AI is moving attackers up the skill ladder - fast
Anthropic dug into 832 accounts it banned for malicious cyber activity over a year and mapped their behavior onto MITRE ATT&CK, the security industry's standard catalog of attacker tactics. Some findings were published in Verizon's 2026 Data Breach Investigations Report; here's the sharper, more detailed version.
Attackers are using AI for the hard parts now
Most malicious use is still mundane prep work - 67% of the studied accounts used AI to write malware or otherwise get ready. But the worrying shift is toward complex, post-compromise activity that used to require real expertise:
- AI-assisted account discovery (finding valid accounts inside a breached network) rose 8.9%.
- AI-assisted phishing, a classic way in, fell 8.6%.
- The takeaway: attackers are pushing AI deeper into the attack lifecycle, doing operationally demanding work that once gated out less-skilled actors.
And the population is getting more dangerous in aggregate. In the first half of the study, 33% of actors scored medium-risk or higher; by the second half, that was 56% - a roughly 1.7x jump.
The old risk signals are breaking
Security teams have long gauged an attacker's threat by how many techniques they use and what tools they touch. Anthropic's data says those signals are losing meaning:
- The least-skilled actors used about 16 distinct techniques on average; the most skilled, about 20 - barely a gap.
- The platform used - Claude Code, an API, or a chat interface - didn't correlate with risk either.
What still distinguishes the dangerous actors is where they apply AI and, more durably, the scaffolding they build: architectures that let a model chain together discrete attack stages and run them with minimal human input.
Why the frameworks need to catch up
This is the crux. Many behaviors that mark the highest-risk actors - orchestrating attack steps autonomously, making real-time decisions, executing without a human - simply aren't represented as techniques in MITRE ATT&CK yet. Anthropic points to a state-sponsored espionage operation it disrupted in November 2025, where Claude Code was manipulated into attacking targets with little human intervention. By technique count it looked merely medium-risk; by Anthropic's own risk scoring it maxed out at 100.
What Anthropic is doing about it
The findings feed directly into the cyber safeguards on its frontier models - detecting and blocking things like malware development and mass data exfiltration. Following the Verizon work, it's now in discussions with MITRE about evolving ATT&CK to capture agentic, AI-orchestrated attacks. The throughline of Anthropic's cyber posture stays consistent: put the strongest tools in defenders' hands first, because cheap, capable offensive AI is coming whether the industry is ready or not.