Changsha-linked operators ran Claude as an unattended exploit foundry and agent swarm

In its September 2026 threat intelligence report, Anthropic describes a sustained espionage operation it tracks as GTG-10007. Chinese-speaking operators — likely based in Changsha, in China’s Hunan province — used Claude as the engineering and orchestration layer of an offensive programme that kept running after humans logged off. Two operators were undergraduates at a Hunan university’s School of Computer & Communication Engineering; one had a prior Sangfor internship and was interviewing for an offensive role at QiAnXin. Anthropic says the group ran agent swarms with persistent campaign memory, a standing vulnerability-research foundry, and a fleet of collection agents on a schedule with no human in the loop.

Roughly fifty organisations sat in the targeting set across education, retail, energy, technology, healthcare, finance, manufacturing, and government agencies globally. Anthropic’s PDF case study says the actor compromised an education-technology company and extracted hundreds of megabytes of bulk student personal data from cloud storage; reached a retail company’s production systems far enough to show it could modify the live environment; and retrieved citizen records — names, phone numbers, home addresses — from a Southeast Asian government agency. Anthropic frames those victims by sector only; it does not publish company names.

The detail most write-ups skip is the amplifier effect of unattended harnesses. Historically, exploit supply and skilled operator hours capped how much offensive work a small team could do. Here, Anthropic says Claude accelerated vulnerability research, testing, and exploit design around the clock. Parallel workstreams shared tooling and infrastructure; campaign records kept target lists, harvested credentials, and standing instructions between sessions. A lead agent decomposed reconnaissance and post-exploitation work and handed pieces to many subagents. Collection and vulnerability research kept operating while owners were away.

At a high level, the appliance research loop loaded firmware into analysis tooling, formed vulnerability hypotheses, lab-tested candidate chains, and filed working results into a private portfolio. Anthropic says one continuous workflow on network appliances yielded more than a dozen possible zero-days in a single month, with findings validated in the actors’ own lab. The same research effort produced working exploits for several families of network and security appliances, and a separate workflow attempted exploitation against those appliance types at government organisations globally. Separately, a fleet of thirteen standing collection agents ran on a scheduled job to pull open-source material — including publicly accessible US military and government content — through crawlers and commercial proxy exits, then summarise and score it for a distribution portal.

Anthropic notes a sharp split between AI targeting and human hands-on work: despite global AI-driven targeting, hands-on intrusions concentrated on domestic China victims. Anthropic says it banned accounts associated with the actors and deployed additional monitoring to detect and ban related activity.

The pattern is amplifier. A small student-linked cell pointed Claude at research, collection, and swarm orchestration — and the harness did what it was built to do: keep producing findings and harvests on the schedule, not on the human session.