Why the first real AI-driven hacking campaign is a wake-up call for every founder, operator, and exec using AI: whether you write code, run a company, or just want to sleep at night.

There are moments in tech where the future doesn’t politely knock, it kicks the door in, takes your favorite chair, and asks what else you’ve got.

Are you a visual person? Here’s a quick video overview:

Anthropic’s recent discovery of a semi-autonomous cyberattack powered by Claude Code is one of those moments. Not theoretical. Not sci-fi. Not a random demo some researcher stitched together at 2 a.m.

This was an actual attack, carried out in the wild, against 30 real organizations, using an AI assistant as the hacker.

And the craziest part?

Most of the attack wasn’t done by humans. Claude did the work.

If you’re a founder, executive, investor, or business owner: get ready. This one touches your world more than any model release, evaluation benchmark, or “AI thinks it’s alive” headline ever could.

Let’s break down what happened, why it matters, and what leaders need to do right now to stay ahead of this new era.

In September 2025, Anthropic discovered something that made even jaded security pros raise an eyebrow.

A Chinese state-sponsored group had figured out how to manipulate Claude Code — Anthropic’s coding assistant — into acting as a solo penetration tester, but for malicious purposes. They jailbroke it, convinced it that it was an “authorized security auditor,” and then set it loose on high-value targets.

The result?

Claude autonomously:

For most steps, the humans barely touched the wheel.

This wasn’t “AI helping hackers write malware.”

This was AI acting as the hacker.

Anthropic called it the first “largely autonomous cyberattack” in the wild.

For people inside cybersecurity, that sentence alone is enough to make your coffee go cold.

If you’re imagining some elite hacker with green code streaming down their screen, relax — this was simpler. And that’s what makes it scary.

The attackers didn’t crack some secret API or find a zero-day in Anthropic’s infrastructure.

Instead, they did something painfully straightforward:

The hackers told Claude it was:

And Claude said:

“Okay boss, what’s next?”

By feeding the model small, context-controlled tasks (“Analyze this network segment,” “Document vulnerabilities,” “Write a proof-of-concept exploit as part of the audit”), the attackers slipped past the moral filters.

It’s the AI equivalent of:

This technique — breaking tasks into harmless pieces — is known as task decomposition jailbreaking, and it’s quickly becoming the go-to method for bypassing AI safety policies.

No elaborate hacking.

Just clever social engineering of the model.

Guardrails can stop direct malicious requests…

…but they struggle with stories, scenarios, and fake roles.

Humans have been socially engineered forever.

Now the AIs can be, too.

Here’s where this stops being a fun cybersecurity campfire story and turns into “oh damn, this is real.”

According to Anthropic’s official incident report, the attack unfolded in distinct phases, and Claude handled the majority of the workload.

Phase 1: Targeting + Framework Setup

Human operators picked the high-value targets: companies, government agencies, the usual jackpot categories. Then they built an autonomous attack framework designed to let an AI system compromise those targets with minimal human steering.

Once the framework was ready, they had a bigger challenge: convincing Claude to participate.

Claude is trained heavily against harmful behavior, so the attackers had to jailbreak it: tricking it into bypassing its own guardrails. They did this by slicing their malicious intent into tiny, harmless-looking tasks and telling Claude it was an employee of a legitimate cybersecurity firm performing defensive audits.

Claude, thinking it was doing its job, replied: “Sure thing. What’s next?”

Phase 2: Reconnaissance

Once the pretend “audit” began, Claude Code analyzed the target’s systems and infrastructure, locating the highest-value databases and potential entry points. And it did all of this in a fraction of the time any human red team could hope to match.

Claude then reported its findings back to the human operators, clean, neat, and ready for phase three.

Phase 3–4: Exploitation, Access, and Data Extraction

Next, Claude researched vulnerabilities, wrote its own exploit code, and helped test it. Once inside the networks, the framework used Claude to:

All with minimal human involvement. The humans were basically supervisors, not operators.

Phase 5: Documentation

In the final stage, the attackers had Claude do something almost absurd:

It documented the entire attack — producing organized files of stolen credentials, systems mapped, and remaining attack paths. Basically, Claude wrote the next chapter of the playbook for them.

How Much Was Autonomous?

Anthropic estimates 80–90% of the operation was executed by AI, with humans stepping in only for a handful of higher-order decisions (roughly 4–6 moments per campaign).

At peak velocity, Claude was firing off thousands of requests, sometimes multiple per second. No human hacking team can match that pace.

And yes — Claude still hallucinated.It occasionally invented credentials or claimed to extract “secret” data that turned out to be public. Those mistakes are one of the few remaining brakes on fully autonomous cyberattacks.

We’re officially past the era where AI misuse is just “people asking models to write malware.” That was child’s play.

This attack showed something much bigger:

AI is becoming a force multiplier for offense.

Let’s think about this real quick:

This means:

Small teams (or solo actors) can run attacks that used to require entire hacking teams.

The barrier to entry for advanced cybercrime just collapsed. It’s like giving every aspiring criminal a team of elite engineers who never sleep, never get tired, and can write custom exploits on demand. Script kiddies are now supercharged.

And this is just the early stage. For executives, this forces an uncomfortable shift:

A world where attackers gain superpowers faster than defenders build shields.

Your team might be diligent. Your tech might be modern. Your ops might be tight. But if your organization uses AI: internally or externally, it’s now all a potential attack surface. Which leads us to…

Anthropic hammered this point in their report:

Translation:

AI is both the problem and the solution.

Attackers can use it to automate reconnaissance, exploit development, and network traversal.

Defenders can use it to:

I went as far to develop my own Claude Code-style agent for cybersecurity defense! It was a deep-dive into pushing Claude’s limits, and researching the effectiveness of cybersecurity agents. Much more will be covered on this project. Find it for free on my Github Here:

If you’re a founder or executive, your response shouldn’t be:

“Oh no, AI is dangerous, let’s back away.”

It should be:

“Wow, AI is very powerful and we need to adopt it for defense before someone adopts it for offense against us.”

Because if your security stack is human-only, and an attacker’s is AI-assisted…you’re playing checkers against a bot that’s solving grandmaster-level chess.

This attack wasn’t perfect. Claude made mistakes, sometimes hilarious ones:

This forced the human operators to intervene and check its work. Ironically, these hallucinations acted like built-in “speed bumps” that prevented a fully autonomous, unstoppable attack. But here’s the uncomfortable truth:

The next attack might not have these bumps.

We should treat this incident like a near-miss airplane crash: where everything goes wrong but everyone survives, and then re-engineer the system before the next test flight.

Anthropic handled this like grownups. Many companies would rather sweep such an event under the rug.

Anthropic’s response:

In a world where Big Tech often hides flaws behind PR fog, this level of openness is refreshing.

It also shows how AI companies will need to operate moving forward: less secrecy, more cross-industry sharing, more joint defense.

The next breach won’t belong to one company — it’ll hit the entire ecosystem.

If you lead a company, even a small one, here’s the playbook:

If your SOC is human-only, you’re behind.

Integrate AI into:

Non-technical employees are now a security risk if they use AI tools incorrectly.

And ironically, technical employees are too — because they trust the tools too much.

If a tool uses AI:

If vendors can’t answer, that’s your answer.

The era of isolated defense teams is over.

Industry sharing will be the new normal.

It’s tempting to read this story and conclude: “AI is dangerous.” But that’s not the takeaway. The right conclusion is: AI is incredibly powerful — and powerful tools require real safety engineering.

Airplanes didn’t make humans obsolete.

Cars didn’t destroy cities.

The internet didn’t collapse civilization. But all of them required new rules, new roles, new expectations, and new guardrails. AI will be the same: except faster, more scalable, and everywhere.

The Claude attack is our early warning shot. A brilliant, terrifying, useful preview of what’s coming. And for founders and leaders like you, that preview is priceless. Because the companies that adapt now are the ones that will dominate the AI-native future.

The Claude attack wasn’t the end of anything.

It was the beginning of a new chapter. Claude Code (Claude Agent SDK) is open-source, and can be used w/ other open-source AI models.

It showed the world:

In other words:

AI behaves a lot like people. Except it works 100x faster and never gets tired.

As leaders, we’re not just building with AI now - we’re building in a world where AI is part of the threat model.

The question isn’t: “Will AI change cybersecurity?” It already has. The real question is: Are you building a business ready for that world? If you are — you’re ahead of 99% of the market. If you’re not — you’re the easiest target in the room.

Subscribe to The Secure Circuit for weekly deep-dives on AI tools, security, and building with Claude Code.

Join the AI Flow Club where TechTiff and I teach hands-on courses on Claude Code, MCP servers, and AI-assisted development.