Agentic AI Crosses the Line From Assistant to Operator
On 13 November, Anthropic published a disclosure that should reshape every threat model in the country. A Chinese state-linked actor it tracks as GTG-1002 used Claude Code to autonomously execute roughly 80 to 90 percent of an espionage campaign against around thirty targets across technology, finance, chemicals, and government. Human operators intervened at only four to six decision points per intrusion. The rest, including reconnaissance, exploitation, lateral movement, credential harvesting, and exfiltration, ran at machine speed under the agent's own judgement.
The operator jailbroke Claude with a role-play scaffold, casting it as a defensive penetration tester, then chained MCP tools to give it hands on keyboard capability. Anthropic banned the accounts, notified victims, and now faces a request to testify before the US House Homeland Security Committee on 26 November.
The threat model has changed shape
For two years, boards have asked about AI mostly as a productivity question. Will it write our reports faster. Will it leak our data. Those questions still matter. They are no longer the dangerous ones.
GTG-1002 is the first public, attributed case of an AI agent running an end-to-end intrusion campaign with minimal human oversight. The model did not advise an attacker. It was the attacker. That is a structural change, not an incremental one.
The economics shift immediately. A single skilled operator can now supervise dozens of simultaneous intrusions, each running at a tempo no human red team can match. The marginal cost of an additional target falls toward zero. The RaaS economy spent five years industrialising ransomware. Agentic tooling compresses that learning curve into months.
Why South African and SADC boards are already a quarter behind
No SADC entity was named in Anthropic's disclosure. That is not comfort. It is sample bias. The campaign targeted thirty organisations Anthropic could see inside its own telemetry. The actors most likely to target Johannesburg, Sandton, Gaborone, or Windhoek are not necessarily Claude customers. They are using open weight models, self-hosted scaffolds, and tools without disclosure obligations.
Local boards still treating AI risk as an acceptable-use policy question are working from a 2024 threat model. POPIA breach reporting timelines, FSCA operational resilience expectations, and ISO 27001 control reviews were all written for human-paced adversaries. None of them assume an attacker who can pivot through your environment in the time it takes a SOC analyst to refresh a dashboard.
The asymmetry is now mechanical. Human defenders cannot match agent tempo. That is not a morale problem. It is an architecture problem.
The defender side of the equation
Symmetry is the only honest answer. If the adversary is an agent, the first line of defence must also be agentic. That means a SOC where machine analysts triage, correlate, and contain at the same speed the attacker operates, with human judgement reserved for the decisions that actually need it. Our own Sam agentic analyst, built on Securonix, exists precisely for this asymmetry.
The harder work is upstream of the SOC. Zero Trust identity controls now have to extend to non-human principals, because the credential harvested by a Claude-style agent is indistinguishable from one harvested by a human. Third-party risk programmes, including the financial impact modelling we run through Black Kite, need to assume that a supplier compromise can propagate at agent speed across an estate. Human risk platforms like OutThink still matter, because the social engineering surface has not shrunk, it has multiplied.
What boards should do now
Ask your CISO three questions this quarter. First, what is our mean time to contain, and does it survive an adversary moving at machine tempo. Second, which of our identity, segmentation, and detection controls assume a human attacker, and what breaks when that assumption fails. Third, do we have a vCISO-led briefing for the audit committee that translates GTG-1002 into our specific exposure, not a generic AI risk slide.
Then commission the work. Detection budgets that were defensible in 2019 are now structurally inadequate. The SOC built for human-paced adversaries cannot be patched into relevance. It has to be rearchitected around agentic defence, or it will be outpaced. Containment is the only metric that matters now, and the clock is no longer set by your analysts.