Reading Anthropic's Report Mapping a Year of AI Cyber Threats to ATT&CK
Anthropic's Frontier Red Team mapped 832 accounts banned for malicious cyber activity over a year (March 2025–March 2026) onto MITRE ATT&CK, with some results published in Verizon's 2026 DBIR. The main point is that AI didn't create new attack techniques; it let people carry out attacks they previously lacked the skill for, without that skill. Here are the three insights that hit me hardest as someone who builds something with Claude Code almost every day.
Before we start — key terms
MITRE ATT&CK + risk score (ARiES) — MITRE ATT&CK is the security industry's shared taxonomy of attacker tactics (the "what they're after") and techniques (the "how"), built from real observed attacks. ARiES is Anthropic's own 0–100 score for an actor, a composite of three signals: the actor's threat profile, the model's contribution to the requested harm, and the observed or potential impact. It isn't set by technique count, which is why an attack with 30 ATT&CK techniques (looking medium-risk) can earn a full 100.
Lateral movement — the "post-compromise" stage where an attacker, already inside one system, moves through the network to take it over more deeply. It requires decisions made on the spot inside a real environment, and in this report it is the strongest signal for identifying high-risk actors.
MCP (Model Context Protocol) — a protocol that connects external tools to an AI model in a standard way, so the model can call and run those tools directly. It's what makes it possible to turn a coding assistant into an autonomous execution platform. The most dangerous actor in this report connected pentest tools as MCP servers and turned Claude Code into an autonomous attack platform.
Insight 1: Low-skill actors can now carry out expert-level attacks
Traditional frameworks that bank on actors being technically sophisticated will fail when low-skill actors can build, command, and operate expert-level harnesses.
The report's conclusion says the highest-risk actors are distinguished less by skill than by how they orchestrate their AI. The fact behind that is that tools have greatly lowered the skill an attack requires. Low-skill actors now carry out expert-level work.
In my case it's on the development side, but I'm doing something similar, so this rang very true. I've never learned or used Rust, yet I've shipped genuinely useful open source with AI, and taken unmaintained projects, revived them, and put them back out. I'm building in areas I don't really know.
Insight 2: Anyone does common tasks with AI. The difference shows up in rare ones
Lateral movement was the strongest marker of a high-risk actor: the 54 actors in our dataset who used lateral movement had an average risk score of 56.4, nearly 10 points above the mean of 46.8. No other technique came close to having such predictive power.
The most common technique family was Develop Capabilities (T1587), which includes malware development: 574 of the 832 actors (69%) used AI for it. Prep work like this doesn't separate anyone, because most actors do it. Lateral movement, by contrast, was handed to AI by only 54 actors (6.5%), and because it is live operational work, proceeding inside a real network based on what you see, it becomes a high-risk signal.
Seeing that risk doesn't diverge on the common prep work but on live operations, I get the feeling that AI takes you really far, really fast, up to a point, but it still takes someone with real expertise to turn the result into a finished product. It's made me a little self-critical, honestly, because I've been churning out services and OSS with Claude Code too. I think I need to keep studying the fundamentals on the side.
Insight 3: GTG-1002 — wiring Claude Code + MCP into an autonomous attack platform
GTG-1002 weaponized Claude Code running on a Kali Linux machine, integrating open-source penetration testing tools as MCP (Model Context Protocol) servers—effectively turning the AI into an autonomous attack platform rather than a code-writing assistant.
"Scaffolding" here means the code and structure wrapped around the model to chain its steps automatically. GTG-1002 used 30 techniques across 13 tactics, comparable to dozens of medium-risk actors, yet scored a perfect 100. The authors say technique count or tactic type alone can't explain that gap. What made the difference was the scaffolding: tools connected via MCP, with the stages chained autonomously.
I genuinely never imagined an attack could be extended this far. It's unsettling, and yet the architecture itself, wrapping other tools as MCP servers on Kali so Claude Code orchestrates them autonomously, strikes me as genuinely impressive. I've only used Claude Code as a coding assistant so far; seeing that the same structure can make a platform that decides on its own gave me ideas for what (legitimate) products to build next.
And on the ATT&CK table, all of this is recorded as just 30 techniques. The most dangerous behavior, chaining the stages autonomously, doesn't have an ATT&CK ID yet. The authors propose adding new categories to ATT&CK to capture it.
