When the Skill Floor Disappears: A Year of AI-Enabled Cyber Threats on ATT&CK
Anthropic's Frontier Red Team mapped 832 accounts banned for malicious cyber activity over a year (March 2025–March 2026) onto MITRE ATT&CK, with some results published in Verizon's 2026 DBIR. The core message is singular: AI didn't invent new attack techniques — it let people do what they couldn't before without the skill, reshaping where the danger lives. Here are the three insights that hit me hardest as someone who builds something with Claude Code almost every day.
Before we start — key terms
MITRE ATT&CK + risk score (ARiES) — MITRE ATT&CK is the security industry's shared taxonomy of attacker tactics (the "what they're after") and techniques (the "how"), built from real observed attacks. ARiES is Anthropic's own 0–100 score for an actor, weighing not how many techniques were used but where in the attack life cycle, and how autonomously, AI was applied. That's why an attack with 30 ATT&CK techniques (looking medium-risk) can earn a full 100. The whole tension of this piece lives here — the table sees a 30, the real risk is a 100.
Lateral movement — the "post-compromise" stage where an attacker, already inside one system, moves through the network to take it over more deeply. It isn't prep work you stage in advance; it's hands-on work that demands real-time decisions inside a live environment — which is why it turns out to be the single strongest signal separating high-risk actors here.
MCP (Model Context Protocol) — a protocol that connects external tools to an AI model in a standard way, so the model can call and run those tools directly. It's the link that turns a coding assistant into an autonomous execution platform. The most dangerous actor in this report wired pentest tools together as MCP servers to make Claude Code exactly that.
Insight 1: The danger isn't a smarter attacker — the tool removed the skill floor
Traditional frameworks that bank on actors being technically sophisticated will fail when low-skill actors can build, command, and operate expert-level harnesses.
The report's conclusion says the dividing line is "orchestration," but the deeper fact underneath is that the tool erased the skill barrier itself. Low-skill actors now operate expert-level work.
Honestly, it just rings true — because I'm one of the people doing it. I've never learned or used Rust, yet I've shipped genuinely useful open source with AI, and I've taken dead, unmaintained projects, revived them, and put them back out.
Insight 2: Everyone builds with AI now — expertise is still what finishes it
Lateral movement was the strongest marker of a high-risk actor: the 54 actors in our dataset who used lateral movement had an average risk score of 56.4, nearly 10 points above the mean of 46.8. No other technique came close to having such predictive power.
The common "prep" work — building malware (69%) — is something anyone does with AI now. But the moment you hand AI the live operational work, like lateral movement (6.5%) that means feeling your way through a real network, that's the real high-risk signal. Everyone does the easy part; the rare, hard part is what separates.
AI gets you surprisingly far, surprisingly fast — but it still takes someone with real expertise to turn it into a finished product. It's made me a little self-critical, honestly: I've been churning out services and OSS with Claude Code, and I think I need to keep studying the fundamentals on the side.
Insight 3: GTG-1002 — wiring Claude Code + MCP into an autonomous attack platform
GTG-1002 weaponized Claude Code running on a Kali Linux machine, integrating open-source penetration testing tools as MCP (Model Context Protocol) servers—effectively turning the AI into an autonomous attack platform rather than a code-writing assistant.
"Scaffolding" here means the code and structure wrapped around the model to chain its steps automatically. GTG-1002 used only 30 techniques (medium-risk territory) yet scored a perfect 100. The whole difference was that scaffolding — an architecture that wired tools together via MCP and chained the stages autonomously.
I genuinely never imagined an attack could be extended this far. It's unsettling — and yet the architecture itself, wrapping other tools as MCP servers on Kali so Claude Code orchestrates them autonomously, strikes me as genuinely impressive. I've only ever used Claude Code as a coding assistant; seeing that it can be built into a platform that makes autonomous decisions actually gave me ideas for what (legitimate) products to build next.
What's striking is that all of this still registers as just 30 techniques on the ATT&CK table — there's no ID yet for the autonomous, chain-it-all-together behavior that actually makes these actors dangerous. That lag between the standard and reality is exactly where we're standing now. In an era where the tool removed the floor, I'd rather pour my hours into the expertise that finishes the work than into shipping faster — that's what I took away from this report.
