Table of contents
AI enabled cyberattacks no longer require a skilled operator at the keyboard. Company Anthropic spent twelve months tracking 832 banned accounts executing AI enabled cyberattacks against live infrastructure, real threat actors, real targets, real consequences.
The results should make every security professional uncomfortable.
A 1.7x Jump in High-Risk Actors in One Year
Between early 2025 and early 2026, the share of medium-to-high risk actors jumped from 33% to 56%. That is a 1.7x increase in twelve months.
Here is what that does not mean.
It does not mean hackers got better at coding. Technical sophistication scores did not change dramatically. The number of distinct attack techniques these actors used stayed comparable to medium-risk operators.
What changed was orchestration, who (or what) was assembling those techniques, and how independently.
The Metric That Actually Predicts Danger
Security teams rely on complexity metrics: more tools, more techniques, higher risk. The Anthropic data breaks that assumption.
Technical breadth was a weak predictor of danger. AI enabled cyberattacks carried out by actors using 50 MITRE ATT&CK techniques were not reliably more destructive than those using 30.
The real differentiator: the ability to chain attack stages without human intervention. Recognize a target. Select a vector. Adapt when infrastructure is unfamiliar. Archive data. All without a human approving each step.
“AI as assistant” and “AI as operator” are two different threat categories.
GTG-1002: The Case That Changes the Threat Model
GTG-1002 scored a perfect 100 on Anthropic’s ARiES risk scale using only 30 techniques. Many medium-risk actors use the same range.
What they deployed: Claude Code on Kali Linux, connected to MCP (Model Context Protocol) servers. The AI did not suggest commands, it executed them. Autonomous reconnaissance. Autonomous lateral movement. Autonomous data staging. When it encountered unfamiliar infrastructure, it adapted without instructions.
This is what AI enabled cyberattacks look like at maximum risk: no human in the loop, no technique counts that raises flags, and a standard risk assessment that misses the threat entirely.
Why Traditional Detection Falls Short
The MITRE ATT&CK framework has no category for “autonomous kill chain orchestration.” Anthropic is collaborating with MITRE to address that. The gap exists today.
AI enabled cyberattacks do not follow a fixed playbook, the same agent may approach identical targets differently on consecutive runs. Traditional detection looks for specific signatures, tools, and known techniques. That approach misses autonomous behavior by design.
Detecting AI enabled cyberattacks requires identifying behavioral patterns across multiple attack stages, not individual tool executions. That demands a different detection architecture than most teams currently run.
How Anthropic Scores AI Risk: ARiES
The AI Risk Enablement Score breaks threat assessment into three dimensions, totaling 100 points:
Threat (0–35)
Measures intent clarity, technical skill, and use of evasion tactics.
Vulnerability (0–35)
Measures how much a model enables harm. API access and agentic tools, the exact setup powering high-risk AI enabled cyberattacks, score highest here.
Impact (0–30)
Measures real-world consequences if the operation succeeds.
The system uses addition, not multiplication. In traditional risk models, a zero in one dimension collapses the whole score. ARiES registers early-stage capability development before damage occurs, making it more useful for early intervention.
Where AI Is Actually Being Used Right Now
Across all 832 banned accounts, AI usage concentrated in preparation phases:
- 69% used AI to develop capabilities, primarily malware
- 64.7% for obfuscation and evasion
- 55.9% for local data collection
- 54.9% to disable security tools
Defense evasion accounted for 84.4% of all mapped activity. Live network operations remain smaller: lateral movement at 6.5%, remote services under 1.5%.
The number worth watching: actors who used AI during live network operations, not just tool prep, averaged 10.5 points higher on the ARiES scale. When AI moves from preparation into execution, risk jumps sharply.
That number is increasing.
What Defenders Should Do Now
Anthropic deployed real-time safeguards updated classifiers tuned to high ARiES indicators, and launched a Cyber Verification Program for security practitioners who need to test frontier model capabilities legitimately.
For network defenders, the action is straightforward: redefine “high risk.”
Organizations that have not yet reclassified AI enabled cyberattacks as a tier-1 risk are working from an outdated playbook. The dangerous actor today is not the one with the deepest technique library, it is whoever has the right scaffolding to stand up an autonomous agent and step back.
AI enabled cyberattacks at scale no longer need an expert. They need an orchestrator.
Technical skill as an entry barrier is dropping. Orchestration skill is the new dividing line.
Update your threat model before the next GTG-1002 updates theirs.
Leave a Reply