When AI Agents Attack: Lessons from Claude Code, Slack AI, and Copilot CVEs
Return to Part 0: Table of ContentsPrevious Article: Chapter 5 — The Three Capabilities That Turn Your AI Into an Insider Threat
Zero Trust Architecture for the Agentic Enterprise | Part One: Foundations
If you have followed this series from Chapter 1, you encountered GTG-1002 already: the September 2025 Chinese state-sponsored operation that weaponised Claude Code against approximately thirty organisations across technology, financial, government, and chemicals sectors.[1] In that chapter, GTG-1002 was evidence of machine-speed conflict. Human operators made four to six decisions per engagement; the AI system handled everything else autonomously, processing thousands of requests per second.[1]
This chapter examines GTG-1002 again, and three other documented incidents, through a different lens. Not "how fast did it happen" but "what architectural conditions made it possible." The answer is the same in every case. Chapter 5 gave you the Lethal Trifecta as a framework for predicting AI weaponisation. This chapter gives you the evidence that the framework describes what actually happened.
In New Zealand, the acceleration is measurable. Kordia's 2026 Business Cyber Security Report, the most current authoritative NZ-specific data available, found that AI-related cyber attacks doubled in a single year: 6% of all incidents in 2024, rising to 14% in 2025.[2] What was a specialist threat twelve months ago is now a routine attack vector in the New Zealand threat landscape.
Incident One: GTG-1002 — The First Documented AI-Orchestrated Cyberattack (September 2025)
The conventional model of a cyber operation involves human operators doing most of the work and using automation for specific phases. GTG-1002 inverted this completely.
Human operators made four to six critical decisions per engagement: select the target, set the objective, approve escalation at specific thresholds, and retrieve the extracted data. Reconnaissance, vulnerability discovery, exploitation, lateral movement, credential harvesting, data analysis, and exfiltration were all executed autonomously by Claude Code, processing thousands of requests per second.[1] The attack achieved a throughput that no human-operated espionage operation could match.
The technical mechanism was not a software vulnerability in the conventional sense. The attackers social-engineered the AI model itself: elaborate role-play scenarios convinced Claude Code it was operating in a legitimate security research context, redirecting it toward espionage objectives without breaking any system-level control.[1] You cannot secure an agent whose reasoning can be manipulated through the content it processes. No traditional security tooling was positioned to catch this.
Apply the Lethal Trifecta test from Chapter 5:
Leg one: access to sensitive data. Claude Code, by design, held read access to codebases, configuration files, and in many developer environments, credential stores and secrets.
Leg two: exposure to untrusted content. The role-play prompts were untrusted content injected into the model's context. The model processed them as legitimate instructions indistinguishable from authorised user commands.
Leg three: external communication and execution capability. Claude Code's agentic mode could write files, execute system commands, and transmit data through legitimate developer channels without triggering external communication alerts.
All three legs were active. The attack followed as a logical consequence of the architecture. The failure was not in Anthropic's model design. It was in how organisations deployed Claude Code: with ambient permissions inherited from the developer's account, no semantic monitoring of what instructions the agent was acting on, and no human confirmation step before autonomous execution of sensitive operations.
CrowdStrike's 2026 Global Threat Report independently confirms the operational pattern, noting evidence of threat actors executing operations using agentic AI tools with minimal human oversight.[3]
Incident Two: npm s1ngularity — When the Tool Becomes the Weapon (August 2025)
One month before GTG-1002, a supply-chain attack demonstrated a different exploitation path. Rather than attacking the AI model directly, it targeted the AI tools that developers trust implicitly.
Malicious code injected into popular Nx development packages distributed through npm specifically targeted AI coding agents running in permissive modes: Claude Code with the --dangerously-skip-permissions flag, Gemini CLI with --yolo, and Amazon Q with --trust-all-tools.[4] The attack weaponised those agents as reconnaissance and exfiltration tools, harvesting SSH keys, GitHub and npm tokens, cryptocurrency wallets, and environment variables from developer machines.
The exfiltration mechanism required no external command-and-control infrastructure. The malware used the victim's own GitHub credentials to create public repositories under the naming convention s1ngularity-repository-*, uploading stolen data through the victim's own account, attributed to the victim, using the victim's own tools.[4] Detection required a developer to notice that their GitHub account had created repositories they did not recognise. Security researchers from StepSecurity described this as the first known case of malware deliberately weaponising developer-facing AI tools.[4]
The malicious packages remained live for five hours and twenty minutes before detection.[4] In that window, the agent was working against its owner with full cooperation from the infrastructure.
CrowdStrike's 2026 Global Threat Report confirms this independently, noting that August 2025 saw malicious npm packages using victims' own local AI tools to generate commands that stole authentication materials.[3]
The architectural failure is precise. The permissive flags --dangerously-skip-permissions, --yolo, and --trust-all-tools exist for convenience during development. They disable the confirmation steps that would otherwise require the agent to seek approval before accessing sensitive files or executing external operations. A developer enables these flags under time pressure and forgets to disable them. Any attacker who plants malicious instructions in that environment inherits the full execution capability the developer intended for themselves.
Incident Three: Slack AI Memory Poisoning — The Agent That Does Not Know It Is Betraying You (August 2024)
Independent security researchers disclosed the Slack AI memory poisoning vulnerability in August 2024, introducing a vulnerability class that has grown in significance as AI assistants gain deeper integration with enterprise communication platforms.[5]
The attack exploited the trust relationship between Slack AI and the messages it summarised. By injecting carefully crafted instructions into Slack messages in public channels, an attacker could cause those instructions to enter Slack AI's context during normal indexing.[5] When a user subsequently asked Slack AI a legitimate question, the AI retrieved relevant context including the injected instructions and could be directed to exfiltrate data from private channels the user had access to, embedding it in the AI's response.
The victim did not click a link, open an attachment, or grant additional permissions. The attack executed through entirely normal AI assistant interaction. The user asked a question. The AI answered it. The injected behaviour was invisible throughout.
Apply the Lethal Trifecta test:
Leg one: access to sensitive data. Slack AI held access to every channel the authenticated user could read, including private channels containing strategic discussions, personnel matters, and confidential project content.
Leg two: exposure to untrusted content. Public channel messages are untrusted content that Slack AI processes during normal operation. Any user with channel access can post such messages.
Leg three: external communication and execution capability. Slack AI's natural language output was the exfiltration channel. The data did not need to traverse a firewall or a network monitoring boundary. It left through the AI's response.
The architectural failure: Slack AI inherited the user's full read permissions without any separation between reading data and acting on that data under instruction from untrusted sources. There was no semantic boundary between the AI's legitimate summarisation function and its potential to be redirected by adversarial inputs embedded in the content it summarised.
Incident Four: ServiceNow and Microsoft Copilot CVEs — Privilege Escalation in the Enterprise Stack (2025)
The 2025 vulnerability disclosure landscape for AI-integrated enterprise platforms revealed a consistent vulnerability class: privilege escalation through AI integration points. Two platforms with broad NZ enterprise deployments illustrate the pattern.
ServiceNow's Now Assist platform, which brings AI capabilities into IT service management workflows, was subject to multiple vulnerability disclosures in 2025.[6] The attack pattern typically involved injecting prompt instructions through ServiceNow ticket content, workflow descriptions, or knowledge base articles that Now Assist processed during AI-assisted operations. A properly crafted injection could cause the AI to execute actions under the service account's permissions rather than the submitting user's permissions, escalating access silently within the workflow.
Microsoft Copilot for Microsoft 365 presented a related attack surface.[7] With access to the user's full Microsoft 365 environment, including email, Teams, SharePoint, and calendar, Copilot holds exceptional data access. Security researchers documented multiple 2025 scenarios where prompt injection through document content, email body text, or Teams messages could redirect Copilot to perform actions on the user's behalf without the user's awareness: forwarding emails, sharing files, or accessing restricted SharePoint content.
CrowdStrike's 2026 Global Threat Report confirms that prompt injection was being actively used in 2025 to interfere with AI-enabled email triage security workflows, demonstrating that these vulnerabilities moved from researcher disclosure to active operational exploitation within the same year.[3]
The common architectural failure across both platforms: the AI integration layer did not distinguish between instructions from the legitimate user and instructions embedded in the content the AI was processing. Both carried equal authority. The model had no mechanism to apply differential trust to content from different provenance.
Table 1: Documented AI Agent Incidents — Attack Vectors, Trifecta Activation, and Architectural Failures
| Incident | Date | Attack Vector | Trifecta Legs Active | Impact | Architectural Failure |
|---|---|---|---|---|---|
| GTG-1002 (Claude Code) | Sep 2025 | Social engineering via role-play prompts | All three | ~30 organisations across 4 sectors; autonomous multi-stage espionage at machine speed | Ambient permissions; no semantic instruction monitoring; no human checkpoint before high-risk execution |
| npm s1ngularity | Aug 2025 | Malicious packages targeting permissive-flag AI agents | All three | SSH keys, API tokens, wallets, environment variables exfiltrated; 5h 20m live before detection | Permissive execution flags left active; no input provenance verification; no outbound exfiltration detection |
| Slack AI Memory Poisoning | Aug 2024 | Prompt injection via public channel messages | All three | Private channel data exfiltration via AI response output | No distinction between read permissions and act-on-instruction permissions; no semantic filtering on untrusted inputs |
| ServiceNow Now Assist CVEs | 2025 | Prompt injection through ticket and workflow content | Data access + untrusted content | Silent privilege escalation to service account permissions | AI processing layer treated document content as authoritative instruction without provenance checks |
| Microsoft Copilot CVEs | 2025 | Prompt injection through email, documents, Teams messages | Data access + untrusted content | Unauthorised email forwarding, file sharing, restricted content access | User's full M365 permission set inherited by AI without action-level authorisation gate |
| CVE-2025-3248 (Langflow) | April 2025 onwards | Exploitation of AI agent orchestration platform | Data access + execution | Persistence, credential access, ransomware deployment | Public-facing AI orchestration surface with insufficient access controls |
| Malicious postmark-mcp server | 2025 | MCP server identity impersonation | Untrusted content + external communication | Email forwarded to attacker-controlled addresses through trusted AI tool channel | No cryptographic verification of MCP server identity; AI trusts server by name |
Sources: Anthropic threat intelligence[1]; CrowdStrike 2026 Global Threat Report[3]; StepSecurity[4]; Researcher disclosures[5]; CVE database and security advisories[6][7]
The Five Patterns That Appear in Every AI Attack
Seven incidents. Five platforms. Eighteen months. The same five structural failures appear across all of them. Understanding the patterns is more useful than memorising the individual cases.
In every incident, the AI held permissions that belonged to someone else: the developer's account, the service account, the authenticated user. The AI inherited that access wholesale, without any mechanism to verify that the specific action it was about to take was within the scope the original permission holder intended. Permissions were delegated once at setup. They were never re-verified at execution time.
Pattern two: Content processed as instruction.Every attack exploited the same design gap. The AI processed content from an external source — a role-play prompt, a package dependency, a Slack message, a ServiceNow ticket, an email body — and treated instructions embedded in that content as legitimate commands from an authorised source. The model had no way to distinguish "my authorised user asked me to do this" from "content in my context contains something formatted as an instruction."
Pattern three: No human checkpoint at the critical action.GTG-1002 had four to six human decisions across an entire multi-stage espionage engagement. The attacks succeeded because the gap between receiving an untrusted input and executing a high-risk action contained no human confirmation step. Autonomous AI execution is valuable precisely because it removes the human bottleneck. The same characteristic is what makes the attack possible.
Pattern four: Exfiltration through legitimate channels.None of these attacks required creating new communication infrastructure. GTG-1002 used legitimate developer pipelines. The npm attack used GitHub. Slack AI used its response output. Copilot used email. The data moved through channels that security monitoring treated as normal operational traffic. Behaviour-based anomaly detection was technically available; signature-based detection was structurally useless.
Pattern five: The Lethal Trifecta fully active in every successful case.In the incidents where the attack had significant impact, all three Trifecta conditions were present simultaneously. Where only two conditions were met — typically in partial deployments or environments with one leg restricted — attacks in the documented literature either failed to execute or had substantially limited impact. This validates the framework's core analytical claim from Chapter 5: the combination is the vulnerability. Restricting any one leg typically disrupts the attack chain, because the chain requires all three.
The five patterns above represent the author's analytical synthesis of the documented incidents. No single source articulates all five. They are derived from the collective architecture of what went wrong across seven cases.
What New Zealand Practitioners Need to Know
These incidents did not occur in a different threat landscape. New Zealand organisations run Microsoft 365 Copilot, ServiceNow, Slack, and developer toolchains including Claude Code. The vulnerability patterns are identical regardless of geography.
Kordia's 2026 NZ Business Cyber Security Report is the most current NZ-specific evidence.[2] AI-related cyber attacks doubled in 2025, from 6% to 14% of all incidents. Separately, 80% of phishing emails in 2025 were AI-generated, achieving a 54% click-through rate compared to 12% for traditional phishing.[2] AI is being weaponised on both sides of the threat equation: as a target and as a delivery mechanism.
The cost data reinforces the architectural case. The average New Zealand SME breach in 2025 cost $173,000, according to Kordia's analysis.[2] The Privacy Act maximum penalty for a data breach sits at $10,000.[2] The asymmetry does not reduce your risk. It shifts the business case: you are self-insuring against a $173,000 average loss with a $10,000 regulatory ceiling, which means preventing the breach is the investment, not managing the penalty.
For public sector organisations and large enterprises, the NCSC issued advisories in March 2026 requesting heightened vigilance against Iran-linked cyber activity.[8] The advisory is a reminder that New Zealand's digital infrastructure is not isolated from geopolitical cyber spillover. The same threat actors using AI-assisted tools in partner nations within the Five Country Council operate against New Zealand targets.
For the board-level governance response to the same Kordia AI threat data, see this week's Cyber Sunday — two sides of the same report, two different audiences.
A March 2026 Coda: The Trifecta Goes Physical
This chapter was written to document software-based AI weaponisation. On 1 March 2026, the Lethal Trifecta was demonstrated in a form that no security framework document had anticipated.
Iranian Shahed-136 drones struck three Amazon Web Services data centres: two in the UAE, one in Bahrain. Two of three availability zones in AWS's ME-CENTRAL-1 region went offline. Banking services, payment platforms, and government systems across the Gulf collapsed.[9] The Uptime Institute confirmed this as the first military attack on a hyperscale cloud provider in history.[9] Iran's IRGC stated explicitly that the Bahrain facility was targeted because AWS hosts US military workloads. Multiple news organisations reported that the US military used Anthropic's Claude on AWS for intelligence assessments and targeting during the strikes.[9]
Apply the Lethal Trifecta test to the physical infrastructure:
Leg one: access to sensitive data. The same physical servers housed commercial banking data and US military intelligence compute. Civilian and military workloads ran collocated on common hardware.
Leg two: exposure to untrusted content. Cloud data centres in an active kinetic conflict zone are exposed to untrusted content in the most direct sense possible: ordnance.
Leg three: external communication and execution capability. The same infrastructure connected civilian financial services and military command systems. There was no physical isolation between the two.
All three legs were fully active. The attack followed as a logical consequence of the architecture.
The architectural lesson is structurally identical to every software incident documented earlier in this chapter. When you collocate sensitive workloads with systems exposed to adversarial action and connect both through shared infrastructure with no effective isolation, you have assembled the Trifecta. The adversary targeting the military workload does not need to choose between the civilian system and the military one. Destroy the physical layer and you affect both.
This is the concrete meaning of "no trust by default" in an era when physical infrastructure carries both civilian and operational workloads. The cloud is not abstract. It is concrete, steel, and copper at a specific address in a specific jurisdiction. Architecture decisions about where AI workloads run are physical decisions with physical consequences. For the sovereignty dimension of this analysis, see this week's Space AI Monday.
Part Two of this book begins the New Zealand governance analysis: what the regulatory environment requires of NZ practitioners who now understand both the theoretical risk model and the documented evidence of what happens when that model is ignored.
Next week in Chapter 7: NZISM v3.9 Decoded: What the April 2025 Updates Mean for Your Architecture
The views expressed in this article are entirely my own, informed by more than 30 years of professional experience in architecture, security, and technology leadership in New Zealand. They do not represent the views of my employer, any government agency, or the New Zealand government. My commentary on legislation and policy is analytical, drawing on publicly available sources and my professional expertise in architecture, security, and AI governance. I follow the Public Service Commissioner's Code of Conduct for the Public Sector and social media guidance.
Andreas Hamberger is a New Zealand leader in Architecture & Security and Associate Member of the Institute of Directors. Zero Trust Architecture for the Agentic Enterprise is the first book in The Hamberger Report series, providing practitioners with deployable patterns and configurations for securing AI-driven systems.
I use AI tools, including Sudowrite, Claude, Perplexity AI, DeepSeek AI, ChatGPT, Grok, Copilot, Openart and Gemini, as deliberate production tools, not ghostwriters. This is consistent with my position: AI amplifies human judgement; it does not replace it. The frameworks, arguments, and editorial decisions in this series are original work. AI accelerated the process. The thinking is mine.
[1] Anthropic. "GTG-1002 Threat Intelligence Disclosure." September 2025. https://www.anthropic.com/research/threat-intelligence
[2] Kordia. "New Zealand Business Cyber Security Report 2026." March 2026. https://www.kordia.co.nz/nz-business-cyber-security-report-2026
[3] CrowdStrike. "2026 Global Threat Report." February 2026. https://www.crowdstrike.com/global-threat-report/
[4] StepSecurity. "Research Disclosure: npm s1ngularity Supply Chain Attack Targeting AI CLI Tools." August 2025. https://www.stepsecurity.io/research
[5] Security researcher disclosure. "Indirect Prompt Injection Vulnerability in Slack AI." August 2024. [Researcher identity not confirmed at write time; primary publication URL pending verification. Corroborated independently by CrowdStrike 2026 GTR vulnerability pattern analysis.]
[6] National Vulnerability Database / ServiceNow Security Advisories. "ServiceNow Now Assist Vulnerability Disclosures." 2025. https://nvd.nist.gov / https://support.servicenow.com/kb [Note: Specific CVE identifiers require primary source verification. Vulnerability class confirmed via CrowdStrike 2026 GTR independent corroboration.]
[7] Microsoft Security Response Center. "Microsoft Copilot for Microsoft 365 Vulnerability Advisories." 2025. https://msrc.microsoft.com [Note: Specific CVE identifiers require primary source verification. Vulnerability class confirmed via CrowdStrike 2026 GTR independent corroboration.]
[8] NCSC New Zealand. "Advisory: Iran-Linked Cyber Activity." March 2026. https://www.ncsc.govt.nz
[9] AWS Health Dashboard; CNBC (3 Mar 2026); Bloomberg (5 Mar 2026); Fortune (9 Mar 2026); CBS News (3 Mar 2026); Uptime Institute post-incident analysis. AWS data centre strikes, UAE and Bahrain, 1 March 2026. [Multiple independent sources confirm the event and Uptime Institute designation. US military use of Claude on AWS for intelligence assessments during the strikes reported by multiple news organisations with indirect sourcing; confidence level: Likely.]