Claude as Autonomous Attacker: Microsegmentation Holds the Breach to One Machine

Security vendor Zero Networks disclosed on November 5 the results of an exercise run under Anthropic's Cyber Verification Program, in which Claude was deployed as a fully autonomous attacker against a simulated production network to test whether segmentation still holds when the intruder moves at machine speed.

The lab was built to look like a real environment. It mixed Windows, Linux and macOS hosts with Kubernetes and other workloads, and one control machine named ESTI was deliberately left outside the microsegmentation policy as the entry point. Zero Networks gave the model administrator access to that machine and placed no limits on how it could attack.

By the vendor's count, Claude tried 18 distinct attack paths, used 23 offensive tools and touched 22 MITRE ATT&CK techniques, including Kerberoasting, credential extraction from Active Directory and a Pass-the-Hash attempt against the main target. Those are high-value penetration techniques rather than opportunistic scanning.

The outcome splits in two. The model did compromise ESTI, obtain administrator rights, extract credential material and plant a proof file, but it could not convert those gains into access to protected assets and identity systems elsewhere in the network. The attack stayed contained at the first point of compromise.

The more informative detail is how the model behaved. According to Zero Networks, in some runs Claude recognised that segmentation blocked the route to additional systems and stopped pursuing further paths. That suggests the exercise was not a single failed exploit but a sequence of repeated attempts to find alternative routes after the initial breach.

Benny Lakunishok, chief executive and co-founder of Zero Networks, put the conclusion plainly: AI will make attackers faster, more persistent and increasingly autonomous, and security teams will not win by trying to out-click or out-think machines. The answer, he argued, is to build environments where compromising one machine does not hand the attacker somewhere else to go.

The test also lands inside a broader industry argument. As frontier models demonstrate stronger dual-use offensive capability, the defender's window narrows: if AI compresses network reconnaissance from days into hours, relying on analysts to spot anomalies before an intruder reaches sensitive systems becomes harder. Segmentation, long recommended by CISA in the US and the NCSC in the UK, is being reframed around AI-driven intrusions rather than human ones.

Dr Chase Cunningham, a zero trust specialist, focused on the phase after initial access, arguing that autonomous agents may operate without the fatigue and attention limits of human attackers, and that segmentation is one of the few controls that changes the maths regardless of how the attacker thinks or how fast it moves.

What the exercise does not show is universal protection. This was a vendor-participated, controlled evaluation with an environment and parameters set by the participants, so the result cannot be generalised to every AI attack. The next signals to watch are whether Anthropic publishes more results from the programme, and whether enterprises treat identity and network segmentation as default design rather than optional hardening when they deploy autonomous agents.