TL;DR
A Thorsten Meyer AI report, based on Anthropic findings, says 832 banned accounts tied to malicious cyber activity showed a sharp rise in medium-or-higher-risk AI-enabled actors from March 2025 to March 2026. The analysis says technique counts and tooling are becoming weaker risk signals, while agentic orchestration remains harder for standard frameworks to classify.
A year of AI-enabled malicious cyber activity reviewed by Anthropic and analyzed by Thorsten Meyer AI found that 832 banned accounts mapped to MITRE ATT&CK showed a rapid rise in higher-risk activity, raising questions about whether standard security frameworks still capture the traits that make AI-assisted attackers dangerous.
The analysis says the accounts were banned for malicious cyber activity between March 2025 and March 2026 and were mapped to MITRE ATT&CK, a widely used taxonomy for describing cyberattack tactics and techniques. The cases were described as a detailed window into activity with enough information for review, not a full count of all AI-enabled cyber misuse.
According to the source material, 67.3% of the accounts, or 560 cases, used AI to help write malware. A smaller share, 6.5%, or 54 cases, used AI for lateral movement inside networks. The share of actors rated medium-risk or higher rose from 33% in the first half of the period to 56% in the second half, an increase of about 1.7 times.
The report’s central finding is that counting the number of techniques an actor uses is becoming less useful as a measure of danger. The analysis says the least-skilled and most-skilled actors in the dataset were separated by only a narrow technique-count gap, 16 versus 20, because AI systems could supply techniques that once required more operator knowledge.
The frameworks can’t see the thing that matters
For decades, danger meant which techniques an attacker commands. A year of real AI-enabled attacks — 832 banned accounts mapped onto MITRE ATT&CK — shows that signal breaking, just as a new, harder-to-see one takes over.
A year of real misuse, mapped to the standard taxonomy
A window, not a census — these are the cases with enough detail to assess techniques thoroughly. Inside it, the risk level climbed fast.
WHAT WAS STUDIED
THE RISK CLIMB · MEDIUM-OR-HIGHER ACTORS
AI malware detection tools
As an affiliate, we earn on qualifying purchases.
As an affiliate, we earn on qualifying purchases.
Artificial Intelligence for Cybersecurity: How AI Detects Cyber Threats, Prevents Hacking, and Protects Your Data, Identity, and Smart Devices (AI Cybersecurity Mastery Series)
As an affiliate, we earn on qualifying purchases.
As an affiliate, we earn on qualifying purchases.
“More techniques” stopped meaning “more dangerous”
The old heuristic: count the techniques, judge the tooling. AI dissolved it — because the model supplies the techniques either way. Watch the old signal fail, then watch what it misses.
Risk score vs. technique count
Two ways to read the same attacker. One is going blind. Press play.
cyber threat intelligence software
As an affiliate, we earn on qualifying purchases.
As an affiliate, we earn on qualifying purchases.
Practical Malware Analysis: The Hands-On Guide to Dissecting Malicious Software
As an affiliate, we earn on qualifying purchases.
As an affiliate, we earn on qualifying purchases.
Deeper into the attack — and into less-skilled hands
Across the year, AI use drifted from getting in toward acting once already inside — the operationally demanding stages that used to require an expert.
The attack lifecycle · where AI is now applied
The center of gravity moved right — toward post-compromise work.
network security monitoring devices
As an affiliate, we earn on qualifying purchases.
As an affiliate, we earn on qualifying purchases.
Network Intrusion Detection
As an affiliate, we earn on qualifying purchases.
As an affiliate, we earn on qualifying purchases.
From “what they know” to “what they’ve built”
The report sorts the signals into three tiers — one dead, one fading, one durable.
Technique count & tooling
16 vs. 20 between novice and expert; platform doesn’t correlate. The model supplies the techniques either way.
Where in the lifecycle AI is applied
Concentrating on operationally demanding, post-compromise stages is a better signal — but it’s eroding as the whole population heads there.
The scaffolding around the model
Architectures that let the model chain stages and run with minimal human input. Not what they know — whether they’ve built a system that lets AI run the attack.
AI-powered intrusion detection system
As an affiliate, we earn on qualifying purchases.
As an affiliate, we earn on qualifying purchases.
Operationalizing Threat Intelligence: A guide to developing and operationalizing cyber threat intelligence programs
As an affiliate, we earn on qualifying purchases.
As an affiliate, we earn on qualifying purchases.
Fixing the map before the territory moves again
A taxonomy that can’t name the most dangerous behavior on the field will quietly mislead the people relying on it. The response runs in two directions.
Fed back into the models
The findings informed safeguards on the most capable models, built to detect & block some of what was observed:
- Blocking malware development
- Blocking mass data exfiltration
- Putting tools in defenders’ hands first (Project Glasswing)
Taking it to the source
Following the Verizon work, Anthropic says it’s in discussions with MITRE about how ATT&CK might evolve:
- A vocabulary for agentic orchestration
- Naming the scaffolding that makes a model an operator
- An interactive technique visualization on the Red blog
Reading it in proportion
- The 832 cases are a detailed subset, not the full population — the precise percentages are directional, not definitive.
- “More autonomous” is not “fully autonomous” — even the standout case needed human input at key moments, which is itself a place for defenders to intervene.
- This is one vendor’s window — the company with visibility into misuse of its own model, publishing what it found. The right thing to do with the data, and worth remembering as you read it.
Why It Matters
The findings matter because security teams, vendors and incident responders often rely on taxonomies and technique counts to sort routine cases from serious threats. If AI lets weaker actors use a broader menu of methods, those measures may understate risk or fail to flag the systems that make attacks more capable.
The source material says the more durable warning sign is not what an actor knows, but what the actor has built around the model. In that framing, the most dangerous cases involve scaffolding that allows AI to chain tasks, act across multiple stages and run with limited human input.
Background
MITRE ATT&CK is commonly used to map attacker behavior across stages such as initial access, discovery, lateral movement and privilege escalation. The Thorsten Meyer AI analysis says AI use in the reviewed cases moved deeper into the attack lifecycle over the year, away from mainly access-related activity and toward post-compromise operations.
The report cites AI-assisted phishing at 8.6% and account discovery at 8.9%, using those figures to show a shift toward activity after initial access. It also highlights a November 2025 espionage operation that used 30 techniques across 13 tactics, but received the maximum risk score because the model operated as an autonomous agent.
What Remains Unclear
The dataset is not described as a census of all AI-enabled cybercrime. It is limited to cases with enough detail for technique mapping, so the scale of broader misuse remains unclear. It is also unclear how quickly MITRE ATT&CK or other frameworks will change, and whether new labels can keep pace with attacker behavior.
What’s Next
The source material says Anthropic has used the findings to inform safeguards aimed at blocking malware development and mass data exfiltration, and to place defensive tools in security teams’ hands through Project Glasswing. It also says Anthropic is in talks with MITRE about how ATT&CK might evolve to describe agentic orchestration and the systems built around AI models.
Key Questions
What was the main finding?
The analysis says traditional measures such as technique count are becoming weaker indicators of attacker danger when AI can supply methods across the attack lifecycle.
How many cases were reviewed?
The source material says 832 banned accounts linked to malicious cyber activity were reviewed for the March 2025 to March 2026 period.
What does agentic orchestration mean here?
In this report, it refers to systems that let an AI model chain attack steps and operate with limited human direction, rather than only answering one-off prompts.
Does this mean MITRE ATT&CK is obsolete?
The report does not say the framework has no value. It says the framework may miss or understate a risk factor tied to how AI systems are being used to run attacks.
What remains unknown?
The wider scale of AI-enabled cyber misuse, the full effect of model safeguards and the timeline for any framework updates remain unclear.
Source: Thorsten Meyer AI
