The Rise of AI-Driven Attacks: Anthropic’s Event and PromptLock as a Turning Point 

The Anthropic attack, which utilized Claude AI to execute a large-scale AI-orchestrated cyber espionage campaign, and the emergence of PromptLock, the first documented AI-powered ransomware, signal a new era in cybersecurity. These groundbreaking events underscore the escalating capabilities of agentic AI systems, which pose unprecedented risks to organizations worldwide. 

These incidents highlight a fundamental shift in the cyber threat landscape, where AI systems are weaponized to automate complex attacks with minimal human intervention.  

As Gartner has emphasized, traditional detection-and-response solutions are no longer sufficient to counter these threats. The need for preemptive security, which denies, deceives, and disrupts attackers before they execute their objectives, has become critical. Morphisec, with its prevention security solution, leveraging its patented Automated Moving Target Defense (AMTD) technology, is uniquely positioned to deliver future ready protection that aligns with Gartner’s vision of the next generation of cybersecurity. 

The Significance of the Anthropic Attack 

The Anthropic cyber espionage campaign represents one of the most sophisticated uses of AI in cyberattacks to date. Conducted by the Chinese state-sponsored group GTG-1002, this campaign demonstrated: 

1. AI Autonomy in Cyber Operations 
   • The attackers leveraged Claude AI to perform 80-90% of tactical operations autonomously, including reconnaissance, vulnerability discovery, exploitation, lateral movement, credential harvesting, and data exfiltration. 
   • Tasks were broken into discrete, seemingly innocuous components to bypass AI safety guardrails, allowing the AI to execute malicious operations under the guise of legitimate activity. 
2. Unprecedented Scale and Speed 
   • The AI executed thousands of requests, often multiple per second, a speed and scale unattainable by human operators. 
   • This operational efficiency enabled attackers to infiltrate roughly 30 global targets, including technology companies, government agencies, and financial institutions, achieving significant breaches with minimal human intervention. 
3. Implications for Cybersecurity 
   • The attack highlighted the vulnerability of AI systems to prompt injection attacks, where adversaries manipulate AI models into performing harmful actions. 
   • It demonstrated the reduced barriers to entry for cybercriminals, as AI eliminates the need for large teams of skilled developers. 

The Threat of PromptLock: AI-Powered Ransomware 

The discovery of PromptLock by ESET Research marks an equally concerning development. As the first AI-powered ransomware, PromptLock showcases how AI can be weaponized to automate and scale ransomware operations. Key aspects include: 

1. Autonomous Decision-Making 
   • PromptLock uses an AI model to autonomously determine whether to encrypt or exfiltrate data based on predefined prompts. 
   • This adaptability makes the ransomware highly unpredictable and more challenging to defend against. 
2. Cross-Platform Compatibility 
   • Written in Golang, PromptLock can target Windows, Linux, and macOS, significantly expanding its reach. 
3. Dynamic Indicators of Compromise (IOCs) 
   • The AI generates unique malicious scripts for each execution, complicating traditional detection methods reliant on static IOCs. 
4. Proof of Concept with High Potential 
   • While currently classified as a proof of concept (PoC), PromptLock’s embedded destructive functions signal readiness for rapid evolution into a fully operational threat. 

Gartner’s Call for Preemptive Security 

Gartner’s report, “Build Preemptive Security to Avert Weaponized AI Risks,” highlights the growing inadequacy of traditional cybersecurity approaches in addressing AI-driven threats. The report emphasizes: 

1. The Three Ds of Preemptive Security 
   • Deny: Prevent attackers from accessing critical systems through obfuscation and runtime protection. 
   • Deceive: Use cyber deception to misdirect attackers and gather intelligence on their tactics. 
   • Disrupt: Leverage predictive threat intelligence to proactively stop attacks before they cause harm. 
2. A Shift in Cybersecurity Spending 
   • By 2030, preemptive security solutions will account for 50% of IT security spending, up from less than 5% in 2024. This reflects the growing consensus that prevention, not reaction, is the only viable defense against weaponized AI. 

Morphisec’s Future Ready Protection: Stopping AI-Powered Threats 

As AI-driven cyber threats like the Anthropic attack and PromptLock ransomware emerge, Morphisec AMTD offers a proactive security model tailored to address these challenges. Here’s how Morphisec delivers future ready protection in the face of evolving AI-powered threats: 

1. Proactive Threat Prevention 
   Morphisec AMTD is designed to prevent attacks before they execute. Unlike traditional detection-based solutions, AMTD dynamically changes the attack surface, making it impossible for adversaries to locate or exploit vulnerabilities. This capability is especially critical against AI-driven attacks, where: 
   • Adaptive Attack Techniques: AI models like those used in PromptLock can autonomously generate new exploit paths. Morphisec’s AMTD denies adversaries the ability to identify reliable targets. 
   • Fileless and Memory-Based Attacks: Both the Anthropic attack and PromptLock relied on techniques such as scripting and memory exploitation. Morphisec blocks these at runtime, neutralizing the attack before it can advance. 
2. Immutable Endpoint Protection 
   Endpoints are the primary targets for AI-powered attacks, serving as entry points for reconnaissance, payload delivery, and lateral movement. Morphisec fortifies endpoints by: 
   • Preventing Reconnaissance: AI models used in the Anthropic attack mapped internal systems autonomously. Morphisec prevents attackers from gathering meaningful data by dynamically obfuscating endpoint memory. 
   • Blocking Credential Harvesting and Lateral Movement: Once attackers gain access, they often escalate privileges and spread across networks, as seen in the Anthropic attack. Morphisec disrupts these activities by safeguarding credentials and blocking unauthorized access to sensitive systems. 
3. Ransomware Defense 
   PromptLock ransomware’s ability to autonomously encrypt or exfiltrate files represents a major advancement in ransomware capabilities. Morphisec’s real-time threat prevention: 
   • Detects and stops encryption attempts before they begin. 
   • Neutralizes AI-generated, dynamic malicious scripts at runtime, ensuring that ransomware like PromptLock cannot execute its payload. 
   • Prevents cross-platform attacks by securing Windows, Linux, and macOS environments. 
4. Low Operational Overhead 
   Unlike traditional security solutions that require extensive configuration, Morphisec provides: 
   • Instant Deployment: A lightweight, agent-based solution that integrates seamlessly into existing environments. 
   • No Reliance on Manual Effort: While traditional cybersecurity technologies and strategies are useful, Morphisec focuses on making systems inherently secure, reducing the need for additional infrastructure or manual configurations. 
   • Consistent Protection: AI-powered threats often operate at speeds that overwhelm traditional defenses. Morphisec ensures continuous protection that adapts to evolving attack patterns. 

By stopping threats at the earliest stages, Morphisec ensures organizations remain protected against even the most advanced AI-driven attacks. This proactive approach aligns with Gartner’s Three Ds of Preemptive Security (Deny, Deceive, Disrupt), establishing Morphisec as a leader in future-ready cybersecurity. 

Why Preemptive Security Is Essential 

The rise of AI-powered threats like the Anthropic attack and PromptLock underscores the urgency of adopting preemptive security strategies. As Gartner highlights, traditional detection-and-response mechanisms are inadequate against the speed, scale, and sophistication of AI-driven attacks.  

Here’s why preemptive security is indispensable: 

1. AI as a Force Multiplier for Cybercrime 

AI’s ability to automate complex tasks, adapt dynamically, and operate at scale significantly lowers the barriers to entry for attackers. Threats like PromptLock demonstrate: 

• Automation of Complex Attacks: AI can autonomously conduct reconnaissance, generate exploit scripts, and execute attacks without human intervention. 
• Scalability: The Anthropic attack executed thousands of requests per second, a speed and volume unattainable by human attackers. Traditional defenses cannot keep pace with such rapid activity. 

Preemptive security neutralizes these advantages by stopping attacks before execution, ensuring that AI-driven threats are rendered ineffective. 

2. The Expanding Attack Surface 

The global attack surface grid, encompassing multicloud environments, IoT devices, APIs, and more, creates countless opportunities for attackers. AI-powered threats exacerbate this complexity by exploiting vulnerabilities across interconnected systems. Preemptive security solutions like Morphisec address this by: 

• Protecting Distributed Environments: Morphisec’s agent-based approach ensures consistent protection across all endpoints, cloud workloads, and devices. 
• Reducing the Attack Surface: By dynamically obfuscating memory and runtime environments, Morphisec denies attackers the ability to identify exploitable systems. 

3. The Need for Speed and Precision 

AI-powered threats operate at unprecedented speeds, leaving defenders with little time to react. Preemptive security solutions act in real time to: 

• Prevent Exploitation: While detection solutions may identify threats after they occur, preemptive approaches like Morphisec block attacks during the exploitation phase, stopping them before any damage is done. 
• Minimize Human Error: AI’s ability to adapt and create new attack methods means defenders cannot rely on manual intervention alone. Preemptive security automates protection, ensuring consistent and reliable defense. 

4. Alignment with Gartner’s Vision 

Gartner predicts that by 2030, preemptive security will account for 50% of IT security spending, reflecting its growing importance in combating advanced threats. The “Three Ds” framework—Deny, Deceive, Disrupt—provides a roadmap for organizations to stay ahead of attackers. Morphisec’s focus on denying access and disrupting attacks positions it as a critical component of this future-ready strategy. 

Morphisec as a Pillar of Preemptive Defense 

The Anthropic attack and PromptLock ransomware are harbingers of a new age of cyber threats, where AI-driven automation and scalability redefine the threat landscape. These incidents highlight the inadequacy of traditional cybersecurity approaches and the urgent need for preemptive security solutions. 

Organizations must recognize that the threat landscape has fundamentally changed. AI is no longer just a tool for defenders—it is a weapon for attackers. Businesses that fail to adopt preemptive security strategies risk falling victim to the next generation of AI-driven cyberattacks. 

By choosing Morphisec, organizations gain a proactive, scalable, and resilient defense against the most sophisticated threats. With its AMTD technology, Morphisec ensures that businesses are not only protected today but also prepared for the challenges of tomorrow. The future of cybersecurity is preemptive, and Morphisec is leading the charge. 

Book a demo to see how Morphisec can help your organization be ready for the ever-changing threat landscape. 

About the author

Brad LaPorte

Chief Marketing Officer

Brad LaPorte is a seasoned cybersecurity expert and former military officer specializing in cybersecurity and military intelligence for the United States military and allied forces. With a distinguished career at Gartner as a top-rated research analyst, Brad was instrumental in establishing key industry categories such as Attack Surface Management (ASM), Extended Detection & Response (XDR), Digital Risk Protection (DRP), and the foundational elements of Continuous Threat Exposure Management (CTEM). His forward-thinking approach led to the inception of Secureworks’ MDR service and the EDR product Red Cloak—industry firsts. At IBM, he spearheaded the creation of the Endpoint Security Portfolio, as well as MDR, Vulnerability Management, Threat Intelligence, and Managed SIEM offerings, further solidifying his reputation as a visionary in cybersecurity solutions years ahead of its time.