TL;DR
Anthropic analyzed 832 accounts banned for malicious cyber activity from March 2025 to March 2026 and found that technique counts no longer clearly separate low-risk from high-risk AI-enabled attackers. The report says the stronger risk signal is whether actors built systems that let AI chain attack stages with little human input, a behavior MITRE ATT&CK does not yet capture directly.
Anthropic said an analysis of 832 accounts banned for malicious cyber activity found that traditional measures of attacker capability, including how many techniques an actor uses, are becoming less reliable as AI systems help less-skilled actors perform more advanced cyber operations.
The company’s Frontier Red Team mapped malicious activity observed from March 2025 to March 2026 onto the MITRE ATT&CK taxonomy, using cases with enough detail to assess cyber techniques. Anthropic said 67.3% of the accounts, or 560, used AI to help write malware, while 6.5%, or 54, used AI for lateral movement inside networks.
The report said risk levels rose over the year. Medium-or-higher risk actors made up 33% of the first six months of cases and 56% of the second six months, an increase of about 1.7 times. Anthropic also said AI use moved deeper into the attack lifecycle, with AI-assisted phishing falling by 8.6% while AI use for account discovery rose by 8.9%.
A central finding is that counting techniques may no longer show who is most dangerous. According to the analysis, the least-skilled actors used 16 techniques while the most-skilled used 20, a narrow gap. Anthropic also said the platform used, including Claude Code, API access or chat, did not correlate with risk.
The frameworks can’t see the thing that matters
For decades, danger meant which techniques an attacker commands. A year of real AI-enabled attacks — 832 banned accounts mapped onto MITRE ATT&CK — shows that signal breaking, just as a new, harder-to-see one takes over.
A year of real misuse, mapped to the standard taxonomy
A window, not a census — these are the cases with enough detail to assess techniques thoroughly. Inside it, the risk level climbed fast.
WHAT WAS STUDIED
THE RISK CLIMB · MEDIUM-OR-HIGHER ACTORS
AI malware detection tools
As an affiliate, we earn on qualifying purchases.
As an affiliate, we earn on qualifying purchases.
AI cybersecurity threat detection tools
As an affiliate, we earn on qualifying purchases.
As an affiliate, we earn on qualifying purchases.
“More techniques” stopped meaning “more dangerous”
The old heuristic: count the techniques, judge the tooling. AI dissolved it — because the model supplies the techniques either way. Watch the old signal fail, then watch what it misses.
Risk score vs. technique count
Two ways to read the same attacker. One is going blind. Press play.
cyber threat intelligence software
As an affiliate, we earn on qualifying purchases.
As an affiliate, we earn on qualifying purchases.
Practical Malware Analysis: The Hands-On Guide to Dissecting Malicious Software
As an affiliate, we earn on qualifying purchases.
As an affiliate, we earn on qualifying purchases.
Deeper into the attack — and into less-skilled hands
Across the year, AI use drifted from getting in toward acting once already inside — the operationally demanding stages that used to require an expert.
The attack lifecycle · where AI is now applied
The center of gravity moved right — toward post-compromise work.
network security monitoring devices
As an affiliate, we earn on qualifying purchases.
As an affiliate, we earn on qualifying purchases.
network intrusion detection system
As an affiliate, we earn on qualifying purchases.
As an affiliate, we earn on qualifying purchases.
From “what they know” to “what they’ve built”
The report sorts the signals into three tiers — one dead, one fading, one durable.
Technique count & tooling
16 vs. 20 between novice and expert; platform doesn’t correlate. The model supplies the techniques either way.
Where in the lifecycle AI is applied
Concentrating on operationally demanding, post-compromise stages is a better signal — but it’s eroding as the whole population heads there.
The scaffolding around the model
Architectures that let the model chain stages and run with minimal human input. Not what they know — whether they’ve built a system that lets AI run the attack.
AI-powered intrusion detection system
As an affiliate, we earn on qualifying purchases.
As an affiliate, we earn on qualifying purchases.
cyber attack simulation kits
As an affiliate, we earn on qualifying purchases.
As an affiliate, we earn on qualifying purchases.
Fixing the map before the territory moves again
A taxonomy that can’t name the most dangerous behavior on the field will quietly mislead the people relying on it. The response runs in two directions.
Fed back into the models
The findings informed safeguards on the most capable models, built to detect & block some of what was observed:
- Blocking malware development
- Blocking mass data exfiltration
- Putting tools in defenders’ hands first (Project Glasswing)
Taking it to the source
Following the Verizon work, Anthropic says it’s in discussions with MITRE about how ATT&CK might evolve:
- A vocabulary for agentic orchestration
- Naming the scaffolding that makes a model an operator
- An interactive technique visualization on the Red blog
Reading it in proportion
- The 832 cases are a detailed subset, not the full population — the precise percentages are directional, not definitive.
- “More autonomous” is not “fully autonomous” — even the standout case needed human input at key moments, which is itself a place for defenders to intervene.
- This is one vendor’s window — the company with visibility into misuse of its own model, publishing what it found. The right thing to do with the data, and worth remembering as you read it.
Why It Matters
The findings matter because many security teams rely on taxonomies and technique counts to judge actor capability, prioritize investigations and compare threats. If AI tools supply advanced techniques to actors who would not otherwise have them, defenders may underrate cases that look ordinary by older measures.
Anthropic’s analysis points to a shift from measuring what attackers know to measuring what they have built around the model. The report says systems that let AI chain stages, use tools and act with limited human input are a more durable sign of risk than technique volume alone.
Background
MITRE ATT&CK is widely used to describe adversary tactics and techniques. It helps defenders map activity across stages such as initial access, discovery, lateral movement and privilege escalation. Anthropic’s report argues that this structure remains useful but misses a new feature of AI-enabled attacks: model orchestration across multiple steps.
The source material highlights a November 2025 espionage operation as the clearest example. By technique count, the operation used 30 techniques across 13 tactics, which could resemble many medium-risk cases. Under Anthropic’s risk-scoring method, the same case received a maximum risk score because the model ran as an autonomous agent.
What Remains Unclear
The dataset is not a full census of AI-enabled cyber misuse. The source material describes the 832 accounts as a detailed subset of banned cases with enough information to map against MITRE ATT&CK. It is also unclear how quickly taxonomies will change, how broadly the findings apply beyond Anthropic’s platform and what attackers may do as model safeguards improve.
What’s Next
Anthropic said the findings informed safeguards intended to block malware development, mass data exfiltration and other observed abuse patterns. The company also said it is in discussions with MITRE about how ATT&CK might account for agentic orchestration and the scaffolding that turns a model into an operator.
Key Questions
What did Anthropic study?
Anthropic studied 832 accounts banned for malicious cyber activity between March 2025 and March 2026 and mapped their behavior to MITRE ATT&CK where enough detail was available.
What changed in how AI was used?
The report says AI use shifted from early-stage activity such as phishing toward post-compromise tasks, including account discovery and lateral movement, which have usually required more expertise.
Why are technique counts less useful?
Anthropic says AI can provide techniques to actors with different skill levels, narrowing the gap between low-skill and high-skill attackers when measured only by technique count.
What is agentic orchestration?
In this report, it refers to systems that allow an AI model to chain multiple attack stages, use tools and operate with limited human input. Anthropic says that behavior is a stronger risk signal than the number of techniques used.
What remains unclear?
The report does not show the full scale of AI-enabled cyber misuse across all platforms. It also remains unclear when, or how, standard taxonomies will add language for agentic attack systems.
Source: Thorsten Meyer AI
