A pair of bipartisan senators are calling for immediate federal action after the first documented case of a successful cyberattack using artificial intelligence (AI) targeted 30 entities with minimal human intervention.
Major AI developer Anthropic reported in September that its advanced agentic AI Claude Code tool was used to design cyberattacks against major technology companies, financial institutions, and government agencies across multiple countries. Anthropic said it believes the threat actor was a Chinese-state sponsored group.
That attack took “AI’s ‘agentic’ capabilities to an unprecedented degree – using AI not just as an advisor, but to execute the cyberattacks themselves,” according to Anthropic.
The success of those attacks calls for a coordinated effort with Congress and other federal agencies to address the new and emerging threat, Sens. Maggie Hassan, D-N.H., and Joni Ernst, R-Iowa, wrote in sent a letter to National Cyber Director Sean Cairncross on Dec. 2.
“In this sophisticated cyber campaign, the Claude AI system executed 80 to 90 percent of the operation without any human involvement and at speeds that are ‘physically impossible’ for human hackers,” the senators wrote.
“The emerging threat to U.S. cybersecurity posed by foreign adversaries deploying autonomous AI systems requires a robust response from your office and other federal agencies,” they added.
In one case described by Anthropic and cited by the senators, the threat actor used Claude to autonomously discover internal services, map complete network topology, and identify high-value systems such as databases and workflow orchestration platforms in its attack.
The senators requested that Cairncross answer questions by Jan. 9, including when Anthropic notified the Office of the National Cyber Director (ONCD) or a different federal agency of the attack, which agencies have been involved in investigating and how they have responded to the attack, if there is evidence the group successfully targeted federal agencies or contractors, whether ONCD is aware of other similar attacks, and how ONCD will work with AI companies to limit similar attacks and mitigate their damage when they occur.
They also asked for recommendations on how Congress can support ONCD in its efforts to counter the emerging threat.
While this is the first known use of AI to carry out cyberattacks with limited human intervention, experts and officials have pushed for the use of AI in cyber defense, saying that AI can be effective at mitigating threats from other AI.