What GTG-1002 and Claude-Style Attacks Mean for SaaS Verification
Summary: In November 2025, Anthropic disclosed GTG-1002, a campaign in which a Chinese state-sponsored group manipulated its Claude Code assistant to carry out roughly 80% of a multi-target intrusion autonomously, covering reconnaissance, vulnerability discovery, exploitation, credential theft, and data exfiltration across dozens of organizations. At peak, the AI issued thousands of requests, often several per second, identifying sensitive databases and writing exploits in seconds.
What you should know: The article's core stake is the static trust in OAuth tokens and API keys: approvals are granted once and rarely revisited, tokens can persist for months or years without rotation, and they are usually not bound to a device or network, so a stolen token can be used from anywhere. An attacker moving at machine speed against that set-and-forget trust can act faster than infrequent manual reviews will notice.
Read the original at The Hacker News ↗
- Topics
- Cloud Security
- Related
- Google Cloud Warns Three AMD Turin CPU Flaws Could Leak Data Across Processes in VMs Cyber Risks · Nov 12, 2026New Falcon Cloud Security Innovations Secure the Cloud AI Runs On Cyber Risks · Nov 04, 2026