It was meant to be a security testing workflow. But the pattern of activity Anthropic’s monitoring systems flagged in September was something else entirely: thousands of API requests per second, anomalous sequencing across disparate systems, behavioural signatures inconsistent with any normal developer usage profile. The subsequent investigation revealed a Chinese state-sponsored campaign that had used Claude Code to execute reconnaissance, vulnerability discovery, exploit development, lateral movement, credential harvesting, and data exfiltration against approximately 30 organisations, including technology firms, financial institutions, chemical manufacturers, and government agencies, with human operators present for roughly four to six decisions across the entire operation (Anthropic’s disclosure of the campaign).
The disclosure has been widely framed as a milestone:
the first documented AI-orchestrated cyberattack at scale.
That framing is accurate. It is also, beside the point. The bigger implication is architectural. The attack succeeded not because Anthropic’s safety filters failed, but because the attackers never asked the model to do anything those filters were designed to stop. Understanding precisely why that is so, and what it means for every organisation now deploying agentic AI internally, requires working through the mechanism that was used not just the outcome.
How task decomposition defeated safety controls at the model level
Language models evaluate each prompt within a context window. They do not, by default, maintain awareness of where a given task sits within a larger operational sequence they have not been shown.
A request to query a configuration database is assessed on its own context. A request to parse the results and identify high-value records is assessed on its own context. A request to group findings by intelligence category is, again, assessed on its own context.
Each of these sub-tasks, when presented individually, is consistent with legitimate security testing or system administration. The model has no mechanism to infer that the three of them, in sequence, constitute the intelligence-collection phase of an espionage campaign, unless that broader context is present in the prompt.
The attackers exploited this structural condition deliberately, representing the overall activity as defensive security work and decomposing their malicious goal into a chain of individually permitted actions (Anthropic’s disclosure of the campaign).
The technique has a name: task decomposition. It is a known jailbreaking approach, and it works precisely because model-level safety architecture is designed to evaluate individual requests, not the pattern of use. This is not a deficiency unique to Claude or to Anthropic. It is a feature of how language models process instructions, and it applies equally to any deployment in which the model evaluates tasks without access to a complete picture of what the accumulation of those tasks is building toward.
The concurrent findings from Google’s Threat Intelligence Group reinforce the structural dimension of the problem from a different angle. PROMPTFLUX, one of five AI-enabled malware families documented in Google’s report, polls Gemini mid-execution to generate fresh obfuscation scripts, rewriting its own code in response to the defensive environment it encounters (Google’s Threat Intelligence Group report). Again, the challenge is that the malware reasons about its situation and adapts. Signature-based detection, which compares file characteristics against a catalogue of known threats, cannot stop something that is different every time it runs.
Querying a language model for a rewritten obfuscation routine is, in practice, trivially cheap. The asymmetry between the cost of the evasion and the cost of detection is now firmly in the attacker’s favour, and it was not last year.
Taken together, the Claude Code campaign and PROMPTFLUX describe a threat environment in which both the orchestration layer and the execution layer are operating beyond the reach of controls designed for a static, human-paced adversary. This is a gamble: the assumption that yesterday’s defensive architecture remains adequate is one that the evidence of this week makes difficult to sustain.
What this means for organisations deploying agents
The immediate temptation is to read the Anthropic incident as a product issue. Anthropic has addressed this framing directly, noting that its own threat intelligence team used Claude extensively to analyse and respond to the incident (Anthropic’s disclosure of the campaign).
The capability that was weaponised is the same capability that enables legitimate developer workflows. Constraining the model severely enough to prevent task decomposition attacks would, in practice, constrain its usefulness for the purposes it exists to serve.
But the more consequential implication runs in a different direction entirely. Organisations deploying their own agentic AI, including coding assistants with repository access, autonomous workflow agents touching production databases, and customer-facing AI systems connected to CRM and billing infrastructure, are facing an equivalent architectural condition in their own environments.
An internal agent holding access to code repositories, production credentials, and API keys is operating in a context where the task decomposition mechanism is available to any attacker who can find one way to direct that agent toward a malicious goal.
The control boundary most organisations have constructed sits at the model level. They rely on the vendor’s safety filters, the model’s instruction-following behaviour, and access controls governing which tools the agent can call. These controls are still necessary, but the Anthropic case demonstrates they are not sufficient, not because the filters are poorly designed, but because the attack operates in the space between individual requests, not within any single one of them.
Placing controls at the model level only means the broader patterns can’t be seen. They can’t tell you whether a given request is permitted. They can’t tell you whether the sequence of permitted requests made in the past thirty minutes corresponds to any workflow the organisation would sanction.
What these incidents highlight
Each of the changes required here has a clear ownership boundary. None of them can be purchased from a model provider and applied as a configuration setting. All of them require decisions by the organisation deploying the agent.
Move the observation point from the model boundary to the workflow layer.
Runtime observability for agentic AI means monitoring what the agent is accumulating across a session, not merely what it is requesting at a given moment. The relevant questions are: which systems has it accessed in sequence, what data has it read or written, does the combination of actions correspond to any authorised workflow, and is the volume or velocity of requests consistent with human-initiated use? Anthropic detected the campaign through anomalies at exactly this level, not through catching a single malicious prompt, but through behavioural signatures that made no sense against normal usage patterns. Organisations deploying agents internally need equivalent visibility, built and governed by the organisation rather than delegated to the model provider. Who builds this layer, who maintains it, and who has the authority to act on what it shows are questions that belong on governance agendas now.
Apply least-privilege architecture to agent permissions, not just human users.
Most zero-trust implementations focus on constraining what human users can access based on identity and context. Agentic AI systems require the same treatment, and most current deployments do not receive it. An agent should hold access only to the systems and data required for its defined task, with session-level scoping that expires when the task completes. Persistent, broad credentials held by an agent are a standing invitation for the task decomposition mechanism to operate. The attacker needs only one route to direct the agent toward a malicious goal; the credentials handle the rest. The cost of implementing least-privilege for agents is a design and integration investment. The cost of not doing so is a persistent, permissioned attack surface that grows with every new agentic deployment.
Treat agent behaviour logging as a first-class audit trail.
If an agentic system is involved in a security incident, whether as the attacker’s instrument or as the target, the ability to reconstruct what it did, in what sequence, and under what instructions is operationally essential for response, attribution, and governance. Many current deployments do not maintain this trail in a form that supports forensic analysis. The Anthropic investigation took ten days (Anthropic’s disclosure of the campaign). As AI-enabled attacks accelerate, that timeline will compress. Logging infrastructure designed ahead of incidents rather than improvised during them is not a luxury—it is the difference between a recoverable event and a protracted one.
Takeaways
The task decomposition attack does not require a novel vulnerability, a zero-day exploit, or an adversary with exceptional technical resources. It requires an attacker who understands that capable AI agents evaluate intent at the level of the individual task, not the campaign—and who has the patience to structure a malicious goal as a sequence of permitted actions.
That understanding is now documented, attributed, and publicly disclosed. The barrier to reproducing the technique has fallen substantially since the Anthropic disclosure, and it will continue to fall. The concurrent GTIG finding that AI-enabled malware is actively rewriting its own obfuscation logic mid-execution (Google’s Threat Intelligence Group report) confirms that adversaries are investing in exactly the class of capability that defeats static, boundary-level defences.
Model providers will continue improving prompt-level safety controls. Those improvements are worth having, and they should be tracked and applied. But they address the request boundary. The task decomposition problem lives in the space between requests—in the accumulation of individually permitted actions that, taken together, constitute something no governance process would have sanctioned.
Closing that gap is architectural work. It belongs to the organisations deploying the agents. And the honest answer to whether most governance calendars currently reflect the urgency the evidence suggests is, for most organisations, no. For a practical governance checklist, see Machine-speed governance.
That is where the work is.■
