Case · DiggingBeagle record
Anthropic reports a Chinese-speaking espionage operation that ran persistent AI workflows for vulnerability research, reconnaissance and collection, while human operators used the resulting access in real victim networks.
Anthropic threat-intelligence reporting on activity it disrupted. Victim names are generally withheld in the public source.
GTG-10007 is useful because it connects automated exploit research to an operating campaign. Anthropic describes workflows that unpacked firmware, searched components for vulnerability patterns, generated exploit code and tested it against lab copies until a candidate worked. One continuously running appliance workflow produced more than a dozen possible zero-day findings in a month.
The actor also maintained recurring reconnaissance and collection jobs. Anthropic reports 13 standing collection agents that ran on a schedule and a target set of roughly 50 organizations. Human operators still decided when to use access and what to collect, but the surrounding research and reconnaissance kept running while they were away.
The reported impact was not limited to lab results. Anthropic says the group extracted student personal data from an education-technology company, reached a retailer's production environment and retrieved citizen records from a Southeast Asian government agency. The case therefore separates two questions that are often mixed together: how automated the research loop became, and how humans converted its outputs into operational access.
Purpose-built tooling prepares products for static and dynamic analysis.
Boundary: target artifact / analysis environment
Parallel agents search components and use persistent project memory.
Boundary: analysis / hypothesis
The workflow generates exploit code and iterates against lab copies until success.
Boundary: hypothesis / executable exploit
Human operators use outputs and credentials during live intrusions.
Boundary: lab validation / victim network
The September threat report describes exploit-research, reconnaissance and collection workflows.
Locator: GTG-10007 campaign impact
Anthropic reports bulk student data theft and retrieval of citizen records during the campaign.
Locator: GTG-10007 autonomous collection-fleet loop
Anthropic says thirteen standing collection agents ran scheduled collection and summarization jobs.
Locator: GTG-10007 hands-on intrusions
Anthropic reports roughly fifty organizations targeted, including confirmed compromises involving student data, production access and citizen records.
Locator: GTG-10007 appliance zero-day research loop
Anthropic describes a workflow that reversed firmware, formed vulnerability hypotheses, wrote exploit code and iterated until successful lab tests.
diagram
Obtain, decrypt and unpack target product
Search components and retain project memory
Use prior PoCs and evidence to form candidates
Agents write and revise exploit code
Test against lab copies of the product
Successful chain retained by operator
chart
Anthropic September 2026 threat report. The organization count is approximate and the zero-day value is a lower bound because the report says more than a dozen.
| Measure | count |
|---|---|
| Organizations targeted | 50 |
| Standing collection agents | 13 |
| Possible zero-days in one month | 13 |
Exploit-generation systems should be assessed as pipelines, not isolated prompts. Persistent memory, target scopes, test environments and the handoff from lab validation to live targeting determine whether a research capability becomes operational tradecraft.
DiggingBeagle. “GTG-10007 built an autonomous exploit foundry and used the outputs in real intrusions.” First seen Sep 10, 2026. https://diggingbeagle.com/cases/gtg-10007-built-an-autonomous-exploit-foundry-and-used-the-outputs-in-real-intru/
Citation guidanceWhy this archive exists
DiggingBeagle is a non profit research project documenting AI security incidents, agent failures, vulnerabilities and AI-assisted operations. A case keeps its claims beside the sources that support, contest or limit them. Later updates stay visible, so a reader can see when the account changed.
We publish case reconstructions, dated reporting and analysis across records. Each has a different evidentiary role. About the project and our methodology explain how the work is reviewed.