What Anthropic learned mapping a year’s worth of AI-enabled cyber threats
We examine 832 accounts that were banned for malicious cyber activity between March 2025 and March 2026 and map them onto MITRE ATT&CK, a longstanding database of the tactics and techniques used by cyberattackers.
Three main conclusions:
Malicious actors are using AI in ways that make them more dangerous. Cyberattacks are becoming more autonomous. The MITRE ATT&CK framework does not fully capture the tools and activities that make AI-enabled attackers so dangerous.
How AI makes attackers more dangerous
67% used AI to prepare a cyberattack (eg writing malware) 6.5% used AI to assist with lateral movement, n(avigating deep inside a compromised network) In the first six-months, 33% of actors were classified as medium risk or higher. By the second six-months, that share had jumped to 56% Use of AI shifted from techniques to gain initial access towards activity carried out once they were inside the system. Use of AI for account discovery rose 8.9%, while AI-assisted phishing fell 8.6%. AI can now be made to perform these activities on behalf of less sophisticated actors.