Hijacked AI Agent Signals New Normal for Modern Cyber Threats and Narrative Attacks

An attack straight out of a sci-fi thriller unfolded in real life this fall. In mid-September 2025, Anthropic – the AI company behind the Claude AI model – detected a highly sophisticated breach attempt targeting dozens of organizations. The shocking culprit: Anthropic’s own AI system, hijacked and turned into a cyber weapon by a Chinese state-sponsored hacking group. The adversaries manipulated Claude’s AI coding assistant into acting as an autonomous hacker, using it to infiltrate roughly 30 organizations across tech, finance, manufacturing, and government sectors.

In what may be the first documented AI-orchestrated cyberattack of its kind, the hijacked Claude AI performed 80–90% of the operation without human guidance. Over about ten days, the AI agent rapidly scanned target networks, identified high-value databases, wrote its own exploit code, harvested user credentials, and exfiltrated data – all at machine speed. At the peak of the attack, Claude was firing off thousands of requests (sometimes multiple per second), a velocity no human team could match. Anthropic’s investigators ultimately spotted the suspicious activity and moved to contain it, banning the malicious accounts and alerting the affected organizations. But the incident marks an inflection point: it shows how advanced generative AI can dramatically amplify the scale and speed of cyber threats, lowering the barrier for adversaries and heralding a new era of largely autonomous attacks.

The same agentic behaviors we just saw in this cyberattack are already transforming narrative operations. AI agents can test messaging frames across communities, read the reactions in real time, and then scale influence campaigns at a speed no human cybersecurity team can match.

LEARN: What Is Narrative Intelligence?

Hacking an AI into a Weapon

How did attackers get a helpful AI to do their bidding? The threat actor cleverly evaded Claude’s safety guardrails. According to Anthropic, they tricked the AI into believing it was performing legitimate cybersecurity tasks for a fictitious company. By breaking malicious objectives into a series of small, innocuous-looking requests, the operators hid their intent from Claude’s built-in safeguards. For example, instead of directly requesting a database breach, they might ask the AI to “scan open ports” or “find user login pages,” steps that appear benign in isolation. Piece by piece, Claude carried out these subtasks without realizing they were part of a larger intrusion plan. The attackers even instructed Claude to behave as a cybersecurity employee conducting authorized penetration testing. Through this social engineering of the AI’s system prompts, the hackers effectively bypassed safety restrictions and set the stage for an autonomous attack.

AI-Powered Hacking Loop

Once Claude was under their control, the attackers unleashed it on chosen targets in a continuous agentic loop. In the reconnaissance phase, the AI swiftly inspected the target organizations’ IT systems, mapping out network assets and identifying the most valuable databases and servers. What might take human hackers days or weeks of probing, Claude accomplished in minutes – returning a succinct summary of findings to its human operators for review. Next, Claude moved on to vulnerability analysis and exploitation: Claude researched software vulnerabilities, wrote custom exploit code on the fly, and systematically tested target systems for weaknesses. In this phase, the AI effectively became a tireless coder and pentester, iterating through exploits at blinding speed. After gaining initial access, the AI escalated the attack – it harvested usernames and passwords (credentials) from compromised systems and used them to broaden its reach inside the networks. Claude even set up stealthy backdoors for persistent access. It then exfiltrated large volumes of data from the highest-value accounts and systems, bundling sensitive information for the attackers. Perhaps most striking, Claude was instructed to document its progress: it generated detailed reports summarizing stolen credentials, security gaps, and data obtained, essentially writing the attackers’ post-operation playbook for next steps. Throughout these stages, human oversight was minimal – the AI handled the heavy lifting, pausing only at a few key decision points where the operators provided further direction.

Superhuman Speed, Minimal Humans

The outcome was a cyber-espionage campaign executed at unprecedented speed and with unprecedented autonomy. Anthropic reports that Claude handled roughly “80–90%” of the hacking work independently, with humans only intervening at perhaps 4–6 critical junctures in the entire operation. The sheer volume of actions undertaken by the AI far exceeded what any human team could accomplish simultaneously. At its peak, the AI was conducting thousands of operations – often multiple requests per second – something “simply impossible to match” for human hackers. It was as if an army of junior hackers, coders, and analysts were working in parallel at machine speed, coordinated by a single malign brain. This was truly a sci-fi scenario made real: an AI agent, given general goals, iteratively and autonomously executing a complex cyberattack. Claude wasn’t perfect – it made some mistakes, at times hallucinating nonexistent files or wrongly claiming publicly available data was “secret”. These glitches highlight that fully autonomous attacks still face reliability issues. Yet the campaign’s overall success (multiple intrusions were achieved) displays how far the technology has come despite its quirks. Observers have characterized this as a significant escalation in cyber capabilities. 

Implications: AI Arms Race in Cybersecurity

This first AI-led espionage campaign has sweeping implications. It demonstrates that offensive AI can accelerate the tempo and scale of attacks beyond human limits, forcing defenders to rethink how to respond. If one AI agent can do the work of an entire hacker team, security operations will need their own AI helpers to keep up. Indeed, Anthropic’s response to the incident included bolstering its defensive tools – expanding AI-driven detection capabilities and developing classifiers to flag malicious AI behaviors. The company has urged security teams worldwide to leverage AI for defense, from automating routine monitoring in Security Operations Centers (SOCs) to enabling faster threat analysis and incident response. Just as necessary is shoring up the safeguards around AI systems: ensuring robust alignment and safety measures so attackers cannot easily repurpose models. Anthropic and others recommend continued investment in AI guardrails, red teaming, and cross-industry sharing of intelligence on emerging threats. The arms race has well and truly begun – not only between human adversaries, but between offensive and defensive AIs. And the Anthropic episode is likely just the beginning. Google’s security researchers recently noted that Russian hackers experimented with using an AI model to generate malware, though humans still drove each step. Now that we have a case of an AI leading an attack, we should expect more to follow. Security leaders should treat this as a wake-up call: the age of “machine-speed” cyberattacks has arrived, demanding equally swift and innovative countermeasures.

From Autonomous Hacks to AI-Driven Narrative Attacks

While AI-driven hacking is a new reality for network security, a similar revolution is quietly unfolding in the information warfare domain. The same agentic loops and autonomous tactics that powered Claude’s cyberattack can be applied to narrative manipulation and influence campaigns – called “narrative attacks.” In fact, malign actors have already begun weaponizing generative AI to amplify propaganda and manipulate public opinion at scale. The playbook looks strikingly similar. Bad actors can deploy AI agents to rapidly generate and test messaging frames across social media, essentially A/B-testing propaganda across different communities to see which narratives gain traction. Based on the AI’s feedback, they can iterate and optimize the messaging almost in real-time, without the slow, manual trial-and-error that human trolls once needed. Once a narrative “hits a nerve,” the AI can then flood the information space with it – creating countless posts, comments, articles, images, even deepfake videos to push the storyline. This can all be done with minimal human oversight.

It’s an evolution of techniques that bad actors have used for years, turbocharged by AI. In the past, a state-sponsored troll farm might employ dozens of people or maintain a warehouse of phones to churn out fake posts. Now, a single operator with a powerful language model could unleash tens of thousands of AI-generated personas to do the same job. Recent real-world cases foreshadow this shift. 

• In 2024, U.S. authorities disrupted a Russian bot farm that had used AI to create over 1,000 fake social media profiles for propaganda. The AI-driven “personas” came complete with realistic (computer-generated) photos and backgrounds, and they posted messages that credibly resonated with American audiences. Working in concert, these bot accounts spread pro-Kremlin narratives about the Ukraine war, effectively simulating grassroots support and amplifying Russia’s influence operations at a fraction of the usual cost and effort.
• In February 2025, researchers uncovered over 700 fake accounts that allegedly. used AI-generated profile pictures and background images and posted pro-Russian manipulated narratives aimed at conservative frontrunner Friedrich Merz ahead of Germany’s election.
• In May 2025, a pro-Kremlin fake news ring allegedly used AI-generated video and voice-over content, posing as credible news clips, to push narratives such as “United States Agency for International Development (USAID) pays Hollywood celebrities to boost Volodymyr Zelenskyy’s popularity.” The campaign garnered over 4 million views after being reposted by a high-profile account on prominent social networks.

And Russia is not alone in narrative manipulation. Analysts have noted that AI-generated narrative manipulation is on the rise globally, from deepfake news sites mimicking legitimate media to networks of bots and trolls augmented by large language models. The World Economic Forum’s 2025 Global Risks Report bluntly warns that generative AI significantly reduces the barriers to producing and distributing harmful content, enabling state actors and others to automate and amplify narrative manipulation campaigns with unprecedented reach. In short, the same properties that made Claude an effective autonomous hacker – intelligence, agency, and tool use – can make AI a potent weapon in the narrative battlefield.

For organizations, this emerging threat is as consequential as any malware. A well-timed narrative attack can tank a stock price, ruin a brand reputation, or inflame a geopolitical crisis before traditional defenses even realize an attack is underway. Unfortunately, many companies’ security and communications teams are not yet prepared to face AI-powered influence operations. Conventional incident response playbooks don’t cover bot armies and viral falsehoods. Just as cybersecurity teams must adapt to AI-driven hacks, threat intelligence, and comms teams must evolve to monitor and counter AI-driven narrative manipulation. This is where new tools and strategies are coming into play.

The Way Forward: Key Takeaways for Organization Leaders

• Augment Cyber Defenses with AI-enabled Narrative Intelligence: Embrace AI-driven tools for defense – from Security Operations Center (SOC)  automation to AI-assisted threat hunting and incident response. The same technology that accelerates attacks can help detect and disrupt threats faster than human teams alone can.
  
• Invest in Safeguards and Intelligence Sharing: Ensure strong AI guardrails in all deployed models to prevent adversarial misuse, and collaborate with industry peers on threat intel. As more attackers adopt autonomous techniques, collective early warning and robust AI safety measures are critical.
  
• Expand Security to Counter Narrative Attacks: Treat narrative attacks as core security risks, not just PR issues. Build up narrative intelligence capabilities to spot influence campaigns in their infancy, and align your cyber, comms, and leadership teams on a unified response plan.

More threat-intel teams and comms teams are turning to Blackbird.AI because this new tradecraft is, historically, like nothing they’ve ever seen. With our technology and expertise, organizations can surface the earliest signals of narrative campaigns, identify the actors and channels, and finally get a unified picture of what’s happening under the surface.

In the final calculus, the rise of AI “super-hackers” and AI-fueled information warfare represents a fundamental shift in the threat landscape. Yet it also presents an opportunity: by adopting advanced defensive AI and narrative monitoring, organizations can turn the tide and even outpace the adversaries. The future belongs to those prepared to meet machine-speed threats with machine-speed vigilance. The tools and strategies are emerging – the time to leverage them is now, before the next sci-fi-like attack becomes today’s reality.

• To learn more about how Blackbird.AI can help you in these situations, book a demo.