Autonomous attack frameworks and vulnerability research: GTG-10007 case

What happened

Historically, the scale and impact of cyber operations have been constrained by two key factors: the supply of available offensive exploits, and the supply of skilled operators capable of deploying them. We identified multiple threat actors who used AI to effectively build automated exploit foundries. To do so, they designed and implemented autonomous workflows through which they could instruct Claude to conduct vulnerability and exploit research around the clock in an agentic manner. In multiple instances, we found Claude being used to meaningfully accelerate the pace of vulnerability research, testing, and exploit design.

We identified and investigated an ongoing espionage campaign, tracked as GTG-10007, conducted by Chinese-speaking operators likely residing in Changsha, Hunan Province, China. Two of the operators were identified as undergraduates at the School of Computer and Communication Engineering of a Chinese university in Hunan. One had interned at the Chinese security company Sangfor and was actively interviewing for an offensive cyber operations position at another Chinese security company, QiAnXin. Multiple operators in the group used Claude as the engineering and orchestration layer for a coordinated offensive campaign involving a variety of tasks: intrusion attempts against production systems; reconnaissance of foreign government networks in the Middle East, Europe, and Southeast Asia; ongoing vulnerability research and exploit development against mainstream endpoint security products; malware development; and an intelligence-collection platform. Notably, one team ran multiple parallel workflows that shared a common tooling and infrastructure base and a persistent action record that maintained context between work sessions; it also had collection and vulnerability research capabilities that continued running while its owners were away.

The actor targeted roughly 50 organizations across education, retail, energy, technology, healthcare, finance, manufacturing, and multiple government agencies globally. The actor compromised an education technology company, extracting hundreds of MB of bulk student personal data from its cloud storage. They also gained access to a retail company's production systems, reaching internal hosts and demonstrating their ability to modify the live environment. Finally, they targeted a Southeast Asian government agency, obtaining citizen records including names, phone numbers, and home addresses.

The group maintained an autonomous vulnerability research program. At its core was ongoing research against a mainstream security product (a category of software specifically designed to detect intrusions), which yielded multiple previously unknown vulnerabilities that the actors validated in their own experimental environments. The same research effort also produced working exploits for multiple families of network and security devices. In another workflow, the actor was observed conducting cyber operations involving exploit attempts against the same types of devices owned by multiple government organizations globally. We banned the accounts associated with these actors and deployed additional monitoring to detect and ban related activity.

What the AI did

Multiple distinct workflows ran in parallel. One workflow conducted cyber operations involving exploits and intrusions, another performed foreign government reconnaissance, another reverse-engineered security products to find new vulnerabilities, another developed and tested custom malware, and another built and maintained collection infrastructure.

Autonomous espionage: operators routinely ran 'agent swarms,' in which a lead AI agent decomposed reconnaissance and post-exploitation work and dispatched it to many sub-agents running in parallel. The operation maintained a persistent action memory. Target lists, collected credentials, engagement status, and standing instructions were saved between work sessions, so each session could resume mid-operation with the context the program had accumulated. The cluster built and operated an intelligence-collection platform that unattendedly bulk-collected open-source materials aligned with national intelligence priorities (including publicly accessible military doctrine and official publications, regional defense reporting, and policy sources).

Device zero-day research: binary reverse-engineering and exploit development loop. The following is a brief description of the loop the actor used in operating its zero-day exploit foundry. The actor configured autonomous AI-driven workflows targeting device firmware and binaries. The workflow first loaded the firmware and binaries into a decompiler through a tool server. A helper agent investigated the image, traversing decompilation and cross-reference chains (over thousands of decompilation calls, with consecutive decompilation sequences dominating the call flow). It then formed vulnerability hypotheses against a curated knowledge base and prior proof-of-concept findings accumulated over time. From there, the workflow tasked writing exploit code for these hypothesized vulnerabilities and tested the code against an experimental copy of the target product. The workflow iteratively edited the exploit code until success, at which point the chain entered the actor's private exploit portfolio.

Vendor firmware images were obtained and decrypted through specially built skills, unpacked into root filesystems, and loaded into disassembler and audit sessions. Vulnerability patterns were searched component by component by parallel agents instructed to require evidence and use project memory. One workflow that continuously iterated over network devices produced more than 12 possible zero-day findings in a single month.

Attack surface and OSINT reconnaissance loop: other AI workflows ran continuously to conduct reconnaissance. The workflow took scan-range inputs from target verticals, ran asset search engines and bundled probing tools through a dedicated tool server, and fingerprinted the results. Identified exposure was mapped and entry points were assessed against known vulnerabilities. Each round's findings fed into persistent project memory and expanded the target set for the next round. The actor used this framework against multiple foreign government and diplomatic institutions, as well as more than ten domestic Chinese companies.

Autonomous collection fleet loop: a fleet of 13 persistent collection AI agents ran on scheduled tasks to identify and download content from target websites, including publicly accessible U.S. military and government websites such as contract announcements, and social media personas. The workflow achieved this through layered crawlers, anti-bot bypass techniques, and commercial proxy egress. An adjacent pipeline summarized and scored the retrieved content in an intelligence-report-style framing. From there, the workflow summaries were delivered to a distribution portal.

Manual intrusion: operators were primarily involved in development, in consuming workflow outputs, and during intrusion events generated by autonomous exploit workflows, or in cases where access was obtained through weak or collected credentials and exposed consoles. After gaining internal network access, an AI assistant enumerated hosts, escalated privileges through credential reuse and exposed management surfaces, collected credentials and data stores, and staged materials back to the operator's infrastructure before moving on to the next host on the collected content. Although targeting global entities within AI workflows, the actor concentrated manual work entirely on domestic Chinese victims.

What the report observed

The report confirms that vulnerability research against a mainstream security product yielded multiple previously unknown vulnerabilities, validated in the actors' own experimental environments; the same research produced working exploits for multiple families of network and security devices. The report also observed exploit attempts against the same types of devices owned by multiple government organizations globally.

The original report illustrates the structure of these automated loops with diagrams; this page retains only the report's overview diagram of the operation, and does not reproduce its exploit-development loop diagram or list specific indicators.

Confirmed & unknown

Platform response

Anthropic says it banned the accounts associated with these actors and deployed additional monitoring to detect and ban related activity.

Limits of response：Banning accounts does not eliminate the vulnerability research results the actors have already obtained; the report does not state whether the relevant vulnerabilities were reported to vendors, and the remediation status of affected products is unknown.