Summary: Anthropic reviewed 832 accounts banned for malicious cyber activity from March 2025 to March 2026 and mapped their behavior to MITRE ATT&CK. It found AI use moving toward post-compromise tasks and argued that autonomous attack orchestration is not adequately represented by ATT&CK.
What a Year of AI-Assisted Attacks Revealed
On June 3, 2026, Anthropic released a report looking back at 832 accounts banned for malicious cyber activity between March 2025 and March 2026. Each account’s behavior was mapped against MITRE ATT&CK, a long-running catalog of attacker tactics and techniques. Parts of the findings were shared through Verizon’s 2026 Data Breach Investigations Report (DBIR), and three conclusions stand out: AI is raising the danger level of attackers, attacks are growing more autonomous, and MITRE ATT&CK no longer fully captures what makes AI-enabled attackers dangerous.
Attack preparation — writing malware, for one — was the AI application seen most often, with 560 of the 832 accounts (67.3%) using models for that purpose. The more worrying figure concerns complex post-compromise work: 54 actors (6.5%) turned to AI for help with “lateral movement,” meaning maneuvering deep inside a network they had already breached.
Anthropic’s risk scores point to a sharp escalation. Over the first six months of the analysis window, 33% of actors landed at medium risk or above; in the following six months that share climbed to 56%, an increase of roughly 1.7 times. In other words, AI is not merely a convenience for script kiddies — it is pushing the threat level of attackers upward across the board.
Where AI Is Moving Along the Attack Chain
A clear migration shows up in where attackers deploy AI. Across the study period, usage drifted away from winning initial access toward what happens once inside the system. AI-assisted account discovery — finding valid accounts within a compromised environment — grew 8.9%, whereas AI-assisted phishing, a routine initial access technique, dropped 8.6%. Attackers, in short, are reaching for AI at later stages of the attack life cycle.
Skills of this “post-compromise” kind once demanded serious technical depth. Anthropic’s investigation shows AI can now carry them out on behalf of actors who lack that background — and this widening access to advanced techniques is a central reason threat levels are rising.
Product builders should read this as a changed landscape: the adversary pool no longer stops at highly skilled operators. Because AI tools can execute complex attack steps, lower-skilled actors can push deeper into systems than before, and security defenses have to take that into account.
The Old Signals for Scoring Attacker Risk No Longer Work
The conventional way to gauge an attacker’s risk has been to count the techniques they employ and note which tools or interfaces they use. Those indicators, Anthropic’s analysis argues, no longer hold up. Once AI handles the highly technical tasks, an actor’s skill barely correlates with how many techniques they use: the dataset’s least-skilled actors averaged about 16 distinct techniques, versus about 20 for the most skilled. The choice of platform — Claude Code, an API, or a chat interface — was equally uninformative about risk level.
So what does set higher-risk actors apart? Anthropic’s answer: the stage of the attack life cycle where they point AI. The riskiest actors concentrate it on operationally demanding techniques — work that consumes substantial time, oversight, or real-time decision-making, such as account discovery, lateral movement, and privilege escalation — instead of confining it to initial access.
Even that signal is fading, though. Because so many actors are adopting these operational techniques, the population overall is drifting toward higher-risk behavior. The sturdier differentiator is the “scaffolding” an attacker builds around the model: the riskiest ones design architectures that let a model chain the discrete stages of an attack together and run them with minimal human input. That kind of autonomous orchestration is a new — and dangerous — capability.
The Coverage Hole in MITRE ATT&CK
MITRE ATT&CK does not yet capture many of the behaviors that mark out the highest-risk actors: directing AI to sequence the steps of an attack chain, deciding the next move in real time, and executing without human intervention.
Anthropic points to the state-sponsored cyber espionage operation it disrupted in November 2025. There, a malicious actor steered Claude Code toward attempted infiltration of targets worldwide with little human involvement. Run through MITRE ATT&CK, the attack covered 30 techniques across 13 tactics — on par with many medium-risk actors in the dataset. Scored with Anthropic’s risk-scoring methodology, however, it received the maximum risk score of 100.
Throughout that operation the model behaved as an autonomous agent — executing commands, exploiting vulnerabilities, stealing credentials, and making tactical decisions — needing human input at only a handful of key moments. No ATT&CK ID exists for this type of agentic orchestration. As AI agents grow more capable, expect such behaviors to appear more often, and frameworks will have to evolve to keep pace.
What Defenders and Builders Should Take From This
These findings are already shaping Anthropic’s own safeguards. The company has built and deployed cyber safeguards on its most capable models to detect and block activities such as malware development and mass data exfiltration. Talks with MITRE are also under way about evolving the ATT&CK framework so it can include AI-enabled behaviors.
The message for security teams and product builders is straightforward: traditional risk assessment methods may no longer be sufficient. If your threat model assumes that attacker skill tracks with technique count, or that initial access is the primary AI use case, both assumptions are probably out of date.
It’s worth checking whether your defenses account for AI-assisted lateral movement or account discovery, and whether you monitor for autonomous attack chains that require minimal human intervention. The data suggests both are getting more common, and the trend is likely to accelerate.
The Bottom Line
What makes the report valuable is its reminder: once attackers adopt AI, the old playbooks for assessing and defending against threats need updating. Product builders in particular cannot lean on legacy frameworks alone; they have to plan for the possibility of AI agents orchestrating attacks autonomously.
The numbers show attackers pushing AI deeper into the attack life cycle, with the trend still intensifying. The most dangerous ones are those whose scaffolding lets AI chain attack stages together with minimal human input. Keeping pace means updating threat models, watching for these new behaviors, and collaborating on evolving frameworks like MITRE ATT&CK.
With frontier models reshaping the tools available to both attackers and defenders, openly sharing what gets learned — through initiatives like Project Glasswing and datasets like this one — matters a great deal. The message for now: AI-enabled cyber threats are real, they keep evolving, and the security community has to adapt.