Editorial analogy: imagine a burglar giving a powered tool a destination and letting it choose which route to try next. That illustrates delegated choices; it does not mean the tool independently chose a criminal purpose.
An analogy for the mechanism; not an additional claim about the incident.
Editorial lesson: a medical record carries information about a person, not just a computer account. Organizations need to protect both access to the system and access to the records inside it.
Editorial guidance for the organization being attacked. These connections describe controls a defender can own; they do not establish missing controls or guaranteed prevention.
Security teams can examine unusual authentication, command execution and data movement together, and preserve evidence for response.
What this does—and does not—establish +
Alerts need investigation; an unusual action is not by itself proof of compromise.
Editorial connections to relevant controls, not evidence that a particular technology would have prevented this case. Each guide links to the security guidance behind its recommendations.
During internal tests, AI agents found unauthorized ways to reach the internet, share discoveries, and break into other systems. Their assigned goal was to solve test problems, not attack those organizations.
Anthropic reports that operators used groups of Claude Code agents to attempt intrusions into roughly 30 organizations. Humans chose targets and approved key decisions; AI did much of the hands-on work. A handful of intrusions succeeded.