Anthropic says the way malicious actors use artificial intelligence is changing. In an analysis published June 3, the company examined 832 accounts banned for malicious cyber activity between March 2025 and March 2026, mapping the observed behavior against the MITRE ATT&CK framework.
The dataset is not a census of all cybercrime. Anthropic describes it as a subset of banned accounts for which investigators had enough information to assess the techniques involved. Even with that limitation, the company says the results show a shift from using AI mainly to prepare attacks toward using it during the more complex stages that follow an initial compromise.
AI use is moving deeper into the attack lifecycle
The most common activity in the dataset was malware development: 560 of the 832 accounts, or 67.3%, used AI for that purpose. Far fewer accounts used AI for lateral movement, the process of navigating deeper inside a compromised environment, but the figure was still significant at 54 accounts, or 6.5%.
Anthropic also found a change across the two six-month periods covered by the analysis. In the first period, 33% of actors were classified as medium risk or higher by the company’s scoring system. In the second, that share rose to 56%, a roughly 1.7-fold increase.
Several individual techniques moved in opposite directions. AI-assisted account discovery, which involves identifying valid accounts inside a compromised environment, increased by 8.9%. AI-assisted phishing fell by 8.6%. Anthropic interprets those changes as evidence that malicious users are applying models further inside the attack chain, where tasks require more context, coordination and real-time decision-making.
Technique counts no longer tell the whole story
Traditional threat assessment often relies on the number of techniques an actor uses, the tools involved or the interface through which the activity was carried out. Anthropic says those signals were weak predictors of risk in this dataset.
The least-skilled actors used about 16 distinct techniques on average, compared with about 20 for the most skilled. The platform also did not provide a reliable distinction: Anthropic found no meaningful correlation between risk level and whether an actor used Claude Code, an API or a chat interface.
The company says a more useful signal is where AI is applied in the operation. Higher-risk actors were more likely to use models for demanding activities such as account discovery, lateral movement and privilege escalation rather than limiting them to initial access or preparation.
That signal is also becoming less stable. Anthropic argues that the most important differentiator is increasingly the scaffolding built around the model: systems that chain separate stages of an attack, make tactical decisions and continue with limited human input.
Why agentic behavior challenges MITRE ATT&CK
Anthropic’s analysis identifies a gap in the MITRE ATT&CK framework. The framework can describe many individual actions, but it does not currently provide a dedicated technique identifier for the agentic orchestration that connects those actions into a largely autonomous operation.
As an example, Anthropic points to a state-sponsored cyber-espionage operation it says it disrupted in November 2025. The activity mapped to 30 techniques across 13 tactics, a pattern that appeared comparable to many medium-risk actors when measured only by technique count. Under Anthropic’s own risk-scoring method, however, the operation received the maximum score of 100 because the model executed commands, exploited vulnerabilities, stole credentials and made tactical decisions with human intervention required only at a few points.
The distinction matters for defenders. A detection system that records only isolated commands may miss the risk created by their order, speed and degree of automation. Security teams will need visibility into how AI systems select tools, pass information between stages, respond to failures and act on privileged environments.
What defenders should take from the findings
The report does not show that every AI-assisted intrusion is autonomous, nor does it measure the success rate of the attacks. It does show why defensive monitoring should extend beyond simple indicators of compromise.
Teams should review whether identity, endpoint and network telemetry can connect account discovery, privilege escalation and lateral movement into one timeline. They should also audit AI agents and automation workflows for excessive permissions, unrestricted outbound access and the ability to continue after a human approval point has been bypassed or abandoned.
Testing should focus on chained behavior rather than isolated prompts. A model that cannot complete a full operation alone may still create risk when connected to shell access, credential stores, cloud consoles or development pipelines. Human review remains especially important before actions that alter access controls, move laterally or export sensitive data.
Anthropic says the findings have informed safeguards designed to detect and block activities such as malware development and mass data exfiltration. The company is also discussing with MITRE how the ATT&CK framework could evolve to represent AI-enabled behaviors more accurately.
The central message is measured but consequential: AI is not simply making familiar cyber tasks faster. In some cases, it is helping less experienced actors coordinate more technically demanding steps. For security teams, that makes the structure and autonomy of an operation as important as the individual techniques it contains.
Source: Anthropic’s official analysis.