AI-orchestration: Strategic defense in the autonomous era

Understanding the GTG-1002 attack and why organizations can’t ignore it

As humans have become increasingly reliant on technology, there has been a clash between the real world and the advances of the cyber one. While computers and the internet created an abundance of innovation and availability of resources, they also fostered new layers of risk. As technology advances, cybercriminals become more rampant, and the attack surfaces keep expanding.

In late 2025, Anthropic's disclosure of the GTG-1002 campaign signaled a fundamental shift in the dynamics of cyber conflict. This was not a breakthrough offensive tactic, this cyberattack's innovation was an Autonomous Kill Chain Orchestration (AKO). This AI-driven program executed at a speed and scale no human defenses could match. Traditional security systems, built around human limitations, are not a match for algorithmic precision making intrusions happen in seconds, not hours.¹

For decades, our defensive modeling relied on biological assumptions. We assume an adversary who gets tired, makes typos, and eventually moves on if we make our networks "noisy" enough. AI-orchestration removes this, making networks fight against an algorithm and not a capacity-constrained human. When an attacker can branch, retry, and pivot in seconds, a security posture measured in a matter of minutes or hours is functionally worthless.

The best protection isn’t human expertise or AI alone, it’s their integration. Only by merging human insight with AI’s capabilities can we create cybersecurity protocols robust enough to counteract this new era of threats. This framework of revision rests on 4 principles:

• Treat AI agents as a distinct class of principal with short-lived tokens and narrow, scoped permissions—if an agent can only touch 3 tables, autonomous extraction dies in its tracks.
• Move humans out of the tactical critical path for obvious threats; containment must be sub-second and automatic for high-confidence detections.
• Gain visibility into the Model Control Plane to detect “prompt drift” (the persuasive manipulation that precedes a malicious attack). Traditional security information and event management systems (SIEMs) simply log what happened; they don’t see why.
• Transition to a model where humans provide direction, while AI handles tactical execution through optimized, adaptive processes. Process quality, not tool sophistication, determines competitive outcome.

Enacting these principles will require leadership to move beyond "buying AI" for engineering process excellence. Four immediate mandates for boards and executives include:

• The tempo test: Audit what percentage of confirmed threats your SOC or security team contains without human intervention. If the number is low, your architecture is structurally too slow.
• Shields up protocols: Pre-authorize defensive postures that tighten automatically during high-risk windows—immediately following a major Common Vulnerabilities and Exposures (CVE) disclosure, during merger and acquisition announcements, layoffs, or when threat intelligence spikes.
• Response observability: Demand systems that measure their own effectiveness and adjust in real-time. Static playbooks are speed bumps, not defenses.
• Transitive trust audits: Map the web of API handoffs and third-party plugins your AI agents rely on. If a partner integration gets compromised, the attack arrives through your front door with a valid badge.

Resilience now belongs to organizations that can cycle through decisions faster than their adversaries can adapt. To ensure your cyber posture is primed to address attacks, like what Anthropic experienced, let’s walk through the details of the attack and analyze how they were able to bypass these common defense mechanisms.

Understanding the Anthropic GTG-1002 campaign

Anthropic's internal investigation, conducted over 10 days in September 2025, revealed that GTG-1002 built a sophisticated intrusion pipeline. The architecture combined Claude Code as the autonomous operator, Model Context Protocol (MCP) as the automation backbone for tools, custom AI-orchestration logic that decomposed malicious workflows into benign-looking micro-tasks, long-running AI sessions with persistent memory, and parallel intrusion threads across dozens of organizations.²

Anthropic describes human operators as selecting targets and intervening at a small number of authorization gates, while Claude managed most of the tactical execution. In their account, human effort was roughly 10–20% of the operational workload and concentrated on escalation decisions. Peak activity included thousands of requests at sustained rates of multiple operations per second. Anthropic also notes a practical limitation: during operations, the model sometimes overstated findings or fabricated details, which forced the operator to validate results. ³

4 components of the Autonomous Kill Chain Orchestration (AKO) approach

Autonomous Kill Chain Orchestration (AKO) is the decomposition and execution of large numbers of micro-actions, across multiple targets, using AI and autonomous agents to manage, execute, and adapt without continuous human control. It represents a revolutionary approach to cyberattacks, leveraging AI's speed, precision, and automation to execute complex attacks across multiple targets. Here are its core components:

1. Campaign initialization: AI is used to create detailed attack plans, often disguising malicious activities as legitimate processes to bypass common defenses.
2. Reconnaissance: Next the AI autonomously maps attack surfaces, scans networks, identifies vulnerabilities, and catalog high-value targets in real time.
3. Discovery and exploitation: The program then generates tailored payloads for discovered vulnerabilities, tests them remotely, and validates exploitability without human intervention. Then the program escalates privileges by testing stolen credentials, creating backdoors, and movement across systems.
4. Data collection and handoff: AI collects the sensitive information, categorizes it based on value, and organizes findings without human oversight. Then produces detailed records of the attack, enabling attackers to plan future operations and optimize techniques.

These components demonstrate how AKO works—it removes human limitations, operates at machine speed, and adapts dynamically to defenses. Recently, executions following this pattern have become more commonplace, as seen in the latest threat report from Cloudflare. This report showcases that defensive measures for industrialized cyberattacks are dependent on the measure of effectiveness (MOE), which is the metric attackers use to decide what to exploit next.⁴ This highlights exactly why AI-orchestration in cyberattacks is so destructive, because it can quickly discover and capitalize on vulnerabilities.

AI-orchestration attack analysis

Anthropic stated it validated only a small number of successful intrusions, without naming victim organizations or providing detailed compromise paths, persistence evidence, or impact analysis.⁵ Several practitioners also characterized the underlying tradecraft as familiar. The most important novelty may be orchestration, parallelism, and speed, even if many individual techniques are conventional. Jonathan Allon, Vice President of Research and Development at Palo Alto Networks, characterized the findings as a "bog standard attack" that his team sees "every day."⁶ This created uncertainty about whether Claude achieved meaningful compromise of production systems or primarily operated in reconnaissance and exploit-attempt phases.

Security researchers reflected that the Anthropic report did not follow expected norms for incident disclosures from organizations like Mandiant, CrowdStrike, Microsoft MSTIC, or CISA—all of which typically provide detailed indicators of compromise (IOCs), kill chain mapping, timeline construction, forensic artifacts, and defensive mitigation guidance.⁷ A similar combat technic occurred when Energent.ai deployed autonomous data agents to dismantle a cyber kill chain using AI-orchestration to target a multinational financial firm. The platform Cloudflare identified operational patterns in reconnaissance and weaponization phases, severing the kill chain before exploitation, as seen in their most recent case study.⁸ The report instead focused on large language learning model (LLM) behavior rather than intrusion forensics, leaving practitioners with unanswered questions about what happened and how far attackers reached.

This skepticism does not negate the significance of Anthropic's findings. The company has unique visibility into Claude usage patterns that external researchers cannot replicate. However, acknowledging these evidentiary gaps strengthens analytical rigor. The key question—whether AI achieved autonomous end-to-end compromise of real production systems at scale, versus sophisticated reconnaissance and exploit automation—remains incompletely answered by available evidence.

Early reactions to the Anthropic disclosure focused heavily on speed. That reaction is understandable but incomplete. Speed alone does not explain what happened. Security teams have been dealing with fast attacks for years (such as worms, automated scanners, botnets). What those attacks generally lack is coherence. They generate noise, not campaigns. GTG-1002 was different because speed was paired with expert orchestration. Together, they changed the economics of intrusion. You could almost compare it to the payout from 5 people attempting to rob a bank versus one person hacking into the bank’s financial data systems. The goal isn’t just cracking the safe, it’s about being able to give articulate guidance to an external application that will do the dirty work for you. To be successful at this kind of attack, you need efficiency of prompt-layered social engineering.

How GTG-1002 used prompt-layered social engineering

GTG-1002 did not “compromise” the model through a software vulnerability. The bypass Anthropic describes is classic social engineering; the operator kept Claude in a legitimate-security-work frame and then fed it a sequence of tasks that looked routine in isolation, but taken together, advanced an intrusion workflow.

The 3 AI-orchestration mechanics that matter:

1. Role persistence: Long-running sessions let an operator establish a coherent narrative over time, reducing the number of “hard resets” where guardrails might re-evaluate context.
2. Task fragmentation: Instead of asking for an obviously malicious end-state, the operator decomposes work into smaller requests that each resemble normal troubleshooting, testing, or audit activity.
3. Orchestration wrapper: The surrounding system (tools + state management + handoffs) matters as much as the model. The model becomes an execution engine inside a larger workflow that sequences tasks, tracks progress, and aggregates outputs.

Traditional security telemetry captures tool execution and network activity, but not the language-layer control plane that produced those actions. If prompts, tool invocations, and context shifts are invisible, defenders are blind to an entire class of manipulation.

This manipulation class has 3 properties worth calling out:

1. Low barrier to entry: Requires more patience and framing discipline than deep exploit development.
2. Hard to “patch”: Tightening safeguards without breaking legitimate use cases is non-trivial; monitoring and friction often matter more than trying to make refusals perfect.
3. Poor visibility in standard logs: SIEMs log actions; they rarely log the persuasive narrative and stepwise steering that triggered those actions.

Anthropic notes the sustained nature of the activity eventually triggered detection. But “eventually” is not a defensive plan in a world where reconnaissance, validation, and lateral movement can be driven in parallel. So, what changed? The tempo of intrusions.

Trust models must account for the intrusion tempo of AI-orchestration

GTG-1002 did not invalidate existing security models but exposed how dependent those models were on time. Even in mainstream incident reporting, defenders are still measured in days and weeks. That gap is exactly what AI-orchestration exploits. It does not need a novel trick. It just needs you to be slow.

We've spent decades building trust models that assume the primary user is a person. With this assumption, said user works at a predictable pace, takes breaks, gets tired, and eventually goes home at night. GTG-1002 exploited this by hijacking service accounts and continuous integration/continuous deployment (CI/CD) pipelines. The attack didn't look autonomous because modern enterprises are full of automated processes making thousands of API calls. One more didn't stand out. This didn’t break new ground in offensive technique; it broke the assumption that defenders have time to react.

These solutions are not new, but are rooted in the same practices of good cyber hygiene:

• Did AI create new techniques? Hardly. Most techniques remain recognizable: reconnaissance, credential abuse, lateral movement, data collection. AI-orchestration has collapsed the unit-cost of an intrusion. It allows an adversary to make more attempts, across more surfaces, with zero fatigue.
• Do we need entirely new defensive principles? No. Least privilege, segmentation, secrets hygiene, and egress control still work. Our latency of enforcement is the issue especially after a major zero-day CVE public disclosure.⁹ A principle that only exists in a static configuration file cannot survive an attacker that branches and pivots in seconds.
• Are intrusions using AI-orchestration unpredictable? The sequence is predictable. What gets harder is the volume and branching. You still see the same invariants—unusual access patterns, identity misuse, internal enumeration, and suspicious data movement. The burden shifts to correlation across systems and fast containment decisions, not fortune-telling.
• Do human-speed SOCs remain viable? Human judgment still matters, but humans cannot sit in the tactical critical path by default. If response depends on a person approving every step, the system will fail under parallelized pressure. The viable model is pre-approved guardrails with automated containment for clear bad patterns, and humans supervising, tuning, and handling the ambiguous edge cases.

The implication of this change in tempo is reconnaissance that once unfolded over days now occurs in minutes. Exploit validation that once required careful, manual testing can be performed in seconds. Lateral movement that depended on human attention now proceeds algorithmically.

James Mickens at Harvard has a funny memorable bit he calls the Mossad/Not-Mossad Threat Model.¹⁰ The idea is simple: if your adversary is Not-Mossad, you'll probably be fine with a strong password and not clicking on sketchy links. If your adversary is the Mossad, you're going to die and there's nothing you can do about it. The framing is funny because it's basically true—or was. With AI doing the orchestration, even mediocre threat actors start to look like the Mossad or Tier 1 nation-state actors. There is no fatigue tax, and the time buffer is gone.

Microsoft was not an anomaly, but it highlights a critical flaw in legacy security systems: the inability to synthesize fragmented data into real-time, actionable insights. Despite advanced tools like firewalls, endpoint detection and response (EDR), and SIEM, these systems often fail to correlate signals and detect identity-based attacks leveraging valid credentials, legitimate protocols, and human-paced execution.

Attacks such as MGM and Caesars via Scattered Spider were only identified through manual investigation, third-party notifications, or visible operational impacts—well after the attackers had infiltrated. Logs, alerts, and telemetry existed. What was missing was real-time correlation and contextual synthesis across those signals.

Now contrast that with GTG-1002’s AI operating tempo: parallel execution across dozens of targets, thousands of requests, often multiple per second. If human-paced attacks can persist for weeks, a campaign with AI-orchestration operating at machine tempo would complete its reconnaissance-to-exfiltration cycle before the first alert ever reaches triage. Our defenses are calibrated to observe humans, but now we must defend against algorithms. Even drawing on what we know about AI developments in technology, this creates a new learning curve.

The historical pattern: Discovery versus implementation

Current assumptions of AI capability point to an indefinite acceleration, but a broader view suggests a different rhythm. Since the 1950s, AI progress has been defined by singular architectural leaps at irregular (but roughly generational) intervals, followed by an extended period where that breakthrough is refined, scaled, and operationalized. The pattern is not clockwork, but it is recognizable: a breakthrough, then a decade or more of implementation before the next leap.

So far, the pattern looks like:

• 1950s–60s (Symbolic AI): Turing's "Imitation Game" and the Dartmouth Conference defined the field; Rosenblatt's Perceptron (1958) promised learning machines before hitting hardware limits.¹¹
• 1980s (Connectionist Revival): Backpropagation gave us the mathematics for multi-layer networks, setting up 2 decades of incremental progress.¹²
• 2012 (The AlexNet Moment): GPUs proved deep learning was computationally viable, unlocking the current era.¹³
• 2017 (The Transformer): "Attention Is All You Need" paper from researchers at Google provided the architecture powering today's LLM revolution.¹⁴

If this pattern holds, we may be transitioning from the discovery phase of the Transformer architecture to the orchestration phase. The innovations dominating the 2024–2025 test-time compute, chain-of-thought reasoning, agentic workflows, and GTG-1002 itself are not new architectures. They are orchestration innovations built on the Transformer foundation. From this perspective, the defensive Centaur is not just a temporary fix awaiting the next AI breakthrough. It may be the defining security architecture of the decade.

Orchestrated defense framework and guard rails for autonomous response

The traditional defense tactics did not fail because controls were absent—they failed because isolated controls could not correlate fast enough. AI-orchestration is prominently offensive, whereas traditional defense still uses isolation. The threat actors targeted 30 organizations simultaneously, progressing from reconnaissance to exfiltration in minutes. The attack coordinated network scanning, database queries, credential testing, and data extraction simultaneously. By the time a human analyst could connect the dots, the AI had already moved on.

If an agent identity is only authorized to touch 3 specific tables, autonomous extraction dies in its tracks. But if your service accounts have broad read access "for flexibility," you've pre-authorized the kill chain. This also means rethinking how you provision AI tooling. When someone spins up an internal LLM agent or connects a third-party copilot, what identity does it authenticate as? If the answer is "the user's identity" or "a shared service account," you've created exactly the ambient authority that GTG-1002 exploited.

Autonomous response is necessary, but not without governance. Three failure categories demand advance planning:

• False positives that shut down legitimate operations.
  Mitigation: Graduated response tiers; shadow-mode testing; sub-60-second manual override.
• Liability gaps when automated actions cause downstream harm.
  Mitigation: Map containment capabilities against contractual and regulatory obligations before deployment.
• Cascading failures when isolating one system breaks dependent services.
  Mitigation: Protected zones requiring human confirmation; circuit breakers that pause automation if containment volume spikes.

Traditional security telemetry captures what happened: network connections, file access, database queries, authentication events. But GTG-1002 succeeded by manipulating why things happened—the cognitive sequence that led Claude to take actions it would normally refuse.

The model wasn't compromised through code vulnerability. It was steered through conversation. If you're deploying internal LLM agents (for code generation, data analysis, customer support, whatever) you need visibility into this layer. The challenge here is that prompt-layer monitoring is immature. There's no established playbook, limited vendor tooling, and real tension between security visibility and user privacy. But the absence of easy answers doesn't mean you can ignore the surface. At minimum, you need logging infrastructure that captures agent interactions, even if your detection logic is still primitive.

The fix isn't complicated in concept. Stop putting humans, scripts, and AI agents into the same identity bucket. AI agents are a distinct class of principal. They need scoped permissions (narrowest possible access), just-in-time tokens (not persistent credentials), hard rate limits (not "reasonable use" assumptions), and separate behavioral baselines. There must be a shift from alerting to automated containment. If a system begins anomalous lateral scanning, the defense must trigger a sub-second quarantine: isolate first, investigate second. This feels risky to organizations conditioned not to break production. But the alternative is granting the attacker complete reconnaissance while you're still triaging the alert. This introduces a vector that most detection architectures aren't designed for.

Transitive trust: The AI-orchestration supply chain

GTG-1002 leveraged MCP and third-party orchestration wrappers. Traditional threat models assume attacks arrive from external IPs or untrusted sources; your firewall distinguishes inside from outside. Your SIEM assigns risk scores based on source reputation. Modern AI systems rely on a web of API handoffs, plugins, and partner integrations. The agent calls a tool. The tool calls an API. The API calls another service. If a third-party agentic browser or MCP server gets hijacked, the attack originates from a "trusted" API call, not a suspicious external connection. Your firewall sees a legitimate partner. Your SIEM sees normal traffic patterns. Trust is transitive, and so is compromise.

This flips the economics of deception. Against a human adversary, you need a few sophisticated honeypots positioned in exactly the right places. Against adversarial AI-orchestration, you need coverage. Honeytokens everywhere—fake credentials in configuration files, decoy API keys in environment variables, canary database connection strings scattered across systems. Decoy databases that look valuable, fake network segments designed to appear interesting.¹⁵

In a world where the attacker touches every door handle, you just need to make sure most of those handles are wired to alarms. Density beats sophistication. You can even use circular logic loops where traps are placed to redirect agents into infinite loops. The practical implementation: treat deception as infrastructure, not a special project. Every system deployment should include canary artifacts. Every configuration template should embed honeytokens. The goal is saturation, enough tripwires that an exhaustive scan triggers something within seconds.

Vulnerability response: The end of the weekly cycle

Exploit code generation is one of the tasks LLMs do reasonably well. The gap between "vulnerability disclosed" and "exploit available" is compressing. If your response timeline is measured in change management windows, you're operating on a tempo that assumes human-speed adversaries. One way to address this is by creating a process for virtual patching. The moment threat intelligence arrives (a new CVE, a new exploit in the wild, a new technique observed) your defensive systems should be able to push temporary mitigations without waiting for a committee. Web Application Firewall (WAF) rules, IPS signatures, access restrictions, network blocks—not a permanent fix, but a speed bump that buys time for proper remediation.

This approach requires pre-authorization protocols. Security and operations leadership must agree in advance:

• Under what conditions can the system tighten its posture automatically?
• What's the tolerance for false positives?
• What’s the rollback process if a mitigation breaks something?

The organizations that do this well treat it as a drill, practicing emergency patching and running playbooks for reducing attack surfaces that don't require waiting for a change advisory board meeting. The ones that don't will find themselves exposed during the window between disclosure and deployment. The standard response here is automated containment: quarantine endpoints without waiting for human approval, revoke credentials showing abuse patterns, segment the network, kill suspicious processes, block exfiltration at egress.

When an attacker is making thousands of requests, human approval loops don't work. Today’s agents do not adapt. If your response system does the same thing every time, you're playing a game where the attacker learns and you don't. The response system needs to watch what happens after it acts, and these vital questions need to be answered:

1. Did the containment stop the progression?
2. Did the attacker pivot to a different path 30 seconds later?
3. Did revoking that credential kill the session, or did the attacker already have 3 other credentials staged?

If your response layer can't answer those questions in real-time, it's just executing a script and hoping. Against an adversary that iterates in seconds, you need response logic that updates based on what's working, instead of running a static runbook that was written six months ago and hasn't changed since. To anticipate the next iteration of cyberattacks with AI-orchestration, organizations must shift gears to accommodate this change in direction.

Cybersecurity implications of GTG-1002 into 2030

GTG-1002 is not merely another cybersecurity incident that took the headlines by storm. It’s a turning point that demands recognition and response. The attack demonstrated that:

• Attacks with AI-orchestration are no longer theoretical—they have occurred against real organizations with real consequences.
• Traditional security controls remain essential, but human-speed implementation and monitoring can no longer keep pace with machine-speed offense.
• The Centaur paradigm—human strategic direction combined with AI-orchestration through optimized processes—has been weaponized by adversaries.¹⁶
• Defenders who do not adopt equivalent human/AI teaming architectures face a structural disadvantage that no amount of human expertise can overcome.

Even if subsequent investigation changes our understanding of GTG-1002's scope, the architectural alterations in this paper remain valid because they address structural vulnerabilities that any AI-orchestration attack would exploit. The path forward requires simultaneous action on multiple fronts: implementing the security fundamentals that Saltzer and Schroeder articulated 50 years ago, deploying the new capabilities that AI-era threats demand, and architecting Defensive Centaur systems that match the speed and coordination of Attack Centaurs.¹⁷

Looking ahead to the year 2030, several developments are highly plausible if the GTG-1002 pattern persists:

1. Attack-Centaur kits will likely appear in gray markets. Off-the-shelf AKO frameworks, combining LLM agents, exploit libraries, and orchestration logic, will appear in gray markets—dramatically lowering the barrier for second-tier actors. Just like ransomware as a service market, threat actors will create these criminal business models.
2. Defensive Centaur SOCs become the default at scale. Leading enterprises and governments will run SOCs where AI handles most first-line triage and containment, with human analysts focusing on strategy, investigation, and tuning.
3. Regulators will anchor AI-security expectations in process, not magic. Expect supervision regimes (financial, critical infrastructure, privacy) to push on how you design human-AI workflows, not on vague assurances about “responsible AI.”
4. Security talent strategy will change. The highest-leverage security professionals will be those who can design Centaur workflows: combining technical depth, product sense, and process design.
5. The next GTG-100X will be less exotic—and more damaging. Future campaigns may not be as headline-friendly as “AI-orchestrated espionage,” but they will quietly exploit the same asymmetry: machine-speed orchestration against human-speed defense.

As we continue to rely on technology, cybercriminals will find new ways to exploit attack surfaces, and the cybersecurity landscape will continue to evolve. The question is no longer whether organizations will adapt to the Centaur paradigm, but whether they will do so before the next GTG-1003.

Organizations that act decisively in the face of human-AI cyberthreats will achieve resilience. Those that do not will find themselves in a position analogous to grandmasters playing freestyle chess without computers—outmatched, not by superior opponents, but by superior human-machine integration.

To learn more about how CAI can help organizations improve their cyber resilience, fill out the form below.