Anthropic analysis of 832 banned accounts shows AI lets low-skill actors run advanced cyberattack techniques, mapped to MITRE ATT&CK
Network defenders now face a wider pool of capable attackers. Anthropic banned 832 accounts for malicious cyber activity over the past year. About 67% used AI to write malware or prep attacks. Lateral movement and privilege escalation, once expert-only, are now run by AI for low-
Defenders are facing a structural shift in who can run a serious intrusion. Anthropic published an analysis of cyber-related misuse of its AI systems, drawn from 832 accounts it banned for malicious activity between March 2025 and March 2026. Roughly 67% of those accounts used AI to help write malware or otherwise prepare an attack, and a smaller share used it for lateral movement inside compromised systems. The core finding is about capability, not volume: techniques that used to require deep expertise, such as lateral movement, privilege escalation and account discovery, were carried out by AI on behalf of far less skilled operators. The least-skilled actors used about 16 distinct techniques on average, while the most skilled used roughly 20, a gap too small to tell them apart by method. The share of actors rated medium risk or higher climbed from 33% in the first half of the period to 56% in the second. In total Anthropic recorded 13,873 actions spanning 482 unique MITRE ATT&CK techniques across all 14 tactics. For security teams, the takeaway is that the barrier to entry for advanced post-compromise activity is falling, which widens the set of people who can reach later stages of an attack.