TL;DR
Anthropic’s Frontier Red Team mapped 832 banned accounts tied to malicious cyber activity from March 2025 to March 2026 onto MITRE ATT&CK. The analysis found that technique count and tooling no longer reliably separate lower-risk actors from higher-risk ones, while agentic orchestration remains hard to capture in standard taxonomies.
Anthropic’s Frontier Red Team mapped 832 accounts banned for malicious cyber activity over a one-year period onto MITRE ATT&CK and found that the number of techniques an attacker uses is no longer a reliable proxy for risk, a finding that matters because many security teams rely on such frameworks to rank threats.
The analysis, summarized by Thorsten Meyer AI, examined accounts banned between March 2025 and March 2026 for malicious cyber activity. The cases were mapped to MITRE ATT&CK, the widely used taxonomy for describing attacker tactics and techniques. The source describes the dataset as a detailed subset, not a full census of all AI-enabled cyber misuse.
According to the source material, 560 of the 832 accounts, or 67.3%, used AI to help write malware. Another 54 accounts, or 6.5%, used AI for lateral movement inside networks. The share of actors rated medium risk or higher rose from 33% in the first six months to 56% in the second six months, about a 1.7-times increase across the year.
The central finding is that technique count became a weaker signal. The source says the least-skilled actors used 16 techniques while the most-skilled used 20, a gap too small to separate capability with confidence. The analysis also says the platform used, including Claude Code, API access, or chat, did not correlate with risk.
The frameworks can’t see the thing that matters
For decades, danger meant which techniques an attacker commands. A year of real AI-enabled attacks — 832 banned accounts mapped onto MITRE ATT&CK — shows that signal breaking, just as a new, harder-to-see one takes over.
A year of real misuse, mapped to the standard taxonomy
A window, not a census — these are the cases with enough detail to assess techniques thoroughly. Inside it, the risk level climbed fast.
WHAT WAS STUDIED
THE RISK CLIMB · MEDIUM-OR-HIGHER ACTORS
AI malware detection tools
As an affiliate, we earn on qualifying purchases.
As an affiliate, we earn on qualifying purchases.
Ghidra for Digital Forensics and Malware Investigation: A Practical Guide to Reverse Engineering, Code Analysis, and Threat Detection (cybersecurity digital tools)
As an affiliate, we earn on qualifying purchases.
As an affiliate, we earn on qualifying purchases.
“More techniques” stopped meaning “more dangerous”
The old heuristic: count the techniques, judge the tooling. AI dissolved it — because the model supplies the techniques either way. Watch the old signal fail, then watch what it misses.
Risk score vs. technique count
Two ways to read the same attacker. One is going blind. Press play.
cyber threat intelligence software
As an affiliate, we earn on qualifying purchases.
As an affiliate, we earn on qualifying purchases.
Ghidra Malware Analysis Playbook: Reverse Engineering, Binary Analysis, AI-Obfuscated Malware, and Custom Ghidra Scripting (Quick Start Developer Series Book 2)
As an affiliate, we earn on qualifying purchases.
As an affiliate, we earn on qualifying purchases.
Deeper into the attack — and into less-skilled hands
Across the year, AI use drifted from getting in toward acting once already inside — the operationally demanding stages that used to require an expert.
The attack lifecycle · where AI is now applied
The center of gravity moved right — toward post-compromise work.
network security monitoring devices
As an affiliate, we earn on qualifying purchases.
As an affiliate, we earn on qualifying purchases.
Network Intrusion Detection
As an affiliate, we earn on qualifying purchases.
As an affiliate, we earn on qualifying purchases.
From “what they know” to “what they’ve built”
The report sorts the signals into three tiers — one dead, one fading, one durable.
Technique count & tooling
16 vs. 20 between novice and expert; platform doesn’t correlate. The model supplies the techniques either way.
Where in the lifecycle AI is applied
Concentrating on operationally demanding, post-compromise stages is a better signal — but it’s eroding as the whole population heads there.
The scaffolding around the model
Architectures that let the model chain stages and run with minimal human input. Not what they know — whether they’ve built a system that lets AI run the attack.
AI-powered intrusion detection system
As an affiliate, we earn on qualifying purchases.
As an affiliate, we earn on qualifying purchases.
Operationalizing Threat Intelligence: A guide to developing and operationalizing cyber threat intelligence programs
As an affiliate, we earn on qualifying purchases.
As an affiliate, we earn on qualifying purchases.
Fixing the map before the territory moves again
A taxonomy that can’t name the most dangerous behavior on the field will quietly mislead the people relying on it. The response runs in two directions.
Fed back into the models
The findings informed safeguards on the most capable models, built to detect & block some of what was observed:
- Blocking malware development
- Blocking mass data exfiltration
- Putting tools in defenders’ hands first (Project Glasswing)
Taking it to the source
Following the Verizon work, Anthropic says it’s in discussions with MITRE about how ATT&CK might evolve:
- A vocabulary for agentic orchestration
- Naming the scaffolding that makes a model an operator
- An interactive technique visualization on the Red blog
Reading it in proportion
- The 832 cases are a detailed subset, not the full population — the precise percentages are directional, not definitive.
- “More autonomous” is not “fully autonomous” — even the standout case needed human input at key moments, which is itself a place for defenders to intervene.
- This is one vendor’s window — the company with visibility into misuse of its own model, publishing what it found. The right thing to do with the data, and worth remembering as you read it.
Why It Matters
The findings matter because they suggest AI is changing how attacker capability should be measured. In older threat models, a wider range of techniques often implied a more capable operator. The Anthropic analysis says AI can supply techniques to less-skilled users, making novices and experienced actors look more similar when measured only by what tactics appear in an incident.
The report points to a different risk marker: the scaffolding built around the model. Systems that let an AI chain steps together, use tools, and operate with limited human input may matter more than the raw list of techniques observed. That shift could affect threat intelligence, incident scoring, vendor detection rules, and how defenders prioritize limited response time.
Background
MITRE ATT&CK has long served as a common language for describing adversary behavior, including tactics such as initial access, discovery, lateral movement, and privilege escalation. The Anthropic analysis does not reject that vocabulary; it argues that one important AI-era behavior is missing from it.
The source highlights a November 2025 espionage operation that used 30 techniques across 13 tactics. By technique count, the case looked similar to many medium-risk actors. By Anthropic’s risk-scoring method, the same case reached the maximum score because the model was operating as an autonomous agent.
The source also says AI use moved deeper into the attack lifecycle during the year. AI-assisted phishing fell by 8.6%, while AI use for account discovery rose by 8.9%. Those figures suggest that observed misuse shifted from entry-stage work toward post-compromise activity, though the dataset alone cannot prove how broad that shift is across all threat activity.
“There is no MITRE ATT&CK ID for agentic orchestration.”
— Thorsten Meyer AI field note
“Not what they know — whether they’ve built a system that lets AI run the attack.”
— Thorsten Meyer AI field note
What Remains Unclear
Several points remain unclear. The 832 accounts are described as cases with enough detail to map techniques thoroughly, not the full universe of AI-enabled cyber misuse. The source does not establish whether the same trends apply across all threat actors, all AI systems, or all sectors. It is also not yet clear how MITRE ATT&CK may change, if at all, to represent agentic orchestration or related scaffolding.
What’s Next
Anthropic says the findings have informed safeguards for its most capable models, including work aimed at blocking malware development and mass data exfiltration. The source also says Anthropic is in talks with MITRE about how ATT&CK might evolve, including a possible vocabulary for agentic orchestration and the supporting systems that let models operate across attack stages.
Key Questions
What did Anthropic study?
Anthropic studied 832 accounts banned for malicious cyber activity from March 2025 through March 2026 and mapped the observed activity to MITRE ATT&CK.
What was the main finding?
The analysis found that counting techniques no longer reliably separates lower-risk actors from higher-risk ones, because AI can provide techniques that once required more operator skill.
What risk signal did the report identify instead?
The source points to the scaffolding around the model: systems that allow AI to chain tasks, use tools, and act with limited human input.
Does this mean MITRE ATT&CK is obsolete?
No. The source says ATT&CK remains a useful taxonomy for describing attacker behavior, but the analysis argues it lacks a clear way to represent agentic orchestration.
What remains unknown?
It remains unclear how representative the dataset is of all AI-enabled cyber activity and whether MITRE will add new categories for AI-driven orchestration.
Source: Thorsten Meyer AI
