Algorithm-Led Cyber Attacks: Who Is Accountable When the Attacker Disappears?

In mid-September 2025 Anthropic noticed suspicious activity on its platform. Its investigation concluded that attackers had used its coding tool, Claude Code, to try to break into about thirty organisations around the world: technology firms, financial institutions, chemical manufacturers and government bodies. Only a small number of the attempts succeeded.

A Fact, Not a Hypothesis

The company attributed the campaign, with high confidence, to a Chinese state-sponsored group. It estimated that AI performed 80 to 90 per cent of the work, and that humans needed to intervene at four to six critical decision points per campaign.

Two reservations are needed. First, the figure is the company's own estimate, announced by the company itself, and should be read as such. Second, the tool sometimes hallucinated: it claimed to have extracted secrets that were in fact publicly available, or invented credentials, and the company describes this as an obstacle to full autonomy. So the more accurate picture is a fast machine worker operating under intermittent human direction, not a machine commander waging war on its own.

Speed Cuts Both Ways

In October 2024 Google researchers announced that an AI agent had found a flaw in the open-source database SQLite: an exploitable stack buffer underflow, fixed the same day, before it reached any official release. The team believed it to be the first public case of its kind, but described the results as "highly experimental" and said that a fuzzer tailored to the same target might, for now, be just as effective.

In the AI Cyber Challenge run by DARPA, the teams' systems found 54 of 63 synthetic vulnerabilities and patched 43 of them, and discovered 18 real vulnerabilities in open-source software. The average time to patch was 45 minutes, and the average cost per task about $152.

The point is that the same capability serves defender and attacker alike. Whoever uses it more skilfully, and patches before a flaw is exploited, tips the balance.

When the Return Address Is Lost

Thomas Rid and Ben Buchanan argue that attributing an attack is "what states make of it": a process combining technical evidence with political judgement, not a test whose answer comes out of a laboratory. Even for Stuxnet, discovered in July 2010, Symantec's report cautioned against drawing conclusions about attribution, because an attacker may plant clues that implicate someone else. About 60 per cent of the infected machines were in Iran.

No figure measures the effect of AI on the difficulty of attribution, and saying that it makes it harder is a reasoned inference, not a documented fact: the more incidents there are, and the more varied their methods, the heavier the burden on investigators. That weakens deterrence, which depends on knowing whom to punish.

A Lesson from the Stock Market

When automated systems interact at a speed beyond human ability to follow, things can slip out of hand. On 6 May 2010 an institutional investor began selling 75,000 futures contracts (worth about $4.1 billion) using an algorithm that targeted 9 per cent of trading volume "without regard to price or time". The index fell about 5 per cent in roughly four and a half minutes, then recovered after a brief automatic pause. This was not a cyber attack, but it shows that an algorithm whose speed is unchecked can outrun human review. It does not follow that automated conflicts will end this way; the example is useful for designing brakes.

What to Do

• Keep a human decision at the points of no return, such as cutting off a vital service or answering an attack.
• Build for recovery, not only prevention: a system that recovers quickly is worth more than a promise that it will never be breached.
• Make detection and patching as fast as the attacker, with automated tools under human supervision.
• Document incidents and share them with the competent authorities; collective learning narrows the gaps.

For the general defensive picture and deepfakes, see the article "AI and Cybersecurity: One Key in Two Hands".

Taking the means, by tightening oversight and training people, and then putting our trust in God, is the balance between complacency and panic. The question worth asking is not "can an algorithm fight a war?" but "who can stop it, and when?"