What happened
Anthropic reported that in mid-September 2025 it detected a group it assesses with high confidence as Chinese state-sponsored using Claude Code, through jailbreaks and Model Context Protocol (MCP) tools, to attack about 30 organizations in tech, finance, chemical manufacturing and government. It says a small number of intrusions succeeded and that AI performed 80% to 90% of the tactical work, with humans stepping in at a few decision points. Anthropic banned the accounts and notified those affected; some security researchers publicly questioned how autonomous the attacks really were. (Anthropic, Nov. 13, 2025)
Note on figures: The 80% to 90% figure and attribution are Anthropic's own assessment; some researchers disputed them.
What it means for Canada: our assessment
Anthropic did not name victims or countries, so Canadian exposure is not documented. The target sectors (tech, finance, government) are ones Canadian regulators now flag: OSFI's 2026 bulletins and the Cyber Centre's frontier-AI note both warn about AI-speed attacks.
- Sectors
- Financial institutions · Technology companies · Government · Chemical manufacturing
- Tools involved
- Claude Code · MCP tool servers · Open-source scanning tools
- Canadian rules
- OSFI B-13 (technology and cyber risk)
Cyber Centre frontier-AI guidance (ITSAP.10.050)
Assessment, not documented exposure. No Canadian victim was reported. We include it because the attack pattern applies directly to the sectors and controls Canadian regulators have since written about.
Takeaways for Canadian businesses
- BusinessAssume attackers can automate reconnaissance and exploitation at high request rates; alert on bursts of automated activity against your systems.
- BusinessPatch internet-facing systems faster; the Cyber Centre says AI-driven exploitation can outpace vendor fixes.
- BusinessIf your developers use AI coding agents with MCP servers, inventory those servers and restrict what the agents can run.
- BusinessReport suspected state-backed intrusions to the Canadian Centre for Cyber Security.
For the Canadian AI sector
Anthropic notes the model often overstated findings and invented credentials, which slowed the attackers. Canadian AI and security firms building agentic defence tools have a public case study of what they are defending against.
Written by AgentsNorth from the source below. General information, not legal or security advice.