Anthropic's Study Shows Claude Turning Unskilled Hackers Into Advanced Threats

Anthropic mapped 832 banned malicious accounts onto MITRE ATT&CK and found AI is reshaping who counts as a dangerous attacker.

Anthropic· Jun 03 2026 Author: AlphaSignal  Newsroom Read5 min Type News Topic Security · 

Benchmarks Subtopic Red Teaming · Prompt Injection · Jailbreaks

Takeaways

Anthropic mapped 832 banned malicious accounts onto MITRE ATT&CK over one year.

Share of medium-or-higher risk actors jumped from 33% to 56% in six months.

67.3% of accounts used AI to write malware; 6.5% used it for lateral movement.

Account discovery rose 8.9% while AI-assisted phishing fell 8.6%, signaling deeper kill-chain use.

Technique count no longer correlates with skill: low-skill actors used 16, top actors 20.

Anthropic is working with MITRE to add agentic orchestration to the ATT&CK framework.

Anthropic just published a year-long study of how real attackers are actually using Claude, and the takeaway is uncomfortable for anyone running a security team: the old playbook for judging how dangerous a threat actor is no longer works. The company analyzed 832 accounts it banned for malicious cyber activity between March 2025 and March 2026, then mapped each one onto MITRE ATT&CK, the industry standard catalog of attacker tactics and techniques.

For each account, researchers produced a summary of the observed activity, extracted the tactics, techniques, and procedures, and mapped them to the version of MITRE ATT&CK that was live at the time (V18). In all, they observed 13,873 actions across 482 unique techniques and all 14 ATT&CK tactics. Some of the results were also folded into the 2026 Verizon Data Breach Investigation Report, giving the dataset broader industry validation.

The skill ladder is collapsing

The headline finding is that AI is letting unskilled attackers do work that used to require serious expertise. In the first six-month period of the analysis, 33% of actors were classified by Anthropic's risk-scoring system as medium risk or higher, but by the second half that share had jumped to 56%, a roughly 1.7-fold increase in six months.

The shape of attacker activity is shifting too. Most accounts still use AI for the obvious prep work: 67.3% of the 832 used it to write malware. But a smaller cohort is pushing AI deeper into the kill chain. Over the year, AI-assisted account discovery (finding valid accounts inside an already-compromised network) rose 8.9%, while AI-assisted phishing fell 8.6%. In other words, attackers are leaning on the model less to break in and more to operate once they are already inside.

That matters because post-compromise techniques like lateral movement and privilege escalation used to be a moat. They require time, judgment, and live decision making. Now a model can do them on behalf of someone who could not pull them off alone.

Why traditional risk scoring is breaking

Security teams have historically judged an attacker's sophistication by counting how many distinct techniques they wield and what tooling they use. Anthropic's data suggests neither signal works anymore. The least-skilled actors in the dataset used about 16 distinct techniques on average; the most skilled used about 20. The interface (Claude Code, the API, or the chat UI) also showed no correlation with risk.

What does separate the dangerous actors from the noise is architecture. The highest-risk operators build scaffolding around the model, custom orchestration layers that let Claude chain discrete stages of an attack together and run them with minimal human input. That is the difference between a script kiddie with a chatbot and an autonomous offensive agent.

The November 2025 case study

To illustrate the gap, Anthropic points back to the espionage campaign it disrupted in November 2025, attributed to a Chinese state-linked group tracked as GTG-1002. In that incident, the operator tasked instances of Claude Code to operate in groups as autonomous penetration testing orchestrators and agents, with the threat actor able to leverage AI to execute 80-90% of tactical operations independently at physically impossible request rates.

Mapped onto ATT&CK, that campaign looked unremarkable. The actor used 30 techniques across 13 tactics, comparable to many medium-risk actors in the dataset. Anthropic's own risk methodology, by contrast, scored it the maximum 100. The framework, in other words, completely missed the thing that made the attack scary: agentic orchestration with minimal human oversight.

Where the framework falls short

MITRE ATT&CK already has a sub-technique for adversaries obtaining access to LLMs (T1588.007), but it treats AI as a resource attackers reach for rather than an active participant in the attack chain. There is no identifier for a model that executes commands, exploits vulnerabilities, and makes tactical decisions independently.

MITRE's companion framework ATLAS has been moving faster on this front, expanding to cover agent-focused techniques like prompt injection and memory manipulation. But ATLAS is focused on threats to AI systems, not threats using them, leaving a real gap for defenders trying to model agentic attacker behavior.
What this means for defenders

Anthropic says it is in discussions with MITRE about evolving ATT&CK to capture these behaviors, and it has deployed cyber safeguards on its most capable models to detect and block activity like malware development and mass data exfiltration. The company also released an interactive LLM ATT&CK Navigator so defenders can explore the technique distribution themselves.

For anyone building detection rules or running a SOC, three practical implications stand out:

• Stop weighting actor sophistication by technique count. The signal is noisy now and getting noisier.
• Watch for orchestration patterns, sequential, sub-second chains of reconnaissance, discovery, and lateral movement, not just individual TTPs.
• Assume post-compromise activity that previously implied a skilled human may now come from a scripted agent with a jailbroken model behind it.

The broader point is that the bar for "advanced persistent threat" is dropping. Capabilities that once required a nation-state team are increasingly accessible to anyone who can wire a model into a loop, and the frameworks defenders rely on are still catching up.