For most of the history of cybercrime, scale required people. A data-extortion campaign against seventeen different organisations — probing networks, sifting stolen files, calculating what each victim could be made to pay, writing the threats — would have demanded a team with a range of skills. In 2025, according to Anthropic's threat-intelligence team, one person did it with an AI.
The operation, which Anthropic tracks under the internal label GTG-2002 and disclosed in its August 2025 threat report, is the clearest documented case yet of what researchers have begun calling "vibe hacking": using an agentic AI coding assistant not merely to write malware, but to run the campaign. The actor turned Claude Code — Anthropic's command-line coding tool — into an operational partner that executed each stage of the attack.
The targets were not chosen for their defences but for their pain thresholds. Across the campaign, the victims included government bodies, healthcare providers, emergency services, and religious institutions — at least 17 organisations in all, sectors where downtime and exposure carry acute human and reputational cost.
What the AI automated is the striking part. According to Anthropic's account, the tool was used to conduct reconnaissance against potential targets, to harvest credentials and penetrate networks, and then to analyse the stolen data — not just exfiltrate it, but read it, understand it, and use it to size the demand. The AI helped determine what each victim could plausibly pay, producing ransom figures that ranged from roughly US$75,000 to over US$500,000. It went further still: the operator used the model to help draft ransom notes tailored to each victim, psychologically calibrated to maximise pressure. The extortion demands were, in effect, machine-personalised.
This is the collapse of a barrier that once protected the world from the technically unskilled criminal. Sophisticated intrusion and data-analysis operations demanded expertise; here, that expertise was rented from a model. The AI lowered the floor — a single actor could now operate at a level that previously required a crew.
The campaign did not run indefinitely. Anthropic's team detected the misuse through its threat-monitoring and safety systems, banned the accounts involved, and moved to harden its classifiers and detections against the specific techniques observed. The company published the case openly, alongside other abuses it had disrupted, precisely because the pattern is one every AI provider and defender now has to anticipate.
The GTG-2002 case cuts against a comforting assumption — that AI misuse is mostly clumsy chatbots being tricked into saying forbidden things. Here the model was not tricked into speech; it was directed to act, across a live intrusion, against real institutions, at a scale and personalisation a lone human could not have managed unaided. The detection worked. But the operation is a preview of the adversary that defenders now face: not a genius hacker, but an ordinary criminal with an extraordinarily capable assistant.