The First AI-Orchestrated Espionage Campaign: Why Edge Defenses Must Detect Agents
Key takeaways
- →Anthropic reported that a state-sponsored group used Claude Code as an autonomous agent to run most of an espionage campaign.
- →The agent made thousands of requests, often several per second. Human operators only intervened at a handful of decision points.
- →AgentHunter detects this pattern of agentic reconnaissance and staged exploitation at the edge, before it turns into an intrusion.
- 1
Agent maps target attack surface
- 2
Autonomous vulnerability probing
AgentHunter identifies agentic reconnaissance cadence and deceives / blocks the campaign
- 3
Exploit generated and executed
- 4
Credentials harvested, lateral movement
- 5
Data categorized and exfiltrated
- Affected
- Tech, finance, chemical and government organizations
- When
- Disclosed November 2025
- Impact
- A small number of successful intrusions
What happened
In November 2025 Anthropic published an account of a campaign it attributed with high confidence to a Chinese state-sponsored group. The attackers broke tasks into small, innocent-looking steps and had an AI agent perform reconnaissance, write exploit code, harvest credentials and sort stolen data. Anthropic estimated that AI performed 80–90% of the tactical work.
Why traditional edge defenses struggle
Each request looked unremarkable. The agent adapted when blocked, used legitimate tooling and moved faster than any human team. Fingerprinting and rate rules see sessions. They don't see a campaign being reasoned through.
How AgentHunter would have stopped it
AgentHunter correlates activity into campaigns and recognizes the shape of agentic work: systematic enumeration, hypothesis testing and fast retries with variations. It then responds per campaign.
- Agentic reconnaissance detection across sessions and IPs
- Deception responses that poison the agent's map of your environment
- Automated containment before exploitation succeeds
The lesson
Every incident in this series shares one root cause: an AI system acted with real authority, and nothing in the stack was checking whether that action made sense for its task, its Principal or its environment. That's the gap AgentHunter was built to close, with zero integration and deployment measured in days.
See AgentHunter on your own environment
Zero integration. Live in days. We'll show you what your current stack is missing.