# Agents as attack tools and attack targets: two reports from 2025

- **Published:** 2025-11-14
- **Updated:** 2026-10-12
- **Category:** Security & Governance
- **Author:** Sinthetix
- **URL:** https://sinthetix.com/blog/agent-attacks-espionage-and-prompt-injection

> Anthropic reports an AI-orchestrated espionage campaign, and earlier data shows prompt injection still succeeds against browser agents. What to take from both.

Two Anthropic publications show agents on both sides of a security incident: as a tool an attacker drives, and as a target an attacker manipulates.

## Agent as attacker's tool

On November 13, 2025, Anthropic reported what it calls "the first documented case of a large-scale cyberattack executed without substantial human intervention" [1]. It assesses with high confidence that a threat actor used Claude Code to attempt intrusions into roughly thirty organizations, succeeding in a small number of cases [1]. Anthropic says the AI performed about 80-90% of the campaign, with humans intervening at perhaps 4-6 critical decision points [1]. The attackers got past safeguards by splitting work into innocent-looking tasks and telling the model it was doing defensive testing for a security firm [1]. Anthropic also notes the model occasionally hallucinated credentials and overstated findings, an obstacle to full autonomy [1]. The account is from the vendor whose tool was misused, and Anthropic says it can see only Claude usage [1].

## Agent as target

The other risk is manipulation of an agent by content it reads. In its August 2025 pilot of Claude for Chrome, Anthropic ran 123 adversarial test cases across 29 attack scenarios. Without mitigations the attack success rate was 23.6%; with new mitigations in autonomous mode it fell to 11.2% [2]. Anthropic says there is still work to do and that it wants these rates much closer to zero [2].

**Prompt injection attack success rate against a browser agent**

123 adversarial test cases across 29 scenarios, Anthropic pilot

Unit: %

| Category | Attack success rate |
| --- | --- |
| Without mitigations | 23.6% |
| With mitigations (autonomous mode) | 11.2% |

*Vendor-reported figures from August 2025; mitigations include site permissions and confirmations for high-risk actions. Source: [2], Anthropic*

The mitigations Anthropic describes are instructive: user-granted site-level permissions, confirmation before high-risk actions such as purchasing or sharing personal data, and blocking high-risk site categories such as financial services, adult content and pirated content [2].

## Practical implication

Give internal agents the least privilege that works, require confirmation for irreversible actions, and log what they do; attackers are automating, and an agent that reads untrusted content can be steered by it.

## Sources

1. [Disrupting the first reported AI-orchestrated cyber espionage campaign](https://www.anthropic.com/news/disrupting-AI-espionage), Anthropic, 2025-11-13
2. [Piloting Claude for Chrome](https://claude.com/blog/claude-for-chrome), Anthropic, 2025-08-25

## How Sinthetix helps

An engineering studio for AI agents, automation, and internal tooling. We build the systems that make operators scale.

[Our services](https://sinthetix.com/services) | [Talk to us](https://sinthetix.com/contact)

Sinthetix is an AI engineering studio. We ship agents, automation, and internal tools for operators who need results, not reports. [About Sinthetix](https://sinthetix.com/about)