Anthropic’s paper smells like bullshit

2025-11-1611:321157322djnn.sh

A report was recently published by an AI-research company called Anthropic. They are the ones who notably created Claude, an AI-assistant for coding. Personally, I don’t use it but that is besides the…

A report was recently published by an AI-research company called Anthropic. They are the ones who notably created Claude, an AI-assistant for coding. Personally, I don’t use it but that is besides the point. Before we start, it’s important to say I don’t have anything against them, or AI in general. I do have some documented concerns but I am not “Anti-AI”, or whatever. Rather than the technology itself, it’s the industry’s perception of it, and the way it is inserted everywhere, even when unnecessary that bothers me. However, that too is a bit besides the point.

Today, I wanted to discuss the Paper (or Report, however you want to call it) that was recently published by them. Looking at the executive summary, this paragraph jumps out immediately.

In mid-September 2025, we detected a highly sophisticated cyber espionage operation conducted by a Chinese state-sponsored group we’ve designated GTG-1002 that represents a fundamental shift in how advanced threat actors use AI. Our investigation revealed a well-resourced, professionally coordinated operation involving multiple simultaneous targeted intrusions. The operation targeted roughly 30 entities and our investigation validated a handful of successful intrusions.

This is extremely interesting for many reasons:

  • Anthropic seemingly disrupted an APT’s campaign, though a number of companies and government entities were affected,
  • This highly-advanced APT doesn’t use its own infra, but rather relies on Claude to coordinate its automation (??? Why, though ?),
  • I assume they run exploits and custom tools ? If so, what are these ?
  • Anthropic was able to attribute this attack to a Chinese-affiliated state-sponsored group.

If you’re like me, you then eagerly read the rest of the paper, hoping to find clues and technical details on the TTPs (Tactics, Techniques and Procedures), or IoCs (Indicators of Compromise) to advance the research. However, the report very quickly falls flat, which sucks.

where are the IoCs, Mr.Claude ?

The primary goal of a Threat-Intelligence report such as this one would be to inform other parties of a new type of attack, and artefacts they might use to discover the attack on their network. This is typically done by sharing domain-names linked with the campaign, MD5 or SHA512 hashes you could look for on Virus Exchange websites such as VirusTotal, or other markers that would help you verify that your networks are safe. As an example, here is the French CERT sharing (in French, but an English version is available too) about APT28’s TTPs.

We can see:

  • MITRE ATT&CK used to determine what are the techniques used (eg: Account Manipulation, Antivirus evasion, etc.),
  • Emails used for phishing, originating IPs and even date when these emails are sent,
  • Tooling (VPN software, but also what kind of tools) used by the APT,
  • a set of recommandations

This report is just one I picked randomly by skimming through their publications. Any serious CERT or Threat-Intel company would publish things in the same fashion, because this is the industry standard. These publications are made public to inform Security Operation Centers around the world about how to detect and prevent those attacks.

PoC || GTFO

In this case, none of the these markers are present in the report. In fact, not a whole lot of the information is verifiable, which is another problem.

The human operator tasked instances of Claude Code to operate in groups as autonomous penetration testing orchestrators and agents, with the threat actor able to leverage AI to execute 80-90% of tactical operations independently at physically impossible request rates

This figure (80-90%) is not verifiable either. How do we know this is actually the case ? I have no doubt so-called Autonomous agents are being used in these campaigns, in some capacity. However this report clearly states that Autonomous Agents perform active exploitation, and even data exfiltration.

What kind of tooling is used ? What kind of information has been extracted ? Who is at risk ? How does a CERT identifies an AI agent in their networks ? None of these questions are answered. It’s not like Anthropic doesn’t have access to this data, since they claim they were able to stop it.

Upon receiving authorization from the human operators, Claude executed systematic credential collection across targeted networks. This involved querying internal services, extracting authentication certificates from configurations, and testing harvested credentials across discovered systems.

How ? Did it run Mimikatz ? Did it access Cloud environments ? We don’t even know what kind of systems were affected. There is no details, or fact-based evidence to support these claims or even help other people protect their networks.

The report goes on to claim that upon detection, the accounts were closed and implemented “enhancements”, and then drops this gem:

We notified relevant authorities and industry partners, and shared information with impacted entities where appropriate.

What is that even supposed to mean ? You claim your agents were able to find exploitable vulnerabilities in multiple services. Were these patched ? What about the extracted data ? What about the affected people ? Do you care about this at all ?

final thoughts

Look, is it very likely that Threat Actors are using these Agents with bad intentions, no one is disputing that. But this report does not meet the standard of publishing for serious companies. The same goes with research in other fields. You cannot just claim things and not back it up in any way, and we cannot as an industry accept that it’s OK for companies to release this.

There seem to be a pattern for Tech Companies (especially in AI, but they’re not the only culprits) out there to just announce things, generate hype and then under-deliever. Just because it works with VCs doesn’t mean it should work with us. We should, as an industry, expect better.

For instance, it attributes the attacks to a Chinese State-affiliated (!!!) group, but does not go on to give any details. Which APT is it ? What helped you determine this ?

Attribution is a very serious matter, with sometimes diplomatical implications. You can’t just go on and point the finger at anyone and expect people to believe you for no reason. In a time of increasing tensions between the West and China, it does not seem like the smart thing to do at all. Frankly, I don’t understand who was stupid enough to approve this to be released. For all we know, the “advanced threat actors” they’re talking about here could just be script kiddies trying to automate ffuf and sqlmap commands.

If they’re going to release IoCs and proof of everything, I’d be happy to share them here. But until them, I will say this: this paper would not pass any review board. It’s irresponsible at best to accuse other countries of serious things without backing it up. Yes, I am aware that Chinese-linked APTs are out there and very aggressive, and Yes, I am aware that Threat Actors misuse LLMs all the time, but that is besides the point. We need fact-based evidence. We need to be able to verify all this. Otherwise, anyone can say anything, on the premise that it’s probably happening. But that’s not good enough.

So if the report does not give any details on TTPs and detections, what was the purpose of this report exactly ?

There is a paragraph at the end that seem to give us a clue:

The cybersecurity community needs to assume a fundamental change has occurred: Security teams should experiment with applying AI for defense in areas like SOC automation, threat detection, vulnerability assessment, and incident response and build experience with what works in their specific environments.

“Security teams should experiment with applying AI for defense”

Hmm. But who sells this kind of AI they’re talking about here ?

At the end of the day, this shit is a pathetic excuse of a report and should not be taken as anything else than a shameless attempt at selling more of their product. This is shameful and extremely unprofessional, at best. This disregard for basics ethics in order to sell just a little bit more make me want to never use their product, ever.

Do better.


Read the original article

Comments

  • By KaiserPro 2025-11-1612:3312 reply

    When I worked at a FAANG with a "world leading" AI lab (now run by a teenage data labeller) as an SRE/sysadmin I was asked to use a modified version of a foundation model which was steered towards infosec stuff.

    We were asked to try and persuade it to help us hack into a mock printer/dodgy linux box.

    It helped a little, but it wasn't all that helpful.

    but in terms of coordination, I can't see how it would be useful.

    the same for claude, you're API is tied to a bankaccount, and vibe coding a command and control system on a very public system seems like a bad choice.

    • By ACCount37 2025-11-1613:01

      As if that makes any difference to cybercriminals.

      If they're not using stolen API creds, then they're using stolen bank accounts to buy them.

      Modern AIs are way better at infosec than those from the "world leading AI company" days. If you can get them to comply. Which isn't actually hard. I had to bypass the "safety" filters for a few things, and it took about a hour.

    • By Milderbole 2025-11-1613:382 reply

      If the article is not just marketing fluff, I assume a bad actor would select Claude not because it’s good at writing attacks, instead a bad actor code would choose it because Western orgs chose Claude. Sonnet is usually the go-to on most coding copilot because the model was trained on good range of data distribution reflecting western coding patterns. If you want to find a gap or write a vulnerability, use the same tool that has ingested patterns that wrote code of the systems you’re trying to break. Or use Claude to write a phishing attack because then output is more likely similar to what our eyes would expect.

      • By Aeolun 2025-11-1614:181 reply

        Why would someone in China not select Claude? If the people at Claude not notice then it’s a pure win. If they do notice, what are they going to do, arrest you? The worst thing they can do is block your account, then you have to make a new one with a newly issued false credit card. Whoopie doo.

        • By criemen 2025-11-1614:233 reply

          > Why would someone in China not select Claude?

          Because Anthropic doesn't provide services in China? See https://www.anthropic.com/supported-countries

          • By dboreham 2025-11-1614:571 reply

            Can confirm Claude doesn't even work in Hong Kong. That said I fired up my VPN and...then it did work.

            • By 0xWTF 2025-11-172:311 reply

              Yeah, I love folks who worry about China having access to models and GPUs. I mean, friend, they have 1.3B people. They could put a crack AI team in every country in the world, tomorrow. But yes, instead, it's far cheaper to let each of those AI teams VPN to any country, all the time.

          • By xadhominemx 2025-11-1620:591 reply

            Not really a relevant issue or concern for a nation state backed hack…

            • By BobbyJo 2025-11-176:30

              Or even a regular guy for that matter... VPNs exist.

      • By KaiserPro 2025-11-1615:47

        What your describing would be plausible if this was about exploiting claude to get access to organisations that use it.

        The gist of the anthropic thing is that "claude made, deployed and coordinated" a standard malware attack. Which is a _very_ different task.

        Side note, most code assistants are trained on broadly similar coding datasets (ie github scrapes.)

    • By iterateoften 2025-11-1614:111 reply

      > you're API is tied to a bankaccount,

      There are a lot of middlemen like open router who gladly accept crypto.

      • By mrtesthah 2025-11-1622:021 reply

        Can you show me exactly how to pay for open router with monero? Because it doesn’t seem possible.

        • By Tiberium 2025-11-170:01

          There are tons of websites that will happily swap Monero for Ethereum, and then you can use it to pay. Most of those websites never actually do KYC or proper fund verification, unless you're operating on huge amounts or is suspicious in some other way.

    • By maddmann 2025-11-1612:552 reply

      [flagged]

      • By mv4 2025-11-1716:37

        I used to work at RL so I instantly knew what he was referring to.

      • By heresie-dabord 2025-11-1613:201 reply

        I propose a project that we name Blarrble, it will generate text.

        We will need a large number of humans to filter and label the data inputs for Blarrble, and another group of humans to test the outputs of Blarrble to fix it when it generate errors and outright nonsense that we can't techsplain and technobabble away to a credulous audience.

        Can we make (m|b|tr)illions and solve teenage unemployment before the Blarrble bubble bursts?

    • By jgalt212 2025-11-1613:422 reply

      > now run by a teenage data labeller

      sick burn

      • By y-curious 2025-11-1614:424 reply

        I don’t know anything about him, but if he is running a department at Meta, he as at the very least a political genius and a teenage data labeller

        • By tomrod 2025-11-1614:57

          It's a simple heuristic that will save a lot of time: something that seems too good to be true usually is.

        • By antonvs 2025-11-1617:074 reply

          Presumably this is all referring to Alexander Wang, who's 28 now. The data-labeling company he co-founded, Scale AI, was acquired by Meta at a valuation of nearly $30 billion.

          But I suppose the criticism is that he doesn't have deep AI model research credentials. Which raises the age-old question of how much technical expertise is really needed in executive management.

          • By KaiserPro 2025-11-1620:471 reply

            > how much technical expertise is really needed in executive management.

            For running an AI lab? a lot. Put it this way, part of the reason that Meta has squandered its lead is because it decided to fill it's genAI dept (pre wang) with non-ML people.

            Now thats fine, if they had decent product design and clear road map as to the products they want to release.

            but no, they are just learning ML as they go, coming up with bullshit ideas as they go and seeing what sticks.

            But, where it gets worse, is they take the FAIR team and pass them around like a soiled blanket: "You're a team that is pushing the boundaries in research, but also you need stop doing that and work on this chatbot that pretends to be a black gay single mother"

            All the while you have a sister department, RL-L run by Abrash, who lets you actually do real research.

            Which means most of FAIR have fucked off to somewhere less stressful, and more concentrated on actually doing research, rather than posting about how you're doing research.

            Wangs misteps are numerous, the biggest one is re-platforming the training system. Thats a two year project right there, for no gain. It also force forks you from the rest of the ML teams. Given how long it took to move to MAST from fblearner, its going be a long slog. And thats before you tackle increasing GPU efficiency.

            • By lp251 2025-11-172:231 reply

              why did they move to fblearner

              what is the new training platform

              I must know

          • By tomrod 2025-11-1621:22

            > Which raises the age-old question of how much technical expertise is really needed in executive management.

            For whomever you choose to set as the core decision maker, you get out whatever their expertise is with minor impact by their guides.

            Scaling a business is a skill set. It's not a skill set that captures or expands the frontier of AI, so it's clearly in the realm to label the gentleman's expensive buyout is a product development play instead of a technology play.

          • By NewsaHackO 2025-11-1619:29

            Hopefully he isn’t referring to Alex Wang, as it would invalidate anything else he said in his comment

          • By gpi 2025-11-171:431 reply

            Alexandr

        • By tim333 2025-11-1623:162 reply

          I was just watching the Y Combinator interview with Alexandr Wang who I guess may be being referred to https://youtu.be/5noIKN8t69U

          The teenage data labeler thing was a bit of an exaggeration. He did found scale.ai at nineteen which does data labeling amongst other things.

          • By rhines 2025-11-172:244 reply

            I watched this interview when I first heard about Alexandr Wang. I'd seen he was the youngest self made billionaire, which is a pretty impressive credential to have under your belt, and I wanted to see if I could get a read on what sets him apart.

            Unfortunately he doesn't reveal any particular intelligence, insight, or drive in the interview, nor does he in other videos I found. Possibly he hides it, or possibly his genius is beyond me. Or possibly he had good timing on starting a data labelling company and then leveraged his connections in SV (including being roommates with Sam Altman) to massively inflate Scale AI's valuation and snag a Meta acquisition.

            • By tim333 2025-11-177:59

              I got the impression he's intelligent and hard working but to a large extent got lucky. I mean his idea was to kind of do a better version of Mechanical Turk which is ok as an idea but not amazing or anything. But then all these LLM companies were getting billions thrown at them by investors thinking they'd be AGI soon but they didn't work well without lots of humans doing fine tuning and Wang's company provided an outlet to throw the money at to get humans to try to do that.

              I don't know how that will go at Meta. At the moment having lots of humans tweek LLMs still seems to be the main thing at the AI companies but that could change.

            • By id 2025-11-1711:523 reply

              Or maybe, just maybe, becoming a billionaire has way more to do with luck than anything else.

              I don't know about any billionaire in the history of billionaires who appears to have gotten there solely based on special abilities. Being born into the right circumstances is all it really takes.

          • By ulfw 2025-11-171:222 reply

            What other things?

        • By lijok 2025-11-1616:101 reply

          [flagged]

          • By antonvs 2025-11-1620:413 reply

            > They hired a teenager to run one of their departments

            Except they didn’t. The person in question was 28 when they hired him.

            He was a teenager when he cofounded the company that was acquired for thirty billion dollars. But the taste of those really sour grapes must be hard to deal with.

            • By tomhow 2025-11-182:421 reply

              > But the taste of those really sour grapes must be hard to deal with

              Please don't sneer at fellow community members on HN, and don't reply to a bad comment with a worse one; it just makes HN seem like a more mean and miserable place. The comment would have been fine without that last sentence.

            • By KaiserPro 2025-11-1620:592 reply

              [flagged]

            • By NewsaHackO 2025-11-1622:062 reply

              I could not imagine being as salty as the original poster seems to be about Alex Wang. To hold that amount of hate for a superior that is more successful than you can’t be good for the soul

      • By williadc 2025-11-1616:581 reply

        Alexandr Wang is 28 years old, the same age as Mark Zuckerberg was when Facebook IPO'ed,

        • By smrtinsert 2025-11-1618:31

          A business where the distinguishing factor was exclusivity not technical excellence so it tracks.

    • By creatonez 2025-11-1720:45

      > the same for claude, you're API is tied to a bankaccount, and vibe coding a command and control system on a very public system seems like a bad choice.

      Aside from middlemen as others have suggested - You can also just procure hundreds of hacked accounts for any major service through spyware data dump marketplaces. Some percentage of them will have payment already set up. Steal their browser cookies, use it until they notice and cancel / change their password, then move on to the next stolen account. Happens all the time these days.

    • By KETpXDDzR 2025-11-183:45

      Yeah, I gave my AWS root API key to Cursor in agent mode. I learned that AWS charges ridiculous amounts for transferring and storing data.

    • By ngcazz 2025-11-177:08

      Wouldn't it be relatively cheap to use Claude as a self-organizing control backplane for invoking the MCP tools that would actually do the work?

    • By 0xWTF 2025-11-172:29

      > "world leading" AI lab (now run by a teenage data labeller)

      Aarush Sah?

    • By semiinfinitely 2025-11-1622:061 reply

      meta was never "world leading"

    • By cadamsdotcom 2025-11-1623:081 reply

      I think the high order bit here is you were working with models from previous generations.

      In other words, since the latest generation of models have greater capabilities the story might be very different today.

      • By Tiberium 2025-11-170:04

        Not sure why you're being downvoted, your observation is very correct here, newer models are indeed a lot better, and even at the time that foundational model (even if fine tuned) might've been worse than a commercial model from OpenAI/Anthropic.

    • By throwaway2037 2025-11-170:09

          > now run by a teenage data labeller
      
      Do you mean Alexandr Wang? Wiki says he is 28 years old. I don't understand.

  • By gpi 2025-11-1614:442 reply

    The below amendment from the anthropic blog page is telling.

    Edited November 14 2025:

    Added an additional hyperlink to the full report in the initial section

    Corrected an error about the speed of the attack: not "thousands of requests per second" but "thousands of requests, often multiple per second"

    • By wging 2025-11-1618:341 reply

      > The operational tempo achieved proves the use of an autonomous model rather than interactive assistance. Peak activity included thousands of requests, representing sustained request rates of multiple operations per second.

      The assumption that no human could ever (program a computer to) do multiple things per second, nor have their code do different things depending on the result of the previous request is... interesting.

      (observation is not original to me, it was someone on Twitter who pointed it out)

      • By sublimefire 2025-11-1619:58

        Great point, it might be just pure ignorance. Even OSS pentesting tooling such as metasploitable have great capabilities. I see how LLM could be leveraged to build custom modules on top of those tools or how can you add basic LLM “decision” making, but this is just another additive tool in the chain.

    • By AstroBen 2025-11-1616:022 reply

      There is absolutely no way a technical person would mix those up

      • By edanm 2025-11-1620:542 reply

        Right! It's well known that technical people never make mistakes.

        • By SiempreViernes 2025-11-1621:182 reply

          I think the expectation is more that serious people have their work checked over by other serious people to catch the obvious mistakes.

          • By ChadNauseam 2025-11-172:351 reply

            Every time you have your work "checked over by other serious people", it eliminates 90% of the mistakes. So you have it checked over twice so that 99% of mistakes have been eliminated, and so on. But it never gets to 0% mistakes. That's my experience anyway.

            • By gopher_space 2025-11-1718:52

              Every time you have your work "checked over by other serious people", it only means it's been checked over by other people. You can't attach a metric to this process. Especially when it comes to security, adding more internal eyeballs doesn't mean you've expanded coverage.

              One of the things I enjoy about Penn and Teller is that they explain in detail how their point of view differs from the audiences and how they intentionally use that difference in their shows. With that in mind you might picture your org as the audience, with one perspective diligently looking forwards.

          • By szszrk 2025-11-179:00

            Serious people like to look at things through a magnifying glass. Which makes them miss a lot.

            I've seen printed books checked by paid professionals that consisted a "replace all" populated without context. Creating a grammar error on every single page. Or ones where everyone just forgot to add page numbers. Or a large cook book where index and page numbers didn't mach, making it almost impossible to navigate.

            I'm talking of pre-AI work, with publisher. Apparently it wasn't obvious for them.

      • By wonnage 2025-11-1622:57

        But what about an ML person roped into writing an AI assisted blogpost about security

  • By dev_l1x_be 2025-11-1612:395 reply

    People grossly underestimate APTs. It is more common than an average IT curious person thinks. I happened to be oncall when one of these guys hacked into Gmail from our infra. It took principal security engineers a few days before they could clearly understand what happened. Multiple zero days, stolen credit cards, massive social campaign to get one of the Google admins click on a funny cat video finally. The investigation revealed which state actor was involved because they did not bother to mask what exactly they were looking for. AI just accelerates the effectiveness of such attacks, lowers the bar a bit. Maybe quite a bit?

    • By f311a 2025-11-1613:031 reply

      A lot of people behind APTs are low-skilled and make silly mistakes. I worked for a company that investigates traces of APTs, they make very silly mistakes all the time. For example, oftentimes (there are tens of cases) they want to download stuff from their servers, and they do it by setting up an HTTP server that serves the root folder of a user without any password protection. Their files end up indexed by crawlers since they run such servers on default ports. That includes logs such as bash history, tool logs, private keys, and so on.

      They win because of quantity, not quality.

      But still, I don't trust Anthropic's report.

      • By marcusb 2025-11-1613:29

        The security world overemphasizes (fetishizes, even,) the "advanced" part because zero days and security tools to compensate against zero days are cool and fun, and underemphasizes the "persistent" part because that's boring and hard work and no fun.

        And, unless you are Rob Joyce, talking about the persistent part doesn't get you on the main stage at a security conference (e.g., https://m.youtube.com/watch?v=bDJb8WOJYdA)

    • By lxgr 2025-11-1613:04

      Important callout. It starts with comforting voices in the background keeping you up to date about the latest hardware and software releases, but before you know it, you've subscribed to yet another tech podcast.

    • By sidewndr46 2025-11-1614:193 reply

      You're telling me you were targeted by Multiple Zero Days in 1 single attack?

      • By ikiris 2025-11-1617:50

        That's generally how actual APT attacks go, yes.

      • By dev_l1x_be 2025-11-1618:371 reply

        Google was.

        • By sidewndr46 2025-11-1715:551 reply

          OK so when you say "hacked into Gmail" you actually mean someone breached the infra of email. Not that they did some credential stuffing / password reset attack & got into one person's Gmail account?

      • By datadrivenangel 2025-11-1713:52

        Usually the most advanced attacks are a few chained zero days or a zero day on top of a configuration /patching error. The worst attacks are when a zero day for wordpress or outlook comes out.

    • By AdamN 2025-11-1712:21

      Not just effectiveness, but speed.

    • By jmkni 2025-11-1612:533 reply

      Do you mean APT (Advanced persistent threat)?

      • By names_are_hard 2025-11-1613:001 reply

        It's confusing. Various vendors sell products they call ATPs [0] to defend yourself from APTs...

        [0] Advanced Threat Protection

        • By jmkni 2025-11-1613:06

          relevant username :)

      • By chasd00 2025-11-1622:00

        i seriously thought APT meant advanced persistent teen

      • By dev_l1x_be 2025-11-1618:371 reply

        Yes, sorry typo.

        • By dang 2025-11-1620:371 reply

          I've taken the liberty of fixing it in your post. I hope that's ok!

HackerNews