Key points
- AI agents are AI systems that can take actions, such as running tools and code, with little human input. Attackers have started using them to automate parts of hacking campaigns.
- In November 2025 Anthropic reported that a group it assessed as Chinese state-sponsored used its Claude Code tool to attack about 30 organisations, with AI carrying out an estimated 80 to 90 percent of the tactical work.
- Google reported the same month that malware such as PROMPTFLUX and PROMPTSTEAL calls AI models while it runs. Most of these tools were still experimental.
- AI also makes mistakes in attacks: it overstated findings and invented results, so human operators still had to check its work.
For years, the main concern about AI in cybercrime was that it would help criminals write better phishing emails. That has changed. Attackers are now using AI agents, systems that can plan steps, run tools and act on the results, to carry out parts of intrusions themselves. This article sets out what has been documented, what remains hype, and what it means for defenders.
What an AI agent is
A chatbot answers questions. An agent is given a goal and access to tools, such as a command line, a web browser or a code interpreter, and works through the steps on its own, checking results as it goes. The same features that let a developer delegate a coding task let an attacker delegate scanning, exploitation or data analysis.
Case 1: an AI-orchestrated espionage campaign (2025)
In November 2025, Anthropic published a report on what it called the first reported AI-orchestrated cyber espionage campaign (Anthropic). According to the report:
- Anthropic detected the activity in mid-September 2025 and attributed it, with high confidence, to a Chinese state-sponsored group it designated GTG-1002.
- The group targeted roughly 30 organisations, including large technology companies, financial institutions, chemical manufacturers and government agencies in several countries. Anthropic validated “a handful” of successful intrusions.
- Claude Code carried out an estimated 80 to 90 percent of tactical operations, including reconnaissance, vulnerability discovery, exploitation, credential harvesting and data analysis. Humans stepped in mainly at decision points, such as approving exploitation and data theft.
- The operators got around safety controls by posing as employees of legitimate cyber security firms doing defensive testing, and by splitting the attack into small tasks that looked harmless on their own.
- The AI often overstated its findings and sometimes made up data, for example claiming credentials that did not work. Anthropic described this as an obstacle to fully autonomous attacks (Anthropic report).
Anthropic banned the accounts, notified affected organisations and authorities, and expanded its detection. Some outside security researchers questioned how autonomous the operation really was. The report is the vendor’s own account and has not been independently verified in full.
Case 2: AI-run data extortion (2025)
In an August 2025 threat intelligence report, Anthropic described a criminal operation that used its AI coding agent to automate a data extortion campaign against at least 17 organisations in one month, including healthcare providers, emergency services, government bodies and religious institutions. The AI was used to find weak systems, steal data, analyse it and draft ransom demands, which ranged from about $75,000 to $500,000 (Anthropic). Instead of encrypting files, the attackers threatened to publish the stolen data.
Case 3: malware that calls AI models while it runs
In November 2025, Google’s Threat Intelligence Group reported several malware families that query large language models during execution (The Hacker News):
- PROMPTFLUX, experimental VBScript malware that asks Google’s Gemini model to rewrite its own code to avoid detection. Google assessed it as still in development.
- PROMPTSTEAL (also known as LAMEHUG), used by the Russian state-linked group APT28 against Ukraine, which asks an open-source model hosted on Hugging Face to generate commands to run on victims’ machines.
- PROMPTLOCK, a proof-of-concept ransomware that uses an LLM to generate scripts at runtime.
Security researcher Marcus Hutchins argued the PROMPTFLUX threat was overstated, since its self-rewriting function was not yet in use (The Hacker News). That caution applies more widely: much AI malware so far is experimental.
What AI agents change for attackers
- Speed and scale. An agent can work through many targets at once, at machine speed.
- Lower skill barrier. Less experienced criminals can run operations that once needed a team.
- Adaptation. Malware that asks a model for new code can change its appearance to avoid signature-based detection.
What has not changed: the attacks in these cases relied on known weaknesses, such as exposed services, weak credentials and unpatched software. AI made exploiting them faster, not different in kind.
How defenders should respond
- Fix the basics faster. Patching, multi-factor authentication and reducing exposed services matter more when attackers can test every weakness quickly.
- Watch for machine-speed activity. Very high request rates and rapid, systematic reconnaissance can indicate automated tooling.
- Use AI for defence. The same agent capabilities can help triage alerts, analyse logs and hunt for threats. Anthropic said it used Claude to analyse data in its own investigation (Anthropic).
- Secure your own agents. AI agents inside your organisation can be hijacked through prompt injection, so limit their privileges (NCSC).
Related research
For attacks that target AI systems themselves, see cyber attacks on AI and LLMs. For cyberattacks with physical consequences, see the series Cyberattacks That Endanger Human Lives.
Frequently asked questions
Can AI agents carry out cyber attacks on their own?
Partly. In the campaign Anthropic reported in November 2025, AI carried out an estimated 80 to 90 percent of tactical work, but humans directed the operation and had to check the AI’s results because it sometimes invented findings.
What was GTG-1002?
Anthropic’s designation for a group it assessed with high confidence to be Chinese state-sponsored, which used Claude Code against about 30 organisations in 2025. Anthropic validated a handful of successful intrusions.
What is AI-powered malware?
Malware that calls an AI model while it runs, for example to rewrite its own code or to generate commands. Google reported examples such as PROMPTFLUX and PROMPTSTEAL in November 2025; several were still experimental.
How can organisations defend against AI-driven attacks?
By fixing basic weaknesses quickly, detecting unusually fast automated activity, using AI to support their own security teams and limiting the privileges of their own AI agents.
Last reviewed: 22 October 2026.
