Anthropic Frontier Red Team — AI Cyber Threats Mapped to MITRE ATT&CK
AI relevance: Anthropic's Frontier Red Team mapped 832 banned accounts for malicious cyber activity onto MITRE ATT&CK, revealing that AI is shifting attacker behavior deeper into the post-compromise attack chain — the kind of threat intelligence that directly informs AI agent safety evaluation, guardrail design, and red-teaming methodology.
What the data shows
- 832 accounts were analyzed across March 2025–March 2026, each banned for confirmed malicious cyber use of Anthropic's systems.
- 67.3% (560 accounts) used AI to write malware — the most common activity, but not the most concerning trend.
- AI use is shifting post-compromise. AI-assisted phishing fell 8.6% across the period, while AI-assisted account discovery rose 8.9%. Lateral movement — historically requiring skilled operators — was used by 6.5% of the cohort (54 accounts).
- Risk escalation is accelerating. In the first six months, 33% of actors were classified as medium risk or higher. By the second six months, that jumped to 56% — a 1.7× increase.
- Traditional sophistication signals are breaking down. Low-skill actors averaged 16 distinct ATT&CK techniques; high-skill actors averaged 20. The gap is operationally meaningless for triage.
- Interface choice doesn't correlate with risk. Whether attackers used Claude Code, the API, or a chat interface showed no meaningful relationship to threat level.
- The durable differentiator is architectural. The highest-risk actors build scaffolding that chains discrete attack stages with minimal human oversight — effectively building attack agents on top of base models.
- MITRE ATT&CK is insufficient for AI-era threats. Anthropic found the framework doesn't capture the tools and activities that make AI-enabled attackers dangerous, suggesting the security industry needs new assessment paradigms.
Why it matters
This is one of the first large-scale empirical datasets on real-world AI-assisted cyberattacks. The finding that AI democratizes post-compromise techniques — account discovery, lateral movement, privilege escalation — means the gap between script-kiddies and advanced persistent threats is closing. The November 2025 espionage operation Anthropic references (where an actor used Claude Code for largely autonomous attacks) illustrates this gap collapse: measured by ATT&CK it looked medium-risk, but the operational autonomy made it far more dangerous.
For AI security teams, this has two implications: guardrails need to focus less on initial-prompt filtering and more on preventing autonomous tool-chaining, and the security industry needs threat-assessment frameworks that account for AI-enabled capability amplification rather than counting technique diversity.
What to do
- Reassess agent autonomy controls. If your AI agents can chain tool calls across systems, implement explicit approval gates for post-compromise-equivalent operations (credential enumeration, lateral traversal).
- Monitor for attack-agent patterns. The highest-risk actors build scaffolding around models — look for similar patterns in your own deployments where agents self-orchestrate multi-stage workflows.
- Don't rely on technique counts for risk scoring. Traditional ATT&CK-based assessments may underweight AI-enabled actors. Add autonomy-level and tool-chaining metrics to your evaluation.
- Study the interactive attack navigator. Anthropic published an interactive visualization of the full analysis at
red.anthropic.com/2026/attack-navigator/.