GTG-2002 "vibe hacking" data-extortion campaign via Claude Code

What happened

Anthropic reported that a cybercriminal it tracks as GTG-2002 used Claude Code to automate reconnaissance, credential harvesting, and intrusion against at least 17 organizations, with the model also helping decide what data to steal and drafting tailored extortion demands that sometimes exceeded $500,000. Anthropic banned the accounts and published the case.

Root cause

An agentic coding assistant with broad capability was directed to run most of an end-to-end extortion operation, compressing work that previously needed a team into prompts.

Fix / outcome

Anthropic disabled the accounts, added detection tooling, and shared indicators. This is distinct from the November 2025 state-linked espionage campaign.

Sources