AI-Enabled Threat Actors 2026: What the MITRE ATT&CK Data Shows

Anthropic's Attack Navigator analysis covered 832 accounts banned for malicious cyber activity between March 2025 and March 2026. The methodology mapped each actor's observed behavior to the MITRE ATT&CK framework, producing 13,873 technique observations spanning all 14 tactics -- Initial Access through Impact.

This is not a simulated exercise or a red team reconstruction. These are real threat actors who used real AI models for real attacks, identified through Anthropic's usage monitoring, and whose behavior was sufficiently documented to support ATT&CK mapping. The sample includes actors across the full risk spectrum from opportunistic script-kiddie-level to sophisticated agentic operators.

The 12-month window allows meaningful trend analysis: H1 2025 versus H2 2025 technique frequency, risk score distribution changes over time, and the identification of emerging patterns that were not visible in shorter observation windows. For practitioners building threat intelligence programs, this dataset provides the first statistically grounded baseline for what AI-enabled malicious cyber activity actually looks like at scale.

In March 2025, 33% of malicious cyber actors in the dataset were classified as medium or high risk. By March 2026, that figure was 56%. A 1.7x increase in one year is not noise in a dataset of this size -- it reflects a structural shift in the population of actors using AI for attacks.

The most important finding from the risk classification analysis is what drives the jump. It is not technical skill. It is not tool breadth. It is not familiarity with specific ATT&CK techniques. The single characteristic that most consistently differentiates high-risk actors from medium-risk ones is agentic scaffolding: the construction of orchestration infrastructure that enables AI models to operate autonomously through multi-stage attack chains without operator direction at each step.

The GTG-1002 case study illustrates this precisely. GTG-1002 deployed Claude Code on Kali Linux, integrated open-source pentesting tools into the model's available toolset, and built an autonomous pipeline that handled recon, asset discovery, and data exfiltration without requiring manual direction at each stage. The result was a maximum risk score. GTG-1002's technical sophistication was not exceptional. Its orchestration architecture was. Defenders who frame AI-enabled threat response around blocking access to powerful models are addressing the wrong variable.

Defense evasion is the most widely distributed technique in the dataset: 84.4% of actors use it, a figure that has remained stable across the observation period. Its ubiquity means it is not a differentiator -- it is table stakes for actors who persist long enough to generate ATT&CK observations.

The growth is concentrated in later-stage operations. Account discovery increased 8.9% from H1 to H2. Automated exfiltration increased 6.2%. These are the techniques that accelerate time-to-damage after initial access -- the phase where speed is the attacker's primary advantage and where human IR response is most likely to be too slow.

The declining techniques are equally informative. Standalone malware development dropped 12%. Obfuscation dropped 8.6%. Attackers are using AI less for preparation and more for operation. They are spending less effort building tools and more effort moving through environments and extracting data.

Lateral movement stands out as the single strongest predictor of high-risk classification. Actors in the dataset who used lateral movement techniques averaged risk scores of 56.4 versus 46.8 for the overall population. If your detection engineering has to prioritize one ATT&CK tactic for AI-enabled threat coverage, lateral movement is where the signal is strongest.

The agentic scaffolding pattern creates a detection problem that existing rule sets are not designed to solve. A Claude Code instance orchestrating 50 parallel agents through a Kali Linux environment generates different behavioral signals than a human operator running Mimikatz manually. High API call volume, parallel process spawning, automated credential testing sequences, and machine-speed data staging are the indicators -- not the presence of any specific tool signature.

Practical defensive updates: (1) Build behavioral detection rules for agentic tool use patterns specifically: API call rate thresholds, parallel process spawn counts, automated authentication attempt sequences at non-human timing intervals. (2) Treat lateral movement as the highest-priority detection investment for AI-enabled threat coverage -- the risk score data is unambiguous on this. (3) Update IR playbooks to assume machine-speed data staging once initial access is confirmed. The 6.2% growth in automated exfiltration is not an edge case; it is becoming standard operating procedure for high-risk actors.

On the framework side: Anthropic is working with MITRE to evolve ATT&CK to capture AI-native attack patterns including autonomous kill-chain orchestration and real-time pivot decisions. The current framework's technique granularity was designed for human operators. As agentic scaffolding becomes more common, defenders will need a taxonomy that can represent behavior that occurs at machine speed across parallel execution threads -- something the current ATT&CK structure does not natively support.