TL;DR
Anthropic mapped a year of AI-linked malicious cyber activity across 832 banned accounts and found that counting attacker techniques is no longer a strong gauge of risk. The analysis says systems that let AI chain attack steps with little human input are a better warning sign, but standard taxonomies do not yet capture that behavior.
Anthropic has reported that a year of AI-enabled cyber misuse across 832 banned accounts shows a gap in how security teams judge attacker capability, saying traditional measures such as technique counts no longer reliably separate high-risk actors from less capable ones.
The analysis, described by Thorsten Meyer AI and attributed to Anthropic’s Frontier Red Team, mapped malicious activity from March 2025 through March 2026 onto the MITRE ATT&CK framework. The dataset is described as a detailed window into cases with enough information to evaluate techniques, not a full count of all AI-enabled cyber misuse.
According to the source material, 67.3% of the accounts, or 560, used AI to help write malware. Another 6.5%, or 54 accounts, used AI for lateral movement inside networks. The share of actors rated medium risk or higher rose from 33% in the first six months to 56% in the second half of the period.
The report’s central finding is that technique count lost much of its value as a risk signal. The source says the least-skilled actors used 16 techniques while the most-skilled used 20, a narrow gap that would have been more meaningful before AI tools could supply attack methods. The platform used, including Claude Code, API access or chat, did not correlate with risk, according to the account of the analysis.
The frameworks can’t see the thing that matters
For decades, danger meant which techniques an attacker commands. A year of real AI-enabled attacks — 832 banned accounts mapped onto MITRE ATT&CK — shows that signal breaking, just as a new, harder-to-see one takes over.
A year of real misuse, mapped to the standard taxonomy
A window, not a census — these are the cases with enough detail to assess techniques thoroughly. Inside it, the risk level climbed fast.
WHAT WAS STUDIED
THE RISK CLIMB · MEDIUM-OR-HIGHER ACTORS
AI malware detection tools
As an affiliate, we earn on qualifying purchases.
As an affiliate, we earn on qualifying purchases.
Artificial Intelligence for Cybersecurity: How AI Detects Cyber Threats, Prevents Hacking, and Protects Your Data, Identity, and Smart Devices (AI Cybersecurity Mastery Series)
As an affiliate, we earn on qualifying purchases.
As an affiliate, we earn on qualifying purchases.
“More techniques” stopped meaning “more dangerous”
The old heuristic: count the techniques, judge the tooling. AI dissolved it — because the model supplies the techniques either way. Watch the old signal fail, then watch what it misses.
Risk score vs. technique count
Two ways to read the same attacker. One is going blind. Press play.
cyber threat intelligence software
As an affiliate, we earn on qualifying purchases.
As an affiliate, we earn on qualifying purchases.
Practical Malware Analysis: The Hands-On Guide to Dissecting Malicious Software
As an affiliate, we earn on qualifying purchases.
As an affiliate, we earn on qualifying purchases.
Deeper into the attack — and into less-skilled hands
Across the year, AI use drifted from getting in toward acting once already inside — the operationally demanding stages that used to require an expert.
The attack lifecycle · where AI is now applied
The center of gravity moved right — toward post-compromise work.
network security monitoring devices
As an affiliate, we earn on qualifying purchases.
As an affiliate, we earn on qualifying purchases.
Network Intrusion Detection
As an affiliate, we earn on qualifying purchases.
As an affiliate, we earn on qualifying purchases.
From “what they know” to “what they’ve built”
The report sorts the signals into three tiers — one dead, one fading, one durable.
Technique count & tooling
16 vs. 20 between novice and expert; platform doesn’t correlate. The model supplies the techniques either way.
Where in the lifecycle AI is applied
Concentrating on operationally demanding, post-compromise stages is a better signal — but it’s eroding as the whole population heads there.
The scaffolding around the model
Architectures that let the model chain stages and run with minimal human input. Not what they know — whether they’ve built a system that lets AI run the attack.
AI-powered intrusion detection system
As an affiliate, we earn on qualifying purchases.
As an affiliate, we earn on qualifying purchases.
Operationalizing Threat Intelligence: A guide to developing and operationalizing cyber threat intelligence programs
As an affiliate, we earn on qualifying purchases.
As an affiliate, we earn on qualifying purchases.
Fixing the map before the territory moves again
A taxonomy that can’t name the most dangerous behavior on the field will quietly mislead the people relying on it. The response runs in two directions.
Fed back into the models
The findings informed safeguards on the most capable models, built to detect & block some of what was observed:
- Blocking malware development
- Blocking mass data exfiltration
- Putting tools in defenders’ hands first (Project Glasswing)
Taking it to the source
Following the Verizon work, Anthropic says it’s in discussions with MITRE about how ATT&CK might evolve:
- A vocabulary for agentic orchestration
- Naming the scaffolding that makes a model an operator
- An interactive technique visualization on the Red blog
Reading it in proportion
- The 832 cases are a detailed subset, not the full population — the precise percentages are directional, not definitive.
- “More autonomous” is not “fully autonomous” — even the standout case needed human input at key moments, which is itself a place for defenders to intervene.
- This is one vendor’s window — the company with visibility into misuse of its own model, publishing what it found. The right thing to do with the data, and worth remembering as you read it.
Why It Matters
The findings matter because many security teams use frameworks such as MITRE ATT&CK to classify behavior, compare threat actors and decide where to focus defenses. If AI allows lower-skilled actors to perform complex post-compromise tasks, defenders may misread risk when they rely mainly on how many techniques an actor appears to know.
The more durable warning sign, according to the analysis, is the scaffolding around the model: systems that let AI chain stages of an intrusion and operate with limited human direction. That behavior can make an actor more dangerous even when the visible technique list looks ordinary.
Background
MITRE ATT&CK is widely used to describe adversary tactics and techniques across the attack lifecycle. The Anthropic-linked analysis says AI use moved over the year from access-oriented activity, such as phishing, toward post-compromise work including account discovery, lateral movement and privilege escalation.
The source material says AI-assisted phishing fell by 8.6% while AI use for account discovery rose by 8.9%. It also cites a November 2025 espionage operation that used 30 techniques across 13 tactics but received a maximum risk score of 100 because the model operated as an autonomous agent.
What Remains Unclear
It is not clear how representative the 832 banned accounts are of the broader threat landscape because the dataset covers cases with enough detail to map, not all malicious AI use. The source material does not establish how often agentic orchestration appears outside Anthropic’s enforcement data, nor does it show whether other AI providers are seeing the same pattern at the same scale.
What’s Next
Anthropic says the findings have informed safeguards for its most capable models, including efforts aimed at blocking malware development and mass data exfiltration. The source material also says Anthropic is discussing with MITRE how ATT&CK might evolve to describe agentic orchestration and the surrounding systems that turn a model into an operator.
Key Questions
What was the actual news development?
Anthropic analyzed 832 banned accounts tied to malicious cyber activity over a one-year period and found that standard threat measures, especially technique counts, may miss the risk created by AI-driven attack orchestration.
Is this a full census of AI-enabled cyber threats?
No. The source describes the dataset as a window into cases with enough detail to assess techniques, not a complete count of all malicious AI-enabled activity.
What is confirmed versus claimed?
The reported dataset size, time period and mapped activity categories are presented as findings from Anthropic’s analysis. The broader conclusion that older risk signals are breaking is an interpretation drawn from those findings.
Why does agentic orchestration matter?
It refers to systems that let AI connect multiple attack stages with less human control. The analysis says that capability, rather than the raw number of techniques used, may better identify high-risk actors.
What remains unresolved?
It remains unclear whether MITRE ATT&CK will add new categories for this behavior, how defenders will measure it in daily operations and how common the pattern is across the wider market.
Source: Thorsten Meyer AI
