AI-Powered Cyber Attacks Are Getting More Dangerous: Here's What Anthropic Found

The worst part? The attackers using AI are getting better at it. Initially, most of these actors used AI for basic malware generation—writing code that would have taken them hours. But by the second half of 2025, they'd shifted tactics entirely.

Early in the study period, threat actors used AI primarily for gaining initial access: phishing emails, password spraying, reconnaissance. Low-sophistication stuff. Fast-forward six months, and they're using Claude and other models for the hard part of the attack: lateral movement, credential theft, privilege escalation, command execution.

This is significant because these post-compromise techniques used to be a signal of elite attacker skill. They required deep networking knowledge, system architecture understanding, and the ability to adapt in real-time to what you find inside a network. AI is democratizing that.

Anthropic discovered something uncomfortable: the MITRE ATT&CK framework—the gold standard for describing cyber threat tactics and techniques—doesn't have categories for the most dangerous AI-enabled attacks.

Case in point: the state-sponsored cyber espionage campaign Anthropic shut down in November 2025. The attacker used an AI agent to autonomously execute a global infiltration campaign with minimal human oversight. It received a maximum risk score of 100 from Anthropic's internal ARiES risk model. But mapped to MITRE ATT&CK, it only used 30 techniques across 13 tactics—which sounds like a moderately sophisticated attack. The scoring broke because MITRE doesn't have a category for autonomous attack orchestration.

Traditional indicators don't work anymore. The old playbook: count the number of techniques an attacker uses, assess their tooling, determine technical skill. That used to correlate with danger. Not anymore.

The skill floor for advanced attacks has collapsed. The least-skilled attackers in Anthropic's dataset used about 16 distinct techniques. The most skilled used about 20. That spread used to be the whole story. Now it's noise.

The real differentiation is how attackers build around the AI. High-risk actors design systems where Claude (or whatever model) orchestrates multiple attack stages. The model makes autonomous decisions about which techniques to deploy, adapts to what it finds inside a target network, and executes with no human in the loop.

Even the platform doesn't matter. Using Claude via API, Claude Code, or chat doesn't correlate with risk. What matters is how you architect the attack workflow.

Anthropic has already deployed cyber safeguards on its most capable models based on these findings. They've added classifiers to detect the highest-risk activity patterns—malware generation, credential theft, mass data exfiltration—and they're working with MITRE to update the ATT&CK framework to include autonomous agentic techniques.

But here's the catch: defenders move slower than attackers. Enterprise security teams are still trying to detect attacks using frameworks designed for human attackers. By the time MITRE adds new categories and your SOC learns them, attackers will have evolved again.

If you're responsible for security at a mid-to-large organization, this means two things.

First: lateral movement and post-compromise detection just became your top priority. You can assume initial access will happen. The battle is in what attackers can do after they're in. Invest in network segmentation, credential hygiene, and behavioral analytics that catch anomalous lateral movement. If an attacker can't move freely inside your network, orchestrated autonomous attacks fail.

Second: understand your model risk. If your organization uses LLMs in security tools, admin workflows, or infrastructure automation, you now have a two-way problem: attackers can abuse Claude to attack you, and they can abuse your own Claude integrations if they break in. Audit what your team is building with Claude. Assume attackers will eventually find it and ask: how would they chain this together into something dangerous?

Anthropic Frontier Red Team — LLM ATT&CK Navigator and full analysis — https://red.anthropic.com/2026/attack-navigator/

Anthropic News — What we learned mapping a year's worth of AI-enabled cyber threats — https://www.anthropic.com/news/AI-enabled-cyber-threats-mitre-attack

Verizon 2026 Data Breach Investigations Report (DBIR) — Includes findings from Anthropic partnership — https://verizon.com/business/resources/reports/dbir/

MITRE ATT&CK Framework — Enterprise security tactics and techniques database — https://attack.mitre.org/