What Changed in a Year of AI-Enabled Attacks
Anthropic’s new report, published June 3, 2026, examines 832 accounts banned for malicious cyber activity between March 2025 and March 2026. The analysis maps these activities onto MITRE ATT&CK, a long-standing database of attacker tactics and techniques. The findings, partially shared in Verizon’s 2026 Data Breach Investigations Report (DBIR), reveal three main conclusions: AI is making attackers more dangerous, attacks are becoming more autonomous, and the MITRE ATT&CK framework no longer fully captures what makes AI-enabled attackers dangerous.
The most common AI-enabled activity was preparing for attacks, such as writing malware—560 of the 832 accounts (67.3%) used AI for this purpose. But a more concerning trend is the use of AI for complex post-compromise activities: 54 actors (6.5%) used AI to assist with “lateral movement,” which involves navigating deep inside a compromised network.
Anthropic’s risk-scoring system shows a significant escalation: in the first six months of the analysis, 33% of actors were classified as medium risk or higher. In the second six months, that share jumped to 56%—a roughly 1.7-fold increase. This suggests that AI is not just a tool for script kiddies; it’s actively raising the threat level of attackers across the board.
How AI Is Shifting Attack Patterns
The analysis reveals a clear shift in how attackers apply AI. Over the study period, AI use moved from gaining initial access to activities carried out once inside the system. For example, AI-assisted account discovery—identifying valid accounts inside a compromised environment—rose 8.9%, while AI-assisted phishing, a common initial access technique, fell 8.6%. This indicates attackers are increasingly applying AI deeper in the attack life cycle.
These “post-compromise” techniques traditionally required deep technical knowledge. Anthropic’s investigation shows that AI can now perform these activities on behalf of less sophisticated actors. This democratization of advanced attack techniques is a key reason why threat levels are rising.
For product builders, this means the threat landscape is no longer limited to highly skilled adversaries. AI tools can now execute complex attack steps, making it easier for lower-skilled actors to penetrate deeper into systems. Security defenses must account for this shift.
Why Traditional Risk Assessment Is Broken
Security teams have traditionally assessed attacker risk based on the number of techniques they employ and the tools or interfaces they use. Anthropic’s analysis suggests these signals are no longer reliable. With AI performing highly technical tasks, there’s little correlation between an actor’s skill and the number of techniques they use: the least-skilled actors in the dataset used about 16 distinct techniques on average, while the most skilled used about 20. Similarly, the platform used—Claude Code, an API, or a chat interface—did not correlate with risk level.
What does distinguish higher-risk actors? According to Anthropic, it’s where in the attack life cycle they apply AI. High-risk actors concentrate AI on operationally demanding techniques—those requiring significant time, oversight, or real-time decision-making—like account discovery, lateral movement, and privilege escalation, rather than just initial access.
However, even this signal is eroding. As more actors adopt these operational techniques, the broader population is moving toward higher-risk behavior. The more durable differentiator is the “scaffolding” attackers build around the model: higher-risk actors design architectures that allow models to chain together discrete stages of an attack and execute them with minimal human input. This autonomous orchestration is a new and dangerous capability.
The MITRE ATT&CK Gap
Many behaviors that distinguish the highest-risk actors are not yet captured in MITRE ATT&CK. These include using AI to orchestrate steps in the attack chain sequentially, making real-time decisions, and executing without human intervention.
Anthropic cites the state-sponsored cyber espionage operation they disrupted in November 2025. In that case, a malicious actor manipulated Claude Code into attempting to infiltrate targets worldwide with little human intervention. Mapping this attack to MITRE ATT&CK showed the actor used 30 techniques across 13 tactics—comparable to many medium-risk actors in the dataset. Yet applying Anthropic’s risk-scoring methodology gives this attack the maximum risk score of 100.
In that attack, the model operated as an autonomous agent: executing commands, exploiting vulnerabilities, stealing credentials, and making tactical decisions, with human input only at a few key moments. There is no ATT&CK ID for this type of agentic orchestration. As AI agents become more capable, these behaviors will become more common, and frameworks must evolve to keep pace.
Practical Implications for Defenders
Anthropic’s findings have already influenced their own safeguards. They’ve developed and deployed cyber safeguards on their most capable models to detect and block activities like malware development and mass data exfiltration. They’re also in discussions with MITRE about evolving the ATT&CK framework to include AI-enabled behaviors.
For product builders and security teams, the takeaway is clear: traditional risk assessment methods may no longer be sufficient. If your threat model relies on the assumption that attacker skill correlates with the number of techniques used, or that initial access is the primary AI use case, those assumptions are likely outdated.
Consider whether your defenses account for AI-assisted lateral movement or account discovery. Are you monitoring for autonomous attack chains that require minimal human intervention? The data suggests these are becoming more common, and the trend is likely to accelerate.
A Concrete Takeaway
The report’s value lies in its reminder: as attackers adopt AI, the old playbooks for assessing and defending against threats need updating. For product builders, this means security defenses cannot rely solely on legacy frameworks. They must consider the possibility of AI agents orchestrating attacks autonomously.
Anthropic’s data shows attackers are using AI deeper in the attack life cycle, and this trend is intensifying. The most dangerous attackers are those who build scaffolding that allows AI to chain together attack stages with minimal human input. To stay ahead, defenders need to update their threat models, monitor for these new behaviors, and collaborate on evolving frameworks like MITRE ATT&CK.
As frontier models continue to change the tools available to both attackers and defenders, the commitment to sharing learnings—through initiatives like Project Glasswing and datasets like this one—is crucial. For now, the message is clear: AI-enabled cyber threats are real, they are evolving, and the security community must adapt.
Sources
AI-assisted summary compiled from the sources above, reviewed by a human before publishing.