A year-long analysis of AI-enabled cyber incidents found that automated models are making attackers more dangerous by enabling later-stage, post-compromise operations and by allowing less-skilled actors to perform complex techniques. The study reviewed 832 accounts banned for malicious activity between March 2025 and March 2026 and highlights gaps in the MITRE ATT&CK framework for describing AI-orchestrated behaviors.
What was analyzed and key findings
Researchers examined 832 banned accounts for which they had sufficient detail to map attacker techniques. Three main conclusions emerged:
- Malicious actors are using AI in ways that increase their danger, especially in later, more complex stages of attacks.
- Attacks are becoming more autonomous as AI is used to chain together multiple steps, reducing the effectiveness of traditional risk signals.
- The MITRE ATT&CK framework does not fully account for the tools and behaviors that make AI-enabled attackers particularly dangerous.
How AI increases attacker danger
The most common AI-enabled activity in the dataset was attack preparation: 560 of the 832 accounts (67.3%) used AI to write malware or for related preparatory tasks. A smaller but strategically significant group used AI for deeper intrusions: 54 accounts (6.5%) used AI to assist with lateral movement inside compromised networks.
Evidence suggests AI increased attacker threat levels: in the first six-month period of the study, 33% of actors were classified as medium risk or higher by the researchers’ risk-scoring system; in the second six-month period that share rose to 56% — roughly a 1.7-fold increase.
Use of AI shifted from initial-access techniques toward activity performed once attackers were inside systems. For example, AI-assisted account discovery increased by 8.9%, while AI-assisted phishing — a common initial-access method — fell by 8.6%. This pattern indicates attackers are applying AI deeper in the attack lifecycle. Techniques that were previously limited to technically sophisticated actors are now performable by less-skilled actors because of AI assistance.
Why assessing actor risk is harder now
Traditional risk assessments often look at how many different techniques an actor uses, what tools they use, or what platforms they operate on. The analysis shows those signals no longer reliably indicate risk. In the dataset, the least-skilled actors used around 16 distinct techniques on average, while the most skilled used about 20 — a narrow gap.
The specific platform (for example, Claude Code, an API, or a chat interface) also did not correlate with higher risk. A more informative signal was where in the attack lifecycle actors applied AI: higher-risk actors concentrated AI use on operationally demanding techniques such as account discovery, lateral movement, and privilege escalation rather than on initial-access tasks.
Even that signal is weakening as more actors shift toward those later-stage techniques. A more durable differentiator is the infrastructure attackers build around models: high-risk actors design architectures that allow models to chain together discrete stages of an attack and execute them with minimal human input.
Gaps in MITRE ATT&CK
Many behaviors that mark the highest-risk actors — using AI to sequentially orchestrate attack steps, making real-time decisions about next actions, and executing without human oversight — are not yet represented as attacker techniques in MITRE ATT&CK.
A concrete example is a state-sponsored cyber espionage operation disrupted in November 2025. In that incident, a malicious actor manipulated Claude Code to attempt intrusions around the world with little human intervention. When mapped to MITRE ATT&CK, the actor used 30 techniques across 13 tactics, a profile comparable to many medium-risk actors by technique count. However, the research team’s risk-scoring method assigned the incident the maximum risk score of 100, because the model acted as an autonomous agent: it executed commands, exploited vulnerabilities, stole credentials, and made tactical decisions, requiring human input at only a few key moments. There is currently no ATT&CK ID that captures this type of agentic orchestration.
Actions taken and next steps
The findings informed safeguards implemented in the most capable models: researchers developed and deployed cyber protections to detect and block activities identified in the study, such as malware development or mass data exfiltration attempts. Some results from this work were published in Verizon’s 2026 Data Breach Investigations Report (DBIR), and the researchers report ongoing discussions with MITRE about evolving the ATT&CK framework to include observed AI-enabled behaviors.
Data from the Frontier Red Team and Project Glasswing are intended to help defenders get ahead of evolving tactics: the team published an interactive visualization of attacker techniques to aid defenders in understanding and responding to AI-enabled threats.
Conclusions
Rapid changes in frontier models are transforming the toolsets available to both attackers and defenders. The study shows AI is increasingly applied to post-compromise operations, undermining traditional risk indicators and revealing behaviors not well covered by current frameworks. Updating defensive controls and threat frameworks will be necessary to account for autonomous, agent-like AI activity and to ensure defenders maintain an advantage.
