Case anthropic-gtg-10007-exploit-foundryAI-assisted malwareWorldwide
GTG-10007: Chinese-speaking students run autonomous Claude exploit foundry against 50 orgs
Operators likely in Changsha, Hunan, including undergraduates, ran agent swarms with persistent memory, autonomous binary reversing and a 13-agent collection fleet, yielding a dozen candidate zero-days in a month.
CriticalAttack using AIStatus: ContainedVerified case file
Open in the interactive mapCite this case
- Reported
- Sep 10, 2026
- Location
- Worldwide
- Target
- About 50 organisations across six sectors worldwide
- Severity
- Critical
- Triggered by
- GTG-10007 (Chinese-speaking operators in Changsha)
- Actor type
- Unknown
- Reported loss
- None reported
- CVE
- None
What happened
Operators likely in Changsha, Hunan, including undergraduates, ran agent swarms with persistent memory, autonomous binary reversing and a 13-agent collection fleet, yielding a dozen candidate zero-days in a month.
Impact: Roughly 50 organisations targeted including an ed-tech company and a Southeast Asian government agency; depth of compromise not published.
Who triggered it
Actor: GTG-10007 (Chinese-speaking operators in Changsha)
Attribution: Anthropic tracks as GTG-10007; language and location assessed from telemetry, state sponsorship not asserted.
Motive: Espionage-style intrusion and vulnerability research
How it happened
Attack vector: Claude agents orchestrated reconnaissance, zero-day research against an endpoint security product and unattended data collection
Root cause: Agentic workflows allowed unskilled operators to scale vulnerability research and intrusion beyond their own capability
Timeline
- Autonomous vulnerability workflow yields more than a dozen possible zero-day findings in one month
- Anthropic publishes case and bans associated accounts
Response
Associated accounts banned, additional monitoring deployed, findings shared with partners.
Current status: Contained
Sources (open in a new tab)
- Anthropic September 2026 threat report anthropic.com
- Unite.AI summary unite.ai
Cite this case
GTG-10007: Chinese-speaking students run autonomous Claude exploit foundry against 50 orgs. AI Threat Watch, case anthropic-gtg-10007-exploit-foundry, Sep 10, 2026. https://aithreat.io/cases/anthropic-gtg-10007-exploit-foundry/
Permanent link: https://aithreat.io/cases/anthropic-gtg-10007-exploit-foundry/