AI Didn't Hand Attackers a New Weapon: It Moved Where the Danger Lives
Anthropic's Frontier Red Team mapped 832 accounts banned for malicious cyber activity (March 2025–March 2026) onto MITRE ATT&CK, with some results published in Verizon's 2026 DBIR. The core message is singular: AI didn't invent new attack techniques — it moved where the danger lives, from initial access to post-compromise. Here are five insights, read through the eyes of a developer with a security-basics background who uses Claude Code every day.
Before we start — key terms
MITRE ATT&CK — the security industry's shared taxonomy of attacker tactics (the "what they're after") and techniques (the "how"), built from real observed attacks. Defenders map an intrusion onto it to describe, in a common language, how far an attacker got. This piece's point: there's no cell in that table yet for "AI autonomously chaining the stages."
Kill chain (attack life cycle) — the sequence of stages an attack moves through, roughly split into initial access (getting in) and post-compromise (taking over, moving, exfiltrating once inside). "AI moved deeper into the kill chain" means its use shifted from the first toward the second.
Risk scoring — Anthropic's own 0–100 methodology for rating an actor. It weighs not how many techniques were used but where in the life cycle, and how autonomously, AI was applied. That's why an attack with 30 ATT&CK techniques (looking medium-risk) can score a full 100.
Insight 1: AI moved deeper into the kill chain
These sorts of "post-compromise" techniques used to be restricted to actors with the technical knowledge to carry them out. Our investigation shows that AI can now be made to perform these activities on behalf of less sophisticated actors.
The numbers point the same way: AI-assisted phishing (an initial-access move) fell 8.6%, while account discovery — finding valid accounts inside a compromised environment — rose 8.9%. The labor-intensive, deeper stages are getting automated.
Raising the floor of skill isn't a security story — it's what's happening to every profession. Attackers just got there first.
Insight 2: The heuristics for gauging risk broke
there's little correlation between the skill of a threat actor and how many techniques they use: the least-skilled actors in our dataset used about 16 distinct techniques on average, whereas the most skilled used about 20. Likewise, the specific platform used—Claude Code, an API, or a chat interface—also did not correlate with an actor's risk level.
"More techniques, more tools, therefore more skilled" is a profiling instinct you pick up in any intro security course. This is that instinct collapsing.
When the cheap signals die, the tiring judgment lands back on defenders. As someone who learned the defender's side, that's the part that worries me most.
Insight 3: The real differentiator is the scaffolding around the model, not the model
The more durable differentiator is the type of scaffolding attackers build around the model: higher-risk actors design architectures that allow models to chain together discrete stages of a cyberattack and carry them out with minimal human input.
"Scaffolding" here means the code and structure wrapped around a model to chain its steps automatically — not an unfamiliar word if you wire up agents every day.
If the scaffolding is the differentiator, value flows to whoever designs it, not whoever prompts it. As a junior, that tells me exactly where to invest my hours.
Insight 4: MITRE ATT&CK has no slot for agentic orchestration
That ATT&CK table from the terms section — the most dangerous behavior has no cell to sit in.
Mapping it against the MITRE ATT&CK framework shows that the actor used 30 techniques across 13 tactics, which was comparable to many medium-risk actors in our dataset. Clearly, focusing on the number of techniques this actor used underplays how dangerous they really were (by contrast, applying our risk-scoring methodology to this attack earns it the maximum risk score of 100).
The case is the state-sponsored espionage operation Anthropic disrupted in November 2025: the model ran as an autonomous agent — executing commands, exploiting vulnerabilities, stealing credentials, making tactical calls — yet there is no ATT&CK ID for that kind of agentic orchestration.
The lag between a new reality and the standard that names it is itself the risk. Thirty techniques, a max score of 100 — that's the gap, sitting in plain sight.
Insight 5: A "defender-first" posture
we've developed and deployed cyber safeguards on our most capable models to detect and block some of the activities uncovered here, like developing malware or mass data exfiltration. Following on from our work with Verizon, we're also in discussions with MITRE about how the ATT&CK framework might evolve to include the AI-enabled behaviors we observed.
The safeguards and the MITRE work point the right way. But an announcement isn't a result — show me block rates and false positives before I call it done.
AI changed the where of attacks, not the what. Our maps and our instincts just haven't caught up to where the danger moved.
