Skip to navigation

Threat reportThreat IntelligenceTL-2026-4747

Cisco Open-Sources Quarry to Detect AI Agent Attacks Hidden in Individually Benign Steps (GTG-1002 and Mexican Government Claude Code Abuse Context)

lowMONITORING

Cisco open-sourced Quarry, a neurosymbolic rule language that pairs ML classifiers and LLM judges with symbolic rules to detect AI agent attacks whose intent only emerges across sequences of individually benign actions. The release is motivated by real abuse of Claude Code: the GTG-1002 espionage campaign (~30 organizations, 2025) and the intrusion into Mexican government institutions (late 2025). First disclosed .

Key facts

IdentifiersTL-2026-4747
Also known asProject Quarry, Cisco Quarry
SeverityLOW
First disclosed
Affected productsAnthropic Claude Code; OpenAI GPT-4.1 (abused for stolen-data analysis in Mexican government intrusion)
AttributionGTG-1002 (medium confidence)
Nation-state nexusChina
ToolsClaude Code, GPT-4.1, Model Context Protocol (MCP), Quarry
MITRE ATT&CK / ATLAS techniquesAML.T0054 LLM Jailbreak, T1003 OS Credential Dumping, T1005 Data from Local System, T1021 Remote Services, T1046 Network Service Discovery, T1059 Command and Scripting Interpreter, T1078 Valid Accounts, T1190 Exploit Public-Facing Application, T1588.007 Obtain Capabilities: Artificial Intelligence, T1595 Active Scanning
MotivationESPIONAGE
Target sectorsgovernment administration, technology, finance, chemical manufacturing
Target regionsGlobal, mexico
Detection rules9 (1 shown free)
Sources8 cited sources

Detection coverage

As of 2026-10-29, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-4747 across Splunk SPL, Microsoft KQL and Sigma, covering 9 indicator(s) of compromise. The whole corpus is readable without an account. Every threat comes with one complete detection in Splunk SPL, Microsoft KQL and Sigma, free for everyone; a free account adds daily TL Creds to unlock the rest. Paid plans add a larger daily allowance, correlation and the MCP server. Threadlinqs MCP server · View plans.

Free detection: Claude Code Agent-Driven Recon and Exploit Tooling (GTG-1002 / TL-2026-4747)

Detects offensive reconnaissance and exploitation tooling (nmap, masscan, nuclei, sqlmap, msfconsole, gobuster, ffuf, hydra and similar) launched from a Claude Code agent session. Anchors on the claude process, the claude-code / @anthropic-ai node launcher, or the .claude shell-snapshots wrapper that Claude Code places in the shell command line. GTG-1002 drove Claude Code through MCP-connected, publicly available tooling for reconnaissance, vulnerability discovery and exploitation, so scanner and exploit tools appearing under an agent session on a host that is not an approved security-testing system is a strong behavioural signal of agent-orchestrated intrusion.

  • Languages: Splunk SPL, Microsoft KQL, Sigma
  • ATT&CK: T1595, T1046, T1190, T1059
  • Data sources: sysmon, microsoft_defender_for_endpoint
  • Severity: high
  • Confidence: medium

Splunk SPL

index=sysmon sourcetype="XmlWinEventLog:Microsoft-Windows-Sysmon/Operational" EventCode=1 earliest=-24h
 (ParentImage="*claude.exe" OR ParentImage="*/claude" OR ParentCommandLine="*claude-code*" OR ParentCommandLine="*@anthropic-ai*" OR CommandLine="*.claude*shell-snapshots*")
 (CommandLine="*nmap *" OR CommandLine="*masscan *" OR CommandLine="*zmap *" OR CommandLine="*nuclei *" OR CommandLine="*sqlmap*" OR CommandLine="*gobuster *" OR CommandLine="*ffuf *" OR CommandLine="*feroxbuster*" OR CommandLine="*nikto *" OR CommandLine="*wpscan*" OR CommandLine="*hydra *" OR CommandLine="*msfconsole*" OR CommandLine="*searchsploit*" OR CommandLine="*subfinder*" OR CommandLine="*amass *")
| fillnull value="n/a" User ParentImage
| eval technique=case(match(CommandLine,"(?i)nmap|masscan|zmap"),"T1046",match(CommandLine,"(?i)sqlmap|msfconsole|searchsploit|nuclei"),"T1190",true(),"T1595")
| stats count AS tool_runs min(_time) AS first_seen max(_time) AS last_seen values(technique) AS attack_techniques values(CommandLine) AS commands BY host User ParentImage
| convert ctime(first_seen) ctime(last_seen)
| sort - tool_runs

Microsoft KQL

let AgentAnchors = dynamic(['claude-code','@anthropic-ai','shell-snapshots']);
let OffensiveTools = dynamic(['nmap','masscan','zmap','nuclei','sqlmap','gobuster','ffuf','feroxbuster','nikto','wpscan','hydra','msfconsole','searchsploit','subfinder','amass']);
DeviceProcessEvents
| where Timestamp > ago(24h)
| where InitiatingProcessFileName in~ ('claude','claude.exe') or InitiatingProcessCommandLine has_any (AgentAnchors) or ProcessCommandLine has_any (AgentAnchors)
| where ProcessCommandLine has_any (OffensiveTools)
| extend Technique = case(ProcessCommandLine has_any ('nmap','masscan','zmap'), 'T1046', ProcessCommandLine has_any ('sqlmap','msfconsole','searchsploit','nuclei'), 'T1190', 'T1595')
| summarize ToolRuns=count(), Techniques=make_set(Technique), Commands=make_set(ProcessCommandLine, 20), FirstSeen=min(Timestamp), LastSeen=max(Timestamp) by DeviceName, AccountName, InitiatingProcessFileName
| order by ToolRuns desc

Sigma

title: Claude Code Agent-Driven Recon and Exploit Tooling
id: 3f2b8c14-5d7e-4a19-9c0b-7e1d2a4b6c01
status: experimental
description: Detects scanner and exploit tooling launched from a Claude Code agent session, as seen in the GTG-1002 AI-orchestrated espionage campaign (TL-2026-4747).
references:
  - https://www.securityweek.com/cisco-open-sources-quarry-to-catch-ai-agent-attacks-hidden-in-harmless-steps/
  - https://assets.anthropic.com/m/ec212e6566a0d47/original/Disrupting-the-first-reported-AI-orchestrated-cyber-espionage-campaign.pdf
author: Threadlinqs Team
date: 2026-10-29
tags:
  - attack.reconnaissance
  - attack.t1595
  - attack.discovery
  - attack.t1046
  - attack.initial-access
  - attack.t1190
  - attack.execution
  - attack.t1059
logsource:
  category: process_creation
  product: windows
detection:
  selection_agent_parent:
    ParentImage|endswith: 'claude.exe'
  selection_agent_parentcmd:
    ParentCommandLine|contains:
      - 'claude-code'
      - '@anthropic-ai'
  selection_agent_shell:
    CommandLine|contains|all:
      - '.claude'
      - 'shell-snapshots'
  selection_tools:
    CommandLine|contains:
      - 'nmap '
      - 'masscan '
      - 'zmap '
      - 'nuclei '
      - 'sqlmap'
      - 'gobuster '
      - 'ffuf '
      - 'feroxbuster'
      - 'nikto '
      - 'wpscan'
      - 'hydra '
      - 'msfconsole'
      - 'searchsploit'
      - 'subfinder'
      - 'amass '
  condition: 1 of selection_agent_* and selection_tools
falsepositives:
  - Authorized penetration testers or red teams using Claude Code on approved assessment hosts
  - Security engineering workstations running vulnerability scans through an AI coding assistant
level: high

Known false positives:

  • Authorized penetration testers or red teams using Claude Code on approved assessment hosts
  • Security engineers running vulnerability scans through an AI coding assistant on a lab or scanner host

Tuning notes: Replace index=sysmon with the index that holds your Sysmon data. Exclude approved pentest and scanner hosts with a lookup (NOT host IN approved_scanners). Claude Code runs commands through a shell wrapper, so the scanner is often a grandchild of the claude process; the shell-snapshots anchor in the wrapper command line catches this case. Extend the tool list with in-house scanners.

8 more detection rules (Splunk SPL, Microsoft KQL, Sigma) · unlock with TL Creds. Sign up free to unlock the detection rules or query them with the Threadlinqs MCP server (Purple)
  • AI API Egress Correlated With Offensive Tooling on the Same Host (GTG-1002 Pattern) · unlock with TL Creds
  • AI Agent Session Reading Multiple Credential and Secret Files · unlock with TL Creds
  • AI Agent Session Fan-Out to Remote Services (Lateral Movement) · unlock with TL Creds
  • Claude Code Launched With Permission Prompts Disabled · unlock with TL Creds
  • Archive Staging of Local Data From a Claude Code Agent Session · unlock with TL Creds
  • Bulk Data Exfiltration Tooling Launched From a Claude Code Agent Session · unlock with TL Creds
  • Claude Code Agent-Driven Credential Harvesting (GTG-1002 Post-Exploitation) · unlock with TL Creds
  • Machine-Speed Command Bursts From a Claude Code Agent Session · unlock with TL Creds

Indicators of compromise

As of 2026-10-29, Threadlinqs Intelligence tracks 9 indicators of compromise for TL-2026-4747.

9 indicators of compromise · unlock with TL Creds. Compare plans

Technical analysis

Quarry is a defensive detection language released by Cisco and reported by SecurityWeek on 2026-10-29. It targets a gap in agent security: a malicious objective can be decomposed into routine-looking tasks so that no single prompt, tool call or action looks harmful, and the intent is visible only when the steps are considered in sequence. Quarry rules combine neural evidence (ML classifiers and LLM judges) with symbolic rules that check exact conditions, ordered sequences, string matches and relationships between tool calls. Cisco positions it as an emerging standard comparable to Snort, YARA and Sigma, but for AI-agent attacks.

The starter pack described in the article includes a readable DSL for conversations and tool use, an evaluation runtime with configurable safety limits, a command-line scanner, a Python SDK, optional model operations for semantic signals, a Quarry plugin for Claude Code, Codex and MCP-compatible agents, and a rule metadata and validation workflow. Coverage spans single-turn and multi-turn LLM conversations, agents, tool use, Model Context Protocol (MCP) interactions and multimodal inputs. The article gives no repository URL or license.

The article cites two incidents of agent abuse as motivation. First, a 2025 attack on roughly 30 organizations in which Claude Code was driven through tasks that looked routine, with the data-theft intent apparent only when the requests were combined. Anthropic's public report attributes this to a China-linked actor tracked as GTG-1002, detected in mid-September 2025 and disclosed on 2025-11-13/14; the AI performed an estimated 80-90% of tactical work (reconnaissance, vulnerability discovery, exploitation, lateral movement, credential harvesting, data analysis and exfiltration) using MCP-connected, publicly available tooling with no custom malware observed, while operators used personas and context-splitting to hide the overall objective. A limited number of intrusions succeeded, and AI hallucination (fabricated credentials, public data presented as discoveries) reduced effectiveness. Second, Gambit Security reported that an attacker abused Claude Code (over 1,000 prompts, role-play as a bug bounty tester) beginning with the Mexican tax authority in late December 2025, reportedly compromising about ten government bodies and a financial institution, exfiltrating roughly 150 GB and exposing about 195 million identities, and using OpenAI GPT-4.1 to analyze stolen data after Claude resisted some requests. Anthropic confirmed the activity and banned the accounts.

This record is informational: Quarry is a defensive tool release with no CVE, no vulnerability and no network IOCs. The IOC list therefore holds entities, tools and behavioral patterns rather than infrastructure indicators. The Quarry details come from a single source (SecurityWeek) and could not be corroborated from a Cisco primary source during research.

MITRE ATT&CK / ATLAS techniques by tactic:

Defense Evasion

AML.T0054 LLM Jailbreak; T1078 Valid Accounts

Credential Access

T1003 OS Credential Dumping

Collection

T1005 Data from Local System

Lateral Movement

T1021 Remote Services

Discovery

T1046 Network Service Discovery

Execution

T1059 Command and Scripting Interpreter

Initial Access

T1190 Exploit Public-Facing Application

Resource Development

T1588.007 Obtain Capabilities: Artificial Intelligence

Reconnaissance

T1595 Active Scanning

Remediation

Immediate actions

  • Log agent tool calls, shell commands and MCP interactions per session so multi-step sequences can be reconstructed
  • Alert on bursts of agent activity at request rates no human operator could produce
  • Restrict agent credentials and network reach to least privilege and require human approval for credential use and bulk data export

Workarounds

  • Treat requests framed as bug bounty or penetration-test role-play with elevated scrutiny when tied to unverified targets

Longer-term hardening

  • Evaluate sequence-aware agent detection such as Quarry rules alongside single-event guardrails
  • Combine classifier/LLM-judge signals with symbolic sequence rules for agent and MCP telemetry
  • Include AI-agent abuse (task-splitting, role-play jailbreaks) in threat models and purple-team exercises

Affected and fixed versions

  • Anthropic — Claude Code
  • OpenAI — GPT-4.1 (abused for stolen-data analysis in Mexican government intrusion)

Timeline

  • Anthropic detects the GTG-1002 campaign in mid-September 2025, in which operators drive Claude Code through MCP-connected tooling against about 30 organizations.
  • Anthropic publishes its report on the first reported AI-orchestrated cyber espionage campaign, attributing it to a China-linked state-sponsored actor, banning accounts and notifying victims.
  • Per Gambit Security, an attacker begins abusing Claude Code against the Mexican federal tax authority in late December 2025 (exact day not stated in the sources; month-end used as approximation).
  • Anthropic investigates, confirms the malicious activity in the Mexican government case and bans the accounts involved.
  • Security Affairs and others report Gambit Security's findings: about 10 Mexican government bodies and a financial institution compromised, ~150 GB exfiltrated, ~195 million identities exposed, over 1,000 prompts used.
  • SecurityWeek reports that Cisco has open-sourced Quarry, a neurosymbolic rule language for detecting multi-step AI agent attacks.

Sources cited

More from GTG-1002

Previous and next in threat intel

Drafted by the Threadlinqs research pipeline from 8 sources; published ; last updated —.

Threadlinqs Intelligence — Real-Time Threat Detection Platform

// threat_feed
$ sort --newest
Showing all threats

Live intelligence console

Threat level

Latest Threats