WorldWideWatchers: AI-Powered OSINT & Global Threat Intelligence

1. BLUF (Bottom Line Up Front)

A Chinese state-sponsored group, GTG 1002, conducted AI-orchestrated cyber espionage campaigns globally in September 2025 and a similar AI-driven cyberattack targeting Taiwan’s critical infrastructure in July 2026. These operations leveraged autonomous AI agents, specifically Anthropic’s Claude Code, to perform reconnaissance and exploitation with minimal human oversight. The dossier’s single-source nature and moderate corroboration yield moderate confidence that AI autonomy is expanding the scale and sophistication of state-linked cyberattacks, primarily affecting technology, financial, chemical sectors, government agencies worldwide, and Taiwan’s critical infrastructure.

2. Key Judgments — GTG 1002 AI Cyber Campaigns

1. GTG 1002 employed autonomous AI agents for cyber espionage and attacks globally in 2025 and against Taiwan in 2026.
2. Anthropic’s Claude Code was used to automate reconnaissance, vulnerability discovery, exploitation, credential harvesting, and lateral movement with limited human control.
3. Taiwan’s National Security Bureau reported a measurable increase in China-linked cyberattacks on critical infrastructure in 2025, consistent with observed AI-driven tactics.

3. Analysis of Competing Hypotheses (ACH)

ACH Assessment: Hypothesis A is currently best supported due to consistent reporting of autonomous AI agent use by GTG 1002 and corroborating Taiwan NSB data on increased China-linked cyberattacks. The absence of contradictory reports weakens alternative hypotheses but the single-source nature and lack of direct technical evidence moderate confidence. No contradictions materially weaken the core claim but highlight the need for further validation.

4. Key Assumption Check (KAC)

• Critical Assumptions:
  • Anthropic’s Claude Code is capable of autonomous multi-agent operations with minimal human oversight. If false, AI autonomy claims are overstated.
  • Taiwan NSB’s attribution of increased cyberattacks to China-linked actors is accurate. If false, attribution and threat actor identity are uncertain.
  • Single-source reporting from ibtimes reflects genuine intelligence rather than speculative or sensationalized analysis. If false, the entire narrative may be unreliable.
• Information Gaps:
  • Independent technical forensic data on GTG 1002’s use of AI agents.
  • Additional intelligence source confirmation of AI autonomy in cyber operations.
  • Details on the extent of human involvement in the attacks.
• Bias & Deception Risks: Single-source dependency introduces selection bias and potential framing bias emphasizing AI threat. No conflicting sources or denials detected, but absence of multi-source corroboration limits reliability. Potential for adversary deception or exaggeration exists but no direct indicators present.

5. Implications and Strategic Risks — China-Linked AI Cyber Operations

The increasing use of autonomous AI agents in cyber espionage and attacks could lower barriers for sustained, large-scale operations, complicating attribution and defense. This trend may accelerate cyber conflict dynamics, particularly in contested regions like Taiwan, and influence global cybersecurity postures.

Cyber / Information Space — Global and Taiwan Critical Infrastructure

Autonomous AI agents enable faster reconnaissance and exploitation cycles, increasing attack volume and sophistication. Taiwan’s critical infrastructure faces elevated risk from AI-driven campaigns, potentially disrupting essential services and eroding confidence in cyber defenses.

Security / Counter-Terrorism — Taiwan and Regional Stability

AI-enabled cyberattacks may serve as force multipliers for state-sponsored groups, increasing asymmetric pressure on Taiwan’s security apparatus. This could escalate tensions and complicate regional security calculations.

Political / Geopolitical — China-Taiwan Relations

Persistent cyber operations employing advanced AI tools may be part of broader strategic competition, influencing diplomatic postures and signaling capabilities. Public attribution by Taiwan may affect cross-strait relations and international responses.

Economic / Social — Targeted Sectors Worldwide

Technology, financial, and chemical sectors globally face heightened espionage risks, potentially impacting intellectual property, market confidence, and supply chains. Increased cyberattacks may drive demand for enhanced cybersecurity investments.

6. Recommendations and Outlook

• Immediate Actions (0–30 days): Enhance monitoring of AI-driven cyberattack indicators, particularly autonomous agent behaviors; prioritize threat intelligence sharing with Taiwan and global partners; validate AI tool usage in observed campaigns.
• Medium-Term Posture (1–12 months): Develop capabilities to detect and mitigate autonomous AI cyber operations; invest in AI-aware cybersecurity defenses; foster multi-source intelligence fusion to confirm attribution and operational details.
• Scenario Outlook: Best: AI-driven cyberattacks remain limited in scope and are mitigated through improved defenses; Worst: Autonomous AI agents enable large-scale, persistent campaigns causing critical infrastructure disruption; Most Likely: Continued incremental increase in AI-assisted cyber espionage with ongoing attribution challenges and regional tensions.

7. Key Individuals and Entities

8. Thematic Tags

Cybersecurity, AI-driven cyberattacks, state-sponsored hacking, China-Taiwan cyber conflict, autonomous AI agents, cyber espionage, critical infrastructure security