Ledger / 8 Sep 2026
PRC group chained Claude, Gemini and Codex into an exploitation pipeline
Strong
Google attributes with technical evidence from tooling, not provider telemetry for all models.
The group used CC Switch to query several LLMs for custom exploit scripts, spear-phishing lures and debugging.
“the actor used the tool CC Switch to operate various LLMs, rapidly querying Claude, Gemini, or Codex to write custom exploit scripts, generate convincing spear-phishing lures, or debug errors”Google Threat Intelligence Group
Sources
- GTIG AI Threat Tracker: From Prompting to AutonomyGoogle Threat Intelligence Group · 8 Sep 2026 · primary source
- Disclosed
- 8 Sep 2026
- Activity
- 2026
- Actor
- PRC-nexus espionage group (unnamed) (nation state), as attributed by Google Threat Intelligence Group
- Nexus
- China
- Targets
- Government entities
- What the AI did
- Exploit dev, Phishing content, Ops automation
- Model
- Claude, Gemini, Codex (via CC Switch)
- Model family
- Anthropic, Google, OpenAI
- Model basis
- stated by vendor
- Autonomy
- semi-autonomous
- Outcome
- Google reports the pipeline under experimentation.