Anthropic Measures the Advance of AI-Powered Cyberattacks

Anthropic analyzed 832 accounts blocked for malicious cyber activity between March 2025 and March 2026. The findings show that AI is not only helping attackers get into systems: more of them are using it to move through those systems and make decisions with less human involvement.

The analysis, conducted using the MITRE ATT&CK framework, examines a portion of the accounts blocked by Anthropic. It includes only cases with enough information to reconstruct the techniques used.

AI now helps with more than initial access

The most common activity was attack preparation. 560 of the 832 accounts, or 67.3%, used AI to write malware. Other uses included researching targets, preparing campaigns, and automating technical tasks.

The more complex actions were less common, but they carry greater operational significance. 54 actors, or 6.5%, used AI for lateral movement, a technique that allows attackers to move through a compromised network and reach other systems.

The proportion of actors considered medium risk or higher also increased during the period studied:

• In the first six months, they accounted for 33%.
• In the following six months, they reached 56%.

That represents an increase of approximately 1.7 times. Anthropic interprets the change as a sign that AI is helping actors with less technical knowledge increase their capabilities.

Attackers are moving deeper into networks

The focus of AI use shifted throughout the year. At first, it was concentrated more on gaining initial access, for example through phishing. Later, it appeared more often in tasks carried out after the intrusion.

The use of AI to discover valid accounts within a compromised environment increased by 8.9%, while AI-assisted phishing fell by 8.6%. The difference matters because it shows that attackers are not only trying to get in: they are also automating what happens next.

These tasks include identifying accounts, escalating privileges, and moving through the network. They once typically required experience, supervision, and real-time decisions. Now a model can handle part of that work for less sophisticated actors.

Counting techniques is no longer enough

Security teams often estimate risk by looking at how many techniques an attacker uses or which tools they employ. Anthropic's study indicates that these signals become less useful when AI can perform technical tasks on behalf of someone with little experience.

The least qualified actors in the dataset used around 16 different techniques on average, compared with around 20 among the most qualified. The platform also did not make it possible to clearly distinguish risk levels: there was no clear correlation between using Claude Code, an API, or a chat interface and the attacker's level of danger.

A more useful signal is to observe where the attacker applies AI and how much work they chain together automatically. Higher-risk groups tend to build systems that allow the model to:

• Chain together multiple phases of an attack.
• Decide in real time what to do next.
• Execute actions with minimal human intervention.

This type of automation is known as agentic orchestration. The term describes a system capable of acting, evaluating the result, and continuing on its own, rather than simply responding to an isolated instruction.

A case MITRE still does not describe well

Anthropic cites a cyberespionage operation attributed to a state-backed actor and disrupted in November 2025. In the operation, the attacker manipulated Claude Code to try to infiltrate targets in different countries with little human intervention.

The attack used 30 techniques spread across 13 MITRE ATT&CK tactics, a figure similar to that of several medium-risk actors. However, Anthropic's assessment methodology assigned it the maximum score of 100, because the model executed commands, exploited vulnerabilities, stole credentials, and made tactical decisions during the process.

MITRE ATT&CK still does not have a specific technique for describing this autonomous orchestration. That is one of the main limitations today: an attacker may appear moderate if only individual techniques are counted, even when AI coordinates them from beginning to end.

What changes for defense

For you, the practical consequence is that an alert should no longer assess only who is attacking, which tool they use, or how many techniques they know. It should also analyze how much of the attack they can chain together and execute automatically.

Anthropic says its findings have already influenced protections for its models. The company has deployed controls to detect and block activities such as malware development and mass data extraction, and it is in discussions with MITRE about expanding the ATT&CK framework.

The next challenge will be to better measure AI agents operating inside an intrusion. If these systems continue to gain autonomy, the gap between an expert attacker and one with access to good tools will keep shrinking, and defenders will have to detect not only the actions, but also the chain of decisions connecting them.