随着人工智能改变网络攻击的性质和手段，安全社区所使用的技术和框架是否依然有效？
在一份新报告中，我们试图回答这个问题。我们研究了 2025 年 3 月至 2026 年 3 月期间因恶意网络活动被封禁的 832 个账号，并将其映射到 MITRE ATT&CK（一个长期存在的网络攻击者战术与技术数据库）上。我们将部分结果发布在 Verizon 的《2026 年数据泄露调查报告》（DBIR）中，并在此分享更详细的分析。这 832 个案例只是该期间被封禁账号总数的一部分，但它们代表了那些我们有足够细节来对攻击者技术进行彻底评估的案例。
我们的分析得出了三个主要结论：
- 恶意行为者正在以使其更具危险性的方式使用人工智能。更具体地说，威胁行为者正在其网络行动的后期、更复杂阶段使用人工智能。
- 网络攻击正变得更加自主，而人工智能可用于将攻击的许多环节串联起来，这一事实意味着过去区分高风险与低风险行为者的方法已不再那么有效。
- MITRE ATT&CK 框架并未完全涵盖那些使人工智能驱动的攻击者如此危险的工具和活动。
下面我们提供每个结论的摘要。您可以在我们的前沿红队博客上阅读更详细的分析。
人工智能如何让攻击者更具危险性
我们数据库中最常见的人工智能驱动活动与网络攻击准备相关，例如编写恶意软件（在我们研究的 832 个账号中，有 560 个（即 67.3%）为此目的使用了人工智能）。较少一部分行为者将人工智能用于更复杂的活动——例如，832 个行为者中有 54 个（6.5%）使用人工智能辅助“横向移动”，这涉及在被攻破的网络深处进行导航。
我们发现了与人工智能被用于提升攻击者威胁等级相一致的证据。在我们分析的前六个月期间，33% 的行为者被我们的风险评分系统归类为中等风险或更高。但到了后六个月期间，这一比例跃升至 56%——大约增长了 1.7 倍。
在我们研究的整个时期内，攻击者对 AI 的使用，已从获取系统初始访问权限的技术，转向进入系统后实施的活动。例如，利用 AI 进行账户发现——即在被攻破的环境中识别有效账户——增长了 8.9%，而 AI 辅助的网络钓鱼——一种常见的获取系统访问权限的技术——则下降了 8.6%。这表明攻击者正越来越多地将 AI 应用于攻击生命周期的更深阶段。
这类“攻破后”技术过去仅限于具备相应技术知识的攻击者才能实施。我们的调查显示，如今可以让 AI 代表技术能力较弱的攻击者来执行这些活动。
为何评估攻击者威胁等级变得更加困难
安全团队如何评估网络攻击者的风险等级？传统上，他们依据攻击者使用了多少种不同技术、使用了哪些工具或界面等信息。但我们的分析表明，这些信号已无法准确描绘特定威胁行为者的风险等级。
既然 AI 可以代表攻击者执行高度技术性的任务，那么攻击者的技能水平与其使用的技术数量之间几乎不存在相关性：在我们的数据集中，技能最弱的攻击者平均使用约 16 种不同技术，而技能最强的攻击者则使用约 20 种。同样，所使用的具体平台——Claude Code、API 或聊天界面——也与攻击者的风险等级无关。
通常有助于区分高风险攻击者的因素，是他们在攻击生命周期的哪个阶段应用 AI。例如，他们将 AI 集中在操作要求更高的技术上——即那些需要大量时间、监督或实时决策才能执行的技术——如账户发现、横向移动和权限提升，而不仅仅是那些让他们获得系统初始访问权限的任务。
但即便是这一信号也已在逐渐削弱：正如上一节所讨论的，随着更多行为者被归类为更高风险，这些操作技术恰恰是更广泛群体正在趋同的方向。更具持久性的区分因素是攻击者在模型周围构建的脚手架类型：高风险行为者设计的架构能让模型将网络攻击的各个离散阶段串联起来，并在最少人工输入的情况下执行。
安全框架为何需要变革
许多区分最高风险行为者的行为——例如利用AI按顺序编排攻击链中的各个步骤、实时决策下一步行动、以及在无人干预下执行——尚未被纳入MITRE ATT&CK框架的攻击者技术类别中。
以我们于2025年11月挫败的那起国家支持的网络间谍行动为例。在那起事件中，一名恶意行为者操纵Claude Code试图渗透全球各地的目标，且几乎无需人工干预。对照MITRE ATT&CK框架进行映射后发现，该行为者使用了横跨13种战术的30项技术，这与我们数据集中许多中等风险行为者相当。显然，仅关注该行为者所使用的技术数量，会低估其真正的危险性（相比之下，将我们的风险评分方法应用于此次攻击，其风险评分达到最高值100分）。
在那次攻击中，模型以自主智能体的方式运作：它执行命令、利用漏洞、窃取凭证并做出战术决策，仅在少数关键节点需要人工输入。目前ATT&CK框架中并没有针对这种智能体编排的ID——然而，随着AI智能体能力不断增强，这些恰恰是我们预计会越来越多地看到的行为。
展望未来
这项分析的结果为我们构建模型中的安全防护措施提供了参考。例如，我们已在最先进的模型上开发并部署了网络安全防护机制，用于检测并拦截本次研究中发现的部分活动，例如开发恶意软件或大规模数据窃取。继与 Verizon 的合作之后，我们目前正与 MITRE 讨论 ATT&CK 框架应如何演进，以纳入我们观察到的、由 AI 驱动的行为模式。
前沿模型正在迅速改变攻击者和防御者双方可用的工具。我们致力于帮助防御者领先于这些不断演变的战术，并优先将最强大的工具交到防御者手中。我们将继续分享从 Project Glasswing、从我们在此收集的数据集以及从其他网络安全活动中所获得的经验。
在我们的 Red 博客文章中，我们分享了一个关于攻击者所用技术的交互式可视化展示，旨在帮助防御者领先于 AI 驱动的威胁。
推出 Claude for Teachers
Anthropic 承诺向加拿大 AI 研究投入 1000 万美元
As AI transforms the nature of and methods behind cyberattacks, how well do the techniques and frameworks used by the security community hold up?
In a new report, we seek to answer that question. We examine 832 accounts that were banned for malicious cyber activity between March 2025 and March 2026 and map them onto MITRE ATT&CK, a longstanding database of the tactics and techniques used by cyberattackers. We published some of these results in Verizon’s 2026 Data Breach Investigations Report (DBIR), and are sharing a more detailed analysis here. These 832 cases are just a subset of the total number of accounts banned during this period, but they represent those where we had enough detail to conduct a thorough assessment of the attackers’ techniques.
There were three main conclusions from our analysis:
- Malicious actors are using AI in ways that make them more dangerous. More specifically, threat actors are using AI in the later, more complex stages of their cyber operations.
- Cyberattacks are becoming more autonomous, and the fact that AI can be used to chain together many parts of the attack means that the old ways of differentiating high- from low-risk actors are no longer as effective.
- The MITRE ATT&CK framework does not fully capture the tools and activities that make AI-enabled attackers so dangerous.
Below we provide a summary of each of these conclusions. You can read a longer analysis on our Frontier Red Team blog.
How AI makes attackers more dangerous
The most common AI-enabled activities in our database related to preparing for a cyberattack, such as writing malware (560 of the 832 accounts we studied, or 67.3%, used AI for this purpose). A smaller number of actors use AI for more complex activities—for example, 54 of the 832 actors (6.5%) used AI to assist with “lateral movement,” which involves navigating deep inside a compromised network.
We found evidence consistent with AI being used to help increase the threat level of attackers. In the first six-month period of our analysis, 33% of actors were classified by our risk-scoring system as medium risk or higher. But by the second six-month period, that share had jumped to 56%—a roughly 1.7-fold increase.
Across the period we studied, attackers’ use of AI shifted from techniques to gain initial access to a system towards activity carried out once they were inside the system. For example, the use of AI for account discovery—identifying valid accounts inside a compromised environment—rose 8.9%, while AI-assisted phishing—a common technique to gain access to a system—fell 8.6%. This suggests that attackers are increasingly applying AI deeper in the attack life cycle.
These sorts of “post-compromise” techniques used to be restricted to actors with the technical knowledge to carry them out. Our investigation shows that AI can now be made to perform these activities on behalf of less sophisticated actors.
Why it’s harder to assess an actor’s threat level
How do security teams assess the risk level of a cyberattacker? Traditionally, they’ve used information like how many different techniques they employ and what tools or interfaces they use. But our analysis suggests that these signals no longer paint an accurate picture of the risk level of a given threat actor.
Now that AI can perform highly technical tasks on an actor’s behalf, there’s little correlation between the skill of a threat actor and how many techniques they use: the least-skilled actors in our dataset used about 16 distinct techniques on average, whereas the most skilled used about 20. Likewise, the specific platform used—Claude Code, an API, or a chat interface—also did not correlate with an actor’s risk level.
Whatoften helpsdistinguish higher-risk actors is where in the attack life cycle they apply AI. For example, they concentrate their use of AI on more operationally demanding techniques—those that require significant time, oversight, or real-time decision making to carry out—like account discovery, lateral movement, and privilege escalation, rather than just on tasks that allow them to gain initial access to the system.
But even that signal is already eroding: as discussed in the previous section, those operational techniques are exactly where the broader population is heading as more actors get classified as higher risk. The more durable differentiator is the type of scaffolding attackers build around the model: higher-risk actors design architectures that allow models to chain together discrete stages of a cyberattack and carry them out with minimal human input.
Why security frameworks need to change
Many of the behaviors that distinguish the highest-risk actors—such as the use of AI to orchestrate steps in the attack chain sequentially, make real-time decisions about what to do next, and execute without human intervention—are not yet included as attacker techniques in the MITRE ATT&CK framework.
Consider the state-sponsored cyber espionage operation we disrupted in November 2025. In that case, a malicious actor manipulated Claude Code into attempting to infiltrate targets around the world, with little human intervention. Mapping it against the MITRE ATT&CK framework shows that the actor used 30 techniques across 13 tactics, which was comparable to many medium-risk actors in our dataset. Clearly, focusing on the number of techniques this actor used underplays how dangerous they really were (by contrast, applying our risk-scoring methodology to this attack earns it the maximum risk score of 100).
In that attack, the model worked as an autonomous agent: it executed commands, exploited vulnerabilities, stole credentials, and made tactical decisions, only requiring human input at a few key moments. There is no ATT&CK ID for this type of agentic orchestration—yet these are precisely the behaviors we expect to see much more of as AI agents become more capable.
Looking ahead
The findings from this analysis helped inform the safeguards we build into our models. For example, we’ve developed and deployed cyber safeguards on our most capable models to detect and block some of the activities uncovered here, like developing malware or mass data exfiltration. Following on from our work with Verizon, we’re also in discussions with MITRE about how the ATT&CK framework might evolve to include the AI-enabled behaviors we observed.
Frontier models are rapidly changing the tools both attackers and defenders have at their disposal. We are committed to helping defenders get ahead of these evolving tactics, and to putting the most powerful tools in the hands of defenders first. We’ll continue to share what we learn from Project Glasswing, from datasets like the one we gathered here, and from our other cybersecurity activities.
In our Red blog post, we share an interactive visualization of the techniques used by attackers, in order to help defenders stay ahead of AI-enabled threats.