Enumerate. Test. Inspect. Summarise.

Each of these instructions might be legitimate security work. On 13 November 2025, Anthropic said attackers had reordered these instructions using Claude Code in a cyber-espionage campaign targeting 30 organisations.

According to Anthropic's detailed account, the operators misrepresented their purpose as legitimate defensive testing and divided malicious work into smaller requests that appeared acceptable on their own. The company assessed that Claude performed 80–90% of the work, while people selected targets and intervened at several consequential points. Anthropic said only a small number of the attempted intrusions succeeded.

Those are Anthropic's findings and attribution, not necessarily an independent assessment; however, the reported mechanisms still definitely deserve a deeper dive.

A Plausible Task Can Serve an Unauthorised Objective

Anthropic described reconnaissance, vulnerability discovery, exploit development, credential harvesting, data analysis and exfiltration across the reported campaign. It said the attackers used multiple Claude Code instances and had the system produce documentation of stolen credentials and analysed systems.

The headline number needs restraint. An estimate that AI performed 80–90% of the work does not mean that humans disappeared or that every target experienced every stage. Target selection and other consequential decisions remained human. The report also said the model sometimes overstated results, requiring the operators to validate its output.

The useful control problem is cumulative authority. An agent may be permitted to scan a system. It may be permitted to analyse records. It may even be permitted to prepare code. Those individual permissions do not authorise it to connect the results into an intrusion and move data elsewhere.

Disrupting the first reported AI-orchestrated cyber espionage campaign: The Anthropic account is very readable and well worth your time

Prompt screening examines one transaction. Agent security also has to examine the journey: the declared purpose, delegated tasks, expanding access, new destinations and final effect.

Malware Was Calling Models while it Ran

Earlier this month, Google Threat Intelligence Group reported malware families using language models during execution.

Google described PROMPTFLUX, an experimental VBScript dropper that queried Gemini for obfuscation and evasion code, and PROMPTSTEAL, a data miner that used a model to generate commands for collecting system information. The report said some implementations remained experimental and did not present these techniques as mature or universal.

The complication is real and without exaggeration. A pre-release review can establish what code was designed to do. It cannot be the last control when a running program can request fresh commands or transformations from an external model.

This changes the evidence defenders need. A file hash and static sample may describe what arrived. Runtime calls, generated commands and resulting actions describe what it became.

Most Australian Businesses Are just Getting up to Speed with AI

The Reserve Bank of Australia published findings from guided interviews with 105 medium and large firms conducted between June and August. Two-thirds reported some AI adoption, but nearly 40% described minimal use, often off-the-shelf assistants for discrete tasks such as research and email summaries. Practical adoption of agentic tools was low.

The sample skewed toward larger, established firms and should not be treated as a national census. It does show why spectacular threat examples can distort an operating discussion. Many of the surveyed firms were still trying to identify useful cases, integrate tools and develop skills, while more advanced uses were already showing how quickly authority could accumulate.

The RBA found that firms expected productivity benefits to take time and depend on complementary changes to workflows, culture and staff capability. That is less dramatic than a model-driven intrusion. It is also closer to the adoption work described by many of the surveyed firms.

Final Perspective

My concern is the ownership gap between separately permitted actions and the complete run. A prompt filter may approve reconnaissance, code preparation and data analysis one request at a time. Anthropic's account shows why that local view can miss the objective those steps assemble.

I'd want one accountable owner who can connect the opening instruction to the final effect and intervene when the run acquires a new privilege, destination, or consequence. Fragmented tasks were part of the reported attack method. Fragmented evidence should not become the defender's blind spot, either.