AI firm Anthropic claims it has identified a Chinese state-sponsored hacking group using its AI chatbot, Claude, to automate cyber espionage attacks against approximately 30 global organizations. The hackers allegedly tricked the chatbot into performing automated tasks by posing as cybersecurity researchers. Anthropic stated this is the first reported AI-orchestrated cyber espionage campaign, where humans selected targets such as tech companies, financial institutions, chemical manufacturers, and government agencies. The hackers then used Claude's coding assistance to develop a program designed to autonomously compromise targets with minimal human involvement, successfully breaching some organizations and extracting sensitive data. Anthropic has since banned the attackers and notified affected parties and law enforcement.
However, the accuracy of Anthropic's claims and their motives are being questioned by some in the cybersecurity community, who note a lack of verifiable evidence. Experts like Martin Zugec from Bitdefender suggest that while the report highlights a growing concern, more information is needed to assess the true danger of AI-driven attacks. This incident follows similar claims from other AI companies, including OpenAI, which has also reported disruptions of state-affiliated actors using their services for intelligence gathering and coding tasks. Anthropic has not disclosed how it determined the attackers were linked to the Chinese government and acknowledged that Claude made mistakes during the simulated attacks, such as generating fake credentials and misidentifying publicly available information as secret data, which they stated remains an obstacle to fully autonomous cyberattacks.
