# Anthropic Frontier Red Team Maps a Year of AI-Enabled Cyber Threats Onto MITRE ATT&CK — 832 Banned Accounts Studied, Medium/High-Risk Actors Doubled From 33% to 56% as 67% of Operators Used Claude to Write Malware

> Anthropic's threat-intel team mapped a year of Claude misuse to MITRE ATT&CK and found AI is now lifting low-skill attackers into deep post-compromise work.

- Org: Anthropic
- Date: 2026-06-03
- Category: security, article
- Source: https://www.anthropic.com/news/AI-enabled-cyber-threats-mitre-attack
- Canonical page: https://ai-tldr.dev/releases/anthropic-frt-cyber-threats-mitre-jun3/

## In short

Anthropic's Frontier Red Team mapped 832 banned malicious accounts onto MITRE ATT&CK across March 2025 to March 2026. Medium-or-higher-risk operators rose from 33% to 56%, with 67.3% using AI to write malware.

## What it is

A research write-up from Anthropic's Frontier Red Team based on detailed examination of 832 accounts banned for malicious cyber activity between March 2025 and March 2026. The analysis maps each operator's observed behavior onto the MITRE ATT&CK framework and contributes underlying data to Verizon's 2026 Data Breach Investigations Report.

## How it works

Researchers Kyla Guru and Jacob Klein reviewed conversations, tooling, and outputs from banned accounts and tagged each session against ATT&CK techniques. 560 of 832 operators (67.3%) used Claude to write malware, while 54 (6.5%) used it for lateral movement inside compromised networks. Comparing the first and second halves of the year, the share of medium-or-higher risk operators climbed from 33% to 56%, and a single state-sponsored espionage campaign disrupted in November 2025 scored a maximum risk of 100.

## Why it matters

The headline finding is that AI is being used in the later, autonomy-heavy stages of attacks — not just phishing emails. That erodes the old skill-based risk gradient (script kiddie vs. state actor) and exposes gaps in MITRE ATT&CK's vocabulary for agentic orchestration, which defenders rely on for coverage maps and detection engineering.

## Who it's for

CISOs, threat-intel teams, SOC engineers, and AI safety researchers

## Try it

https://www.anthropic.com/news/AI-enabled-cyber-threats-mitre-attack

## Links

- [Anthropic Post](https://www.anthropic.com/news/AI-enabled-cyber-threats-mitre-attack)
- [Verizon 2026 DBIR](https://www.verizon.com/business/resources/reports/dbir/)
- [TechTarget Coverage](https://www.techtarget.com/searchsecurity/news/366643420/Verizon-DBIR-Key-takeaways-for-CISOs)
- [Frontier Red Team](https://red.anthropic.com/)