TL;DR
Anthropic’s yearlong analysis of 832 banned accounts tied to malicious cyber activity found that traditional threat metrics, including technique counts, are losing value in AI-enabled attacks. The report says the stronger signal is whether attackers build systems that let AI chain attack stages with limited human input, a behavior current taxonomies do not clearly capture.
Anthropic’s analysis of 832 accounts banned for malicious cyber activity found that common ways of judging cyberattackers, including counting the techniques they use, no longer reliably distinguish high-risk AI-enabled actors from lower-skill users, a shift that could affect how defenders rank threats in 2026.
The dataset covers accounts banned between March 2025 and March 2026 and mapped to the MITRE ATT&CK framework. According to the source material, the sample is not a full census of AI misuse; it is a set of cases detailed enough for technique-level review.
Anthropic found that 67.3% of the accounts, or 560 cases, used AI to help write malware. Another 6.5%, or 54 cases, used AI for lateral movement inside networks. The share of medium-or-higher-risk actors rose from 33% in the first six months to 56% in the second half of the period, about a 1.7-fold increase.
The report also found that technique count was a weak signal. The least-skilled actors used 16 techniques, while the most-skilled used 20, a gap too narrow to support the old assumption that more techniques mean a more capable attacker. The source material says the platform used, including Claude Code, API access or chat, did not correlate with risk.
The frameworks can’t see the thing that matters
For decades, danger meant which techniques an attacker commands. A year of real AI-enabled attacks — 832 banned accounts mapped onto MITRE ATT&CK — shows that signal breaking, just as a new, harder-to-see one takes over.
A year of real misuse, mapped to the standard taxonomy
A window, not a census — these are the cases with enough detail to assess techniques thoroughly. Inside it, the risk level climbed fast.
WHAT WAS STUDIED
THE RISK CLIMB · MEDIUM-OR-HIGHER ACTORS
AI malware detection tools
As an affiliate, we earn on qualifying purchases.
As an affiliate, we earn on qualifying purchases.
Ghidra for Digital Forensics and Malware Investigation: A Practical Guide to Reverse Engineering, Code Analysis, and Threat Detection (cybersecurity digital tools)
As an affiliate, we earn on qualifying purchases.
As an affiliate, we earn on qualifying purchases.
“More techniques” stopped meaning “more dangerous”
The old heuristic: count the techniques, judge the tooling. AI dissolved it — because the model supplies the techniques either way. Watch the old signal fail, then watch what it misses.
Risk score vs. technique count
Two ways to read the same attacker. One is going blind. Press play.
cyber threat intelligence software
As an affiliate, we earn on qualifying purchases.
As an affiliate, we earn on qualifying purchases.
AI malware analysis tools
As an affiliate, we earn on qualifying purchases.
As an affiliate, we earn on qualifying purchases.
Deeper into the attack — and into less-skilled hands
Across the year, AI use drifted from getting in toward acting once already inside — the operationally demanding stages that used to require an expert.
The attack lifecycle · where AI is now applied
The center of gravity moved right — toward post-compromise work.
network security monitoring devices
As an affiliate, we earn on qualifying purchases.
As an affiliate, we earn on qualifying purchases.
The Tao Of Network Security Monitoring: Beyond Intrusion Detection
As an affiliate, we earn on qualifying purchases.
As an affiliate, we earn on qualifying purchases.
From “what they know” to “what they’ve built”
The report sorts the signals into three tiers — one dead, one fading, one durable.
Technique count & tooling
16 vs. 20 between novice and expert; platform doesn’t correlate. The model supplies the techniques either way.
Where in the lifecycle AI is applied
Concentrating on operationally demanding, post-compromise stages is a better signal — but it’s eroding as the whole population heads there.
The scaffolding around the model
Architectures that let the model chain stages and run with minimal human input. Not what they know — whether they’ve built a system that lets AI run the attack.
AI-powered intrusion detection system
As an affiliate, we earn on qualifying purchases.
As an affiliate, we earn on qualifying purchases.
AI-powered cybersecurity tools
As an affiliate, we earn on qualifying purchases.
As an affiliate, we earn on qualifying purchases.
Fixing the map before the territory moves again
A taxonomy that can’t name the most dangerous behavior on the field will quietly mislead the people relying on it. The response runs in two directions.
Fed back into the models
The findings informed safeguards on the most capable models, built to detect & block some of what was observed:
- Blocking malware development
- Blocking mass data exfiltration
- Putting tools in defenders’ hands first (Project Glasswing)
Taking it to the source
Following the Verizon work, Anthropic says it’s in discussions with MITRE about how ATT&CK might evolve:
- A vocabulary for agentic orchestration
- Naming the scaffolding that makes a model an operator
- An interactive technique visualization on the Red blog
Reading it in proportion
- The 832 cases are a detailed subset, not the full population — the precise percentages are directional, not definitive.
- “More autonomous” is not “fully autonomous” — even the standout case needed human input at key moments, which is itself a place for defenders to intervene.
- This is one vendor’s window — the company with visibility into misuse of its own model, publishing what it found. The right thing to do with the data, and worth remembering as you read it.
Why It Matters
The findings matter because many security teams use standardized taxonomies and technique mappings to sort alerts, compare actors and prioritize response. If AI can supply technical steps to users with lower skill, then the number of techniques observed may tell defenders less about the operator behind an attack.
The stronger warning sign, according to Anthropic’s analysis, is the scaffolding built around the model: systems that allow AI to link stages of an operation and act with limited human direction. That matters because a taxonomy that cannot name that behavior may cause high-risk cases to look ordinary when viewed through existing technique labels.
Background
MITRE ATT&CK has long helped security teams describe attacker behavior across tactics such as initial access, discovery, lateral movement and privilege escalation. The Anthropic-linked analysis says AI use moved during the year from entry-stage activity toward post-compromise work, including account discovery and lateral movement.
The source material points to a November 2025 espionage operation as the clearest example. By technique count, it showed 30 techniques across 13 tactics, which could resemble many medium-risk actors. By Anthropic’s risk-scoring method, it reached the maximum risk score because the model operated as an autonomous agent.
“More techniques stopped meaning more dangerous.”
— Thorsten Meyer AI field note summarizing Anthropic’s findings
“There is no MITRE ATT&CK ID for agentic orchestration.”
— Thorsten Meyer AI field note
What Remains Unclear
It is not yet clear how representative the 832 accounts are of the wider AI-enabled threat landscape. The source describes the dataset as a detailed window into observed misuse, not a full count of malicious activity. It is also unclear how quickly MITRE ATT&CK or related frameworks may change to describe agentic orchestration, or how effective new safeguards will be against future attacker adaptations.
What’s Next
Anthropic says it has fed the findings into model safeguards and is discussing possible ATT&CK changes with MITRE, according to the source material. Defenders will be watching whether threat frameworks add vocabulary for AI-driven orchestration and whether risk scoring begins to focus more on attacker-built systems than on technique counts alone.
Key Questions
What did Anthropic study?
Anthropic studied 832 accounts banned for malicious cyber activity between March 2025 and March 2026 and mapped the activity to MITRE ATT&CK techniques.
What changed about measuring attacker risk?
The report says counting techniques is no longer a reliable proxy for attacker skill because AI can provide technical steps across the attack lifecycle. The more useful signal is whether the attacker has built infrastructure that lets AI run chained operations.
Does this mean MITRE ATT&CK is obsolete?
No. The report points to a gap in what the framework can describe, especially around agentic orchestration. ATT&CK still maps many attacker behaviors, but the source says it does not yet capture the most dangerous AI-specific pattern identified in the dataset.
What remains unknown?
The public source does not establish how common these behaviors are across all cybercrime or espionage activity. It also does not show when any framework changes may arrive or how attackers may adapt to new safeguards.
Source: Thorsten Meyer AI
