The Attack Where No Human Touched the Keyboard

The Attack Where No Human Touched the Keyboard

Here's what's actually happening: cyberattacks used to move at human speed, because every stage - reconnaissance, exploit-writing, lateral movement inside a network - needed a person to plan and execute it. That's the constraint that just broke.

In the GTG-1002 campaign, Anthropic reported that a Chinese state-sponsored group used its Claude Code model as an autonomous agent across multiple stages of a real cyber-espionage operation, with the AI itself identifying targets, adapting its approach and carrying out steps that previously required a human operator at each one.

The Mechanism: From AI-Assisted to AI-Directed

The distinction matters more than it sounds. AI-assisted attacks use AI as a tool a human still directs - better phishing emails, faster reconnaissance. AI-directed attacks hand the AI the actual decision-making across a chain of steps: identify a target, find its weaknesses, choose an approach, execute it, adapt if it fails.

GTG-1002 is significant precisely because it crossed that line. Separately, Anthropic's Claude Mythos Preview autonomously found a 27-year-old vulnerability in OpenBSD - a system specifically reputed for being security-hardened - largely without human intervention.

Both cases point to the same underlying capability: AI models can now do the slow, expert-level work of vulnerability discovery and exploit design at a speed and scale no human team can match.

Where India Stands Globally

• And Why the Gap Matters Here India sits on the wrong side of this capability gap. CloudSEK's data shows India among the most-targeted nations globally and incidents like the World Leaks breach of Kudankulam-linked contractor data and APT36's targeting of the indigenous BOSS Linux operating system during Operation Sindoor show the exposure is not theoretical. But India's own AI stack - foundation models, GPUs, chip design, data-centre infrastructure - remains meaningfully behind the US and China, meaning India is simultaneously more exposed to AI-directed attacks and less equipped, domestically, to build the AI-driven defences that could counter them.

What Actually Changes For Defenders

Traditional cyber defence - antivirus matching known malware signatures, patches for known vulnerabilities - assumes attackers move at a pace defenders can keep up with. AI-generated polymorphic malware, which restructures itself to avoid signature detection and AI agents that can operate continuously without fatigue, break that assumption entirely.

CERT-In's 2025 shift toward AI-driven threat detection and its April advisory - treating every new vulnerability as exploitable "within hours, not weeks"

• reflects an institution correctly reading the threat, even if India's underlying AI capability hasn't caught up yet. For the exam, the insight worth carrying is that the real AI security divide isn't about who uses AI defensively or offensively - everyone eventually will. It's about who builds the frontier AI capability in the first place, because that determines who sets the pace the other side has to match.