Mapping AI-enabled cyber threats

Anthropic analyzed 832 banned accounts (Mar 2025–Mar 2026) and mapped 13,873 AI-enabled malicious actions to MITRE ATT&CK, showing that actors used models across all stages of the kill chain—most commonly to develop malware and evade defenses—and that a growing subset are using agentic scaffolding to autonomously chain reconnaissance, exploitation, lateral movement, and exfiltration (notably the GTG-1002 espionage campaign); the report introduces an additive ARiES risk score, documents rising medium/high risk actors, and urges extending ATT&CK and deploying technical safeguards and detection for agentic behaviors.