A Guardrail Checks a Request. An Attacker Runs an Operation.

Three campaigns since late 2025 have got AI agents to run offensive operations the models were trained to refuse. One is a confirmed state-sponsored group and one is suspected China-linked. The third is a single opportunistic operator in Zhuhai. Not one of them needed an adversarial prompt, an encoding trick, or any of the optimisation techniques the jailbreaking literature is about.

A guardrail evaluates a request while an attacker runs an operation, and almost every control on the market is built at the wrong unit of analysis.

On 13 November 2025 Anthropic disclosed a campaign it designated GTG-1002, attributed with high confidence to a Chinese state-sponsored group, which drove Claude Code through Model Context Protocol servers wrapping commodity penetration testing tools against roughly thirty organisations in technology, financial services, chemical manufacturing and government. It succeeded in a small number of cases. Anthropic’s account of the bypass is precise: the operators told Claude that it was an employee of a legitimate cybersecurity firm being used in defensive testing, and broke the attacks into small, seemingly innocent tasks that Claude would execute without being given the full context of their purpose.

Between 1 and 4 July 2026, suspected China-linked operators ran twelve waves against Taiwanese government networks using the open-source frameworks Hermes and OpenClaw. They defeated the underlying model’s refusals, not a control belonging to the frameworks, by describing the campaign as authorised penetration testing. The detailed reconstruction is one firm’s analysis of a recovered archive, though Taiwan’s own cyber authority has since confirmed the underlying attacks. I wrote about what that campaign means for control networks separately.

On 30 July 2026, Unit 42 disclosed a third case with a different shape. A Chinese-speaking operator in Zhuhai, assessed as an opportunistic exploit operator rather than a state actor, built an autonomous attack engine on DeepSeek running inside the open-source Hermes Agent framework, commanded over Telegram. Western tools were present but barely used: the recovered Claude Code history was ten entries across three sessions containing model checks, connectivity tests and one package install, and the Codex logs had been configured away. OpenAI told Unit 42 that its provider-side safeguards had refused policy-violating requests and that its safety systems had flagged and disabled a linked account. Unit 42 hedges its causal claim twice: provider controls likely limited the usefulness of Western models, which likely led the actor to select the most permissive one.

Three ways past, and only one was an attack on the model

Hold the house distinction, because it decides what you can build against each.

Lying about authorisation. A user tells the model the work is sanctioned. Anthropic called this jailbreaking in its own report, and under any reasonable definition it is: the user is subverting the model’s own policy. It is not a technical jailbreak: no adversarial suffix, no gradient-found token sequence, no obfuscation, just a well-formed, plausible, entirely ordinary sentence that happens to be false. The model is being asked to make an authorisation determination it has no evidence for, in a system where nothing else is making that determination either.

Decomposition. GTG-1002’s operators broke the campaign into subtasks. Scan this range. Parse this response. Write a script that tries these credentials. Summarise what is in this database. Every one of those requests is something a legitimate security engineer sends. The operation they compose into is not. A per-request classifier cannot see the composition, because it exists only across the sequence.

Switching models. The Unit 42 case did not defeat a provider’s guardrail at all. It selected around it. Model choice has become an operational security decision for attackers, and the open-weight and open-framework supply chain means the choice is always available. That actor’s Hermes build did also bundle a jailbreak skill, so the line is not perfectly clean. What made the operation possible was a model shipped without the controls.

None of the three is prompt injection, which is untrusted content becoming instruction and takes a different defence. Two are jailbreaks of the semantic kind, not the token-level kind most people picture. The third selected a model with fewer controls. Conflating them, which most vendor marketing does, produces a product that addresses none of them.

The unit of analysis is wrong

A guardrail is a function from a request to an allow or a block. An operation is a sequence of hundreds of requests, distributed over time, possibly across accounts and providers, whose meaning exists only in the aggregate.

Anthropic’s own account puts numbers on the mismatch. Human operators made perhaps four to six critical decisions per campaign. The agent executed 80 to 90 percent of the tactical work, and at peak made thousands of requests, often several a second, a speed the company says a human team could not match. So the operators kept the full malicious intent at the orchestration layer, while the model was shown a stream of narrower tasks that looked legitimate one at a time.

You cannot classify each request independently and expect that to catch it. Anthropic itself responded partly by building better classifiers, so a per-request check is not useless; a stateless one is what fails. You can only see the operation at the level where it exists, which is the session, the account, and the campaign. That means rate and concurrency, the shape of a tool-call sequence over hours, and whether an account looks this week the way it looked last week. It is closer to fraud detection than to content moderation, and most of what is sold as an AI guardrail is not built that way.

The same reasoning applies inside your own estate, which is where this stops being about state actors. If your agentic deployment is governed by a filter on each model call, you have a control that a compromised or misdirected agent passes by construction, one benign-looking call at a time.

Why the defender fails the same test that the attacker passes

Put this next to something that looks like a contradiction and is not.

The refusal research, 2,390 defensive-security requests drawn from a collegiate cyber-defence competition, found that a defender who states they are authorised gets refused more often, not less. The attackers in two of these three campaigns claimed authorisation and were let through. The refusal research measured what a single message contains, and the campaigns spread that meaning across hundreds of messages.

The defender’s request arrives whole. Analyse this malware sample. Harden this system. The defender puts attack-shaped vocabulary, a claim of authorisation, and the entire meaning of the task into a single message, which is exactly the shape of a social-engineering attempt. The classifier is right to be suspicious and wrong about who it is looking at.

The attacker breaks the operation into pieces. No single message contains enough to be suspicious about. The authorisation claim only sets a context in which each innocuous fragment fits a story.

So a request-level control can refuse the person telling the truth in one message and pass the person lying across a thousand. The two studies did not test the same system, so this is an explanation rather than a proven result. But it names exactly the blind spot a per-request control creates, and nothing in these three campaigns argues against it.

The third case is the one to read carefully

The DeepSeek campaign is the one that complicates the story, and it should not be skipped for that reason.

In that case the guardrails worked. Western models were tried and refused. An account was identified and disabled. Unit 42’s assessment is that the autonomous phase did not achieve a confirmed compromise, and the significance is trajectory rather than outcome.

Two conclusions follow and they point in opposite directions. Guardrails imposed a real cost: the attacker had to route around the models with the better safety record. On NIST CAISI’s September 2025 evaluation, the best US model solved over 20 percent more software-engineering and cyber tasks than the best DeepSeek model tested, so the permissive stack is also, on that evidence, the weaker one. That is a genuine defensive win and the people who built those controls should get credit for it. (Unit 42 does not identify the exact DeepSeek version behind the recovered session, so that gap cannot be mapped precisely onto this operation.)

And the effect was displacement rather than prevention. The operation continued. Which means the security value of a refusal depends on whether an equivalent capability is available without one, and for the current generation it usually is. The same CAISI evaluation found the tested DeepSeek model answered 94 percent of overtly malicious requests once a common jailbreak was applied, against 8 percent for the US reference models, which is the reason a permissive model is worth switching to even at a capability cost.

What the evidence actually supports

Every one of these campaigns has been reported more confidently than its own primary source justifies, and the folklore is forming now.

Anthropic’s report on GTG-1002 says that Claude frequently overstated findings and occasionally fabricated data during the operation, claiming credentials that did not work and flagging publicly available information as critical discoveries. The company describes this as an obstacle to fully autonomous attacks. Of roughly thirty targets, only a small number were actually compromised. Anthropic published no indicators of compromise, no addresses, domains or hashes, and several established researchers said publicly at the time that the report was thin or overstated.

Unit 42 recorded no confirmed compromise in the autonomous phase, and the Taiwan campaign is one research firm’s analysis of a recovered archive, multiply reported but single-origin.

What is well supported is a broader mechanism than any single case. Two campaigns show operators making prohibited work look locally legitimate through false context and decomposition. A third shows the other failure mode: provider safeguards can refuse the work and still lose the workload to a more permissive stack. What is not supported by any of the three is that AI achieved something a competent human team could not have. What changed, clearly, is scale, parallelism and tempo, and that is a statement about today rather than a defence.

Hallucination currently limits these operations, and it is the single most heavily worked-on problem in the field. Nobody built that limit as a control, and the labs working on it have no interest in whether it was holding attackers back. It is the most likely thing here to be wrong about in a year.

What to do

Four things, and none needs a new product.

Move detection to the session. Rate, concurrency, tool-call sequence shape over hours, and week-over-week deviation in an account’s behaviour. The campaign-level pattern in each of these cases is far more visible than any isolated prompt verdict. If your AI security control returns a verdict per call and nothing per session, it is not the control you think you bought.

Ask any vendor selling guardrails which of the three bypasses their product addresses. Authorisation claims, decomposition, and provider switching are three different problems. A tool that scores individual prompts does not by itself address any of them, and the honest vendors will say so.

Treat a claimed authorisation as unauthenticated input, wherever it appears. A natural-language claim of authorisation is not evidence of it, and the model cannot establish otherwise from the assertion alone. Something outside the model has to make that determination, through identity, a signed ticket or an approval workflow, and if you cannot name what it is, nothing is.

Instrument for the operation you would run. Take your own red team’s last engagement and decompose it into the calls an agent would make. Run that through your controls. If it passes, you have measured the thing that matters, and you have the result whether or not you like it.

In all three campaigns, nobody had to break the model in the way the jailbreak literature imagines. Two of them talked it into cooperating; one of them walked past it to a model that would not argue. Security controls built into the model assume the model is the boundary. It is one component in somebody else’s system, and the attacker is designing the system.