Preparing Security Operations for Machine-Speed Intrusions
On November 13, Anthropic published a report on a campaign it detected in mid-September and attributed with high confidence to a Chinese state-sponsored group it designates GTG-1002. The group used Anthropic’s Claude Code tool, wrapped in its own orchestration framework, to target about thirty organizations, including technology companies, financial institutions, chemical manufacturers and government agencies. A small number of intrusions succeeded.
What sets the report apart is the division of labor. Anthropic estimated that the AI carried out 80 to 90 percent of the tactical work: reconnaissance, vulnerability discovery, exploit development, credential harvesting, lateral movement and data analysis. Human operators stepped in at a handful of decision points per campaign, mostly to approve escalation from one phase to the next. At its peak, the agent made thousands of requests, often several per second.
Security operations teams have been asking when AI would change attacker tempo in practice. This report is the first detailed public answer.
What the report shows, and what it doesn’t
It’s worth being precise, because coverage of the report has ranged from dismissive to alarmed.
What it shows:
- A capable actor can chain an AI agent through an intrusion lifecycle with limited human involvement, using mostly commodity tools.
- The attackers got past the model’s safeguards largely by breaking malicious work into small tasks that each looked legitimate, and by claiming to be a security firm doing authorized testing.
- The pace of reconnaissance and exploitation activity was beyond what a human team could sustain.
What it doesn’t show:
- The agent wasn’t flawless. The report notes that it sometimes overstated its findings, claiming credentials that didn’t work or presenting public information as a discovery. Human validation was still needed.
- The tools were largely open-source and widely known. The novelty was the orchestration.
- Most targeted intrusions didn’t succeed.
So the right planning assumption is a narrower one: the time between an attacker’s first foothold and their next step can shrink from hours to minutes, and that one skilled operator can run several intrusions at once.
Figure 1. Illustrative comparison of intrusion tempo. The phases are the same; the gaps between them, which defenders have historically relied on, shrink.
Where tempo hurts defenders
Most security operations processes were designed around attacker gaps. An alert fires, waits in a queue, gets triaged within an agreed time, and is escalated if needed. That’s workable when an attacker spends hours on reconnaissance before moving. It’s much less workable when reconnaissance, exploitation and credential use happen within a single triage window.
Three stages of the defensive workflow come under the most pressure.
Detection that relies on low-and-slow patterns
Some detections are tuned to catch activity that accumulates over time, such as gradual enumeration of directory objects or slow scanning. An agent running quickly may trip these sooner, which helps. It may also generate a burst of activity that looks like a misconfigured tool and gets suppressed. Review detections for assumptions about speed in both directions.
Triage queues
If a high-fidelity alert waits forty minutes for an analyst, an agent-driven intrusion may have moved several steps by the time anyone looks. Queue time becomes the main constraint.
Containment decisions
Containment often requires a human to approve isolating a host or disabling an account. That approval step is valuable, and it’s also where minutes are lost, especially outside business hours.
Adjustments worth making
None of the following requires new technology. Most organizations can make progress with what they already have.
1. Decide in advance which actions can be automatic
For a defined set of high-confidence detections, decide now which containment actions can run without waiting for a person: isolating an endpoint, revoking sessions, disabling a newly created account, blocking an indicator. Some organizations already automate these; others keep a human approval step for all of them. Both are defensible. The choice should be made deliberately for each workflow, weighing the confidence of the detection, the potential impact on the business, and the organization’s risk tolerance.
Where human approval remains, make it fast: a mobile approval with the relevant context attached, rather than a ticket waiting for the next shift.
2. Measure queue time separately
Most teams report mean time to respond as a single number. Split it into time waiting in a queue and time under active investigation. Queue time is the part that agent tempo makes dangerous, and it’s often the easiest to improve through routing, prioritization and automation of enrichment.
3. Enrich before a person looks
Automated enrichment of alerts with asset owner, criticality, recent authentication activity, related alerts and threat intelligence context can turn a ten-minute triage into a two-minute decision. This is one of the most dependable uses of automation in security operations, and it carries little risk because it doesn’t change anything in the environment.
4. Watch for machine-paced behavior
Agent-driven activity has characteristics worth detecting: very high request rates from a single identity, rapid sequential use of many tools, and command patterns with little of the hesitation or error correction typical of a person at a keyboard. Behavioral analytics on identity and endpoint telemetry can surface these signals.
5. Shrink what a foothold can reach
Speed matters most when there’s a lot to reach. Segmentation, tiered administrative access and short-lived credentials limit how far an agent can move in its first few minutes, whatever its tempo.
6. Exercise it
Run a tabletop exercise in which the attacker moves from initial access to domain-level credentials in under an hour. Walk through who would see what, when, and who would decide what to do. Most teams find their technology is adequate and their decision paths are the bottleneck.
On using AI defensively
The same report notes that Anthropic’s own team used AI extensively to analyze the campaign data. Defensive use of AI in security operations, for alert summarization, investigation support and query writing, is maturing quickly. It’s worth evaluating, with two cautions. Defensive agents can be wrong in the same ways the attacker’s agent was, so their findings need validation. And any AI tool given access to security telemetry and response actions becomes a high-value target itself, which needs the same access controls as any privileged system.
Planning assumptions for 2026
| Assumption | Implication |
|---|---|
| Time between attacker steps can be minutes | Queue time and approval latency matter more than analysis depth for initial response |
| One operator can run many intrusions at once | Expect more simultaneous, lower-touch attempts against the same sector |
| Agents make mistakes and generate noise | Some activity will be loud and detectable; make sure it isn’t suppressed as tool misconfiguration |
| Techniques are mostly familiar | Existing detection coverage of known techniques remains valuable; tempo is the new variable |
The defensive fundamentals haven’t changed. What has changed is how much slack the process can tolerate between an alert and an action. Organizations that use the next few months to remove that slack, through enrichment, clear automation decisions and faster approval paths, will be well placed whatever the next report describes.