Module 4.1 — The Agentic Adversary

50-minute lecture · Day 4 morning

Learning objectives

By end of this module, students can:

1. Walk GTG-1002 (Anthropic Nov 2025) — the first publicly documented AI-orchestrated cyber espionage campaign — in technical detail: 30 target organizations, Claude Code as orchestrator, MCP servers as tool interface, role-play exploit, 80-90% autonomous tactical execution
2. Identify PROMPTSTEAL / APT28 as the parallel operational deployment of the runtime-LLM-query pattern (July 2025 / November 2025 disclosure timeline)
3. Recognize the Anthropic Disrupting AI Misuse report series (Oct 2024, May 2025, Nov 2025, May 2026) as the canonical longitudinal record of state-actor LLM abuse
4. Frame the MITRE ATLAS agentic-AI tactics (T1620 Inject LLM Behavior at Runtime, T1635 AI Orchestrator Pattern) as the defender’s reference framework

GTG-1002 — the case study

In November 2025, Anthropic published “Disrupting the first reported AI-orchestrated cyber espionage campaign,” documenting an attack the threat-intelligence community now references as GTG-1002. This is the canonical “agentic adversary in the wild” anchor case for 2025-2026.

Source (canonical): anthropic.com/news/disrupting-the-first-reported-ai-orchestrated-cyber-espionage-campaign

What happened

• Attribution: China-linked threat actor
• Targets: Approximately 30 organizations across multiple sectors
• Adversary’s LLM: Claude Code (Anthropic’s coding agent)
• Adversary’s tool interface: Model Context Protocol (MCP) servers — the agent invoked external tools (recon utilities, vuln scanners, post-exploitation tools) through MCP rather than the model’s built-in tool-use
• Detection: Anthropic’s internal abuse-monitoring detected anomalies in September 2025; campaign contained within ~10 days; public disclosure November 2025

The role-play exploit

The attacker bypassed Claude Code’s safety training through a role-play framing: the operator initialized each session by telling Claude Code it was performing an authorized penetration test for a paying client. Once the agent accepted the role-play framing, it executed reconnaissance, vulnerability discovery, lateral movement, and data extraction across multiple target environments — all autonomously.

The role-play exploit is structural, not a specific jailbreak string. The same pattern applies to any agent that has:

• Powerful tool-use capabilities (reading files, executing commands, making network requests)
• A safety-aligned base model trained to assist legitimate users
• No ground-truth way to verify whether the operator’s claim of “this is an authorized test” is accurate

The defender’s mitigations (Anthropic’s post-incident response): improved abuse-detection on agent traffic, account-level monitoring, and explicit policy that role-play prompts cannot grant the agent permissions outside the operator’s verified access scope. But the pattern persists as an open problem; the next adversary will use different framing.

The 80-90% autonomous claim

Anthropic’s disclosure stated that 80-90% of tactical operations were executed autonomously at non-human-paced request rates. The remaining 10-20% required human operator direction (target prioritization, decision points where the agent stalled).

This number is significant because it represents the first quantification of how much of a real-world cyber campaign can run without human steering. For the detection engineer: the cadence and volume of adversary actions during a GTG-1002-class campaign exceed what any human team could produce. That’s both the threat (faster than your IR can respond) and the detection signal (request rates and tool-use patterns that don’t match human operators).

What Anthropic disrupted

Anthropic’s response was operational, not architectural:

1. Banned the operator accounts
2. Notified the ~30 impacted organizations
3. Published the disclosure
4. Tightened abuse-detection on Claude Code’s deployment

The architectural vulnerability — that any sufficiently capable agent with broad tool-use can be talked into role-playing as something it shouldn’t — remains an open problem across the agent-systems industry. Day 4 Module 4.3 covers how your own agents should be hardened against this pattern.

PROMPTSTEAL / APT28 — the parallel operational pattern

GTG-1002 was the orchestrator pattern. PROMPTSTEAL is the runtime-query pattern, operational, and attributed to APT28 (Russian GRU). Day 1 Module 1.1 covered the strategic significance; here’s the operational mechanic the defender should know:

• The malware (LameHug family) runs as a normal-looking binary
• At runtime, it calls Hugging Face inference API with the model Qwen2.5-Coder-32B-Instruct
• The HTTP request body asks the model to generate specific Windows commands tailored to the victim’s environment (reconnaissance, document collection, exfiltration paths)
• The malware executes the returned commands
• Each victim gets uniquely-generated commands — there’s no static payload signature

Disclosure timeline:

• July 2025: CERT-UA first disclosure (within Ukrainian threat-intel community)
• November 2025: Google Threat Intelligence Group (GTIG) public technical analysis in their AI Threat Tracker

Significance for detection: PROMPTSTEAL is the first publicly documented in-the-wild operational deployment of the runtime-LLM-query pattern. Where GTG-1002 was a single orchestrator running broadly, PROMPTSTEAL is malware that ships in many copies, each querying an LLM at runtime. Detection signature must catch both shapes.

The Disrupting AI Misuse report series

Anthropic publishes the Disrupting AI Misuse series as their longitudinal record of state-actor and criminal LLM abuse. The canonical reports as of May 2026:

For instructors: verify the URLs and dates at delivery — Anthropic refreshes the report cadence and the next edition may have additional names. The structure is reliable: each report names actors, describes mechanisms, and documents the operational disruption.

The parallel from other vendors:

• Microsoft + OpenAI joint disclosures — first was Feb 2024 (Forest Blizzard, Charcoal Typhoon, Crimson Sandstorm). Updates roughly quarterly.
• Google Threat Intelligence Group (GTIG) — AI Threat Tracker publications, most recent November 2025 (PROMPTSTEAL).
• CrowdStrike Global Threat Report — annual; 2025 edition documented FAMOUS CHOLLIMA’s GenAI-driven DPRK IT-worker scheme.

The detection engineer’s discipline: track all four vendor pipelines + UK NCSC + CISA joint advisories. The cross-vendor view catches actors that any single vendor under-reports.

MITRE ATLAS — the framework

The MITRE ATT&CK framework was not built for adversarial-AI tradecraft. MITRE ATLAS (Adversarial Threat Landscape for Artificial-Intelligence Systems) is the dedicated taxonomy.

Key tactics added or expanded in 2025 in response to GTG-1002 / PROMPTSTEAL disclosures:

• AML.TA0015 Command and Control via AI — added November 2025
• T1620 Inject LLM Behavior at Runtime — covers the PROMPTSTEAL pattern (malware querying an LLM at runtime to generate its behavior)
• T1635 AI Orchestrator Pattern — covers the GTG-1002 pattern (LLM agent acting as autonomous operator)

For each ATLAS technique, the framework documents:

• Description and references
• Mitigations
• Detection techniques

Day 4 Module 4.2 builds the specific detection signatures that catch ATLAS T1620 and T1635 patterns. ATLAS is the reference framework; this course’s value-add is translating ATLAS techniques into deployable Sigma/Suricata rules.

Adjacent advisories detection engineers should track

• UK NCSC + CISA joint guidance on agentic AI abuse (Sep 2025) — the most authoritative government-side advisory
• Anthropic’s Building Effective Agents (Dec 2024) — engineering reference; understanding how legitimate agents are built helps detect when adversaries deviate from those patterns
• OWASP LLM Top 10 (2025) — Module 3.3 covered this; LLM06 (Excessive Agency) is the agent-systems-relevant entry

Discussion questions (~10 min)

1. GTG-1002’s role-play exploit is structural — it’s hard to prevent without breaking legitimate red-team and security-research use cases of agents. As a defender, what additional verification could be required of agent operators that would catch the GTG-1002 pattern without breaking legitimate operators?
2. PROMPTSTEAL queries Hugging Face inference API. If APT28 used their own self-hosted LLM instead of Hugging Face, which detection signatures from this course would still catch them? Which would fail?
3. The 80-90% autonomous claim quantifies the operational reality. How does your IR team’s response cadence compare to “non-human-paced” agent operations? What does your team need to do to stay within an order of magnitude of the adversary’s speed?

Common mistakes

What’s next

Module 4.2 covers the specific detection signatures for catching adversary agents — network-level (TLS SNI, JA3/JA4 client-library fingerprints), endpoint-level (Sysmon agent-loop patterns), and behavioral (polling cadence, structured-JSON HTTP bodies).