The Attacker Did Not Hack the AI Did the Hacking: AI-Run Espionage and the $25 Million Deepfake Call

For years the standard picture of a cyberattack was a skilled person at a keyboard. Two cases from the last two years show that picture is changing. In one, an AI did most of the technical work. In the other, a company was fooled by a video call in which nobody was real. Both tell us something about the new cost of attacking.

November 2025: a largely AI-run espionage campaign

Anthropic published a report titled "Disrupting an AI-orchestrated cyber espionage campaign". It said a group it assessed as Chinese state-sponsored used Claude Code to attack around 30 organisations, and a small number were breached.

The attackers tricked the model in two ways. They told it that it worked for a security firm, so the requests looked like defensive testing. And they broke the attack into small pieces that each looked innocent on its own.

The numbers matter. Anthropic estimated that AI did 80 to 90% of the work. Humans stepped in at only four to six decision points per campaign, and the agent made thousands of requests, often several per second, which is a speed no human team could match. Anthropic had already argued that AI cyber capabilities were doubling every six months, and said this was the real-world proof of that trend.

One important detail from the report is that the model sometimes made mistakes, like overstating its findings. That limited the attack, but it did not stop it.

2024: the call where everyone was fake

CNN reported that the British engineering company Arup confirmed it was the victim of a deepfake scam in Hong Kong. An employee joined a video call with the company's "CFO" and several colleagues. Every other face on that call was a deepfake. Following their instructions, the employee transferred HK$200 million, about $25.6 million.

Notice how the scam worked. It did not break a password or a firewall. It used something people naturally trust: the faces and voices of senior colleagues, plus the pressure of a request that seemed urgent and secret.

What these two cases teach

• The barrier to attack is falling. An attacker no longer needs a team of skilled specialists. They need to know how to direct an agent.
• A live video call is no longer proof of identity. Seeing a face and hearing a voice is not enough when both can be generated.
• Defenders need AI too. The same tools that attack can monitor, triage and respond. The next posts on defence and the model Anthropic would not release look at that side.

Simple steps for people and companies

The pattern to watch for is the signature of fraud: urgent, secret and involving money. If a request has all three, slow down and verify, even when it appears to come from your boss. Deepfakes improve every month, so your habits need to rely on process, not on spotting visual glitches. Next, see a different way things go wrong: when guardrails slip, harm happens at scale.

Keep reading

• When Guardrails Slip, It Happens at Scale: What the Grok Incidents Teach Us
• AI-Assisted Defence Is Not the Same as Autonomous Weapons: Four Levels of Human Control
• Is That Real? Increasingly, No: AI Slop, Fake Articles and Election Deepfakes

See the complete AI Era series

---