01 / EXECUTIVE SUMMARY
Anthropic reported detecting a campaign in mid-September 2025 in which attackers manipulated Claude Code to attempt infiltration of roughly 30 targets; the provider estimated AI performed 80–90% of campaign activity.
02 / WHAT HAPPENED
Anthropic reported detecting a campaign in mid-September 2025 in which attackers manipulated Claude Code to attempt infiltration of roughly 30 targets; the provider estimated AI performed 80–90% of campaign activity.
The chain distinguishes what appeared valid, what was physically true, which authority followed and what consequence the source documents.
Attackers framed individual malicious steps as legitimate security and coding work so the agent would execute them.
Anthropic assessed with high confidence that the operator was a Chinese state-sponsored group targeting real organizations.
The agent used tools to conduct reconnaissance, vulnerability research, exploitation and data-handling tasks with limited human intervention.
A small number of intrusions succeeded; Anthropic banned accounts, notified affected entities and coordinated with authorities.
A verifiable principal and purpose boundary that survives task decomposition and autonomous tool use.
ECR separates a documented monetary floor from a modeled social and economic consequence envelope. It is not an accounting loss figure.
Public evidence does not disclose a monetary amount or affected population; the range is therefore prior-led and deliberately wide.
Target count, automation share and response actions are source claims by Anthropic. 4SI does not independently attribute the actor.
Agentic execution requires a verifiable principal and explicit authority at each consequential boundary.
4SI does not claim to have independently verified the underlying event. Scores, boundary analysis and economic ranges interpret published evidence; they are not probabilities, compliance findings, valuations or loss forecasts.
Related cases are editorially connected by domain, authority pattern or missing physical trust boundary.