Real-world data on how attackers use AI across the whole kill chain. The share of medium-or-higher risk actors grew from 33% to 56%, which matters for anyone securing agents or services.
Key takeaways · AI-distilled
Anthropic mapped 832 banned accounts' malicious Claude use from March 2025 to March 2026 onto MITRE ATT&CK, finding all 14 tactics and 482 sub-techniques; the accounts are a subset chosen because they had enough detail to map.
The share of actors rated medium risk or higher rose from 33% to 56% between the first and second halves of the year, with growth concentrated in high-weight techniques like lateral movement, credential dumping and web shells.
Anthropic found access platform (API or Claude Code) did not predict risk; requested techniques did, and it expects AI agentAn AI system that doesn't just answer once but works toward a goal in a loop — taking actions, reading the results, and deciding what to do next.Full definition → scaffolding to become the differentiator, citing a November 2025 espionage campaign that scored 100 with a medium-risk number of techniques.
Behaviors such as autonomous kill-chain orchestration and AI-directed execution have no ATT&CK IDs yet, so Anthropic argues the taxonomy must grow to capture what separates the highest-risk actors.
Terms in this piece · Glossary
AI agent — An AI system that doesn't just answer once but works toward a goal in a loop — taking actions, reading the results, and deciding what to do next.
