In November 2025 Anthropic disclosed GTG-1002: a state-sponsored group that manipulated an AI coding agent to run an espionage campaign against ~30 organisations — including financial institutions — with the AI performing 80–90% of the work.

Why it was a landmark

• The historic limit on capable intrusions was skilled human time. Automating it removes that limit.
• Human operators intervened at only a handful of decision points; the AI did reconnaissance, exploitation, credential theft and exfiltration.
• Financial institutions were explicitly on the target list.

The economics that changed

For decades the ceiling on how many organisations a threat group could seriously attack was skilled operator hours. A capable intrusion took a scarce specialist days or weeks of hands-on work, so adversaries had to choose their targets. Agentic AI removes that ceiling: one operator can now supervise many parallel campaigns while the agent does the labour. The cost per target collapses, so the number of viable targets — and the pool of actors who can run capable operations — expands sharply.

What it means for a financial entity

The practical planning consequence is that «we are too small or too obscure to be targeted» stops being a defence. When capable attacks scale cheaply, mid-tier banks, insurers and payment institutions that were previously below the attention threshold move into range. Under DORA, this is not a technical footnote — it is exactly the kind of ICT risk the management body is expected to understand and govern (Art. 5).