The dividing line is no longer skill, but orchestration

This piece is full of jargon — T1587, lateral movement, correlation coefficients. No security background needed: learn these four and the rest reads clearly.

This isn't a closed-door exercise. Some of the results were folded into the 2026 Verizon DBIR (Data Breach Investigation Report), the security industry's annual benchmark. The sample is accounts Anthropic banned between March 2025 and March 2026 for violating the cyber parts of its Usage Policy, mapped onto the version of MITRE ATT&CK that was live at the time (V18).

Each actor was scored 0–100 with a new method, ARiES (AI Risk Enablement Score). Data is anonymized.

ARiES is a composite of three signals: the actor's threat profile, the model's contribution to the requested harm, and the observed or potential impact. It draws on an account's activity across Claude.ai, Claude Code, and the API, combined with safety classifiers and threat-intelligence indicators. The higher the score, the higher-risk the AI-enabled actor.

Threat evaluates intent clarity, technical sophistication, threat-intel signals, and evasion tactics (sophistication is graded by Claude from the actor's prompts and tool usage). Vulnerability assesses the model's capacity to enable the harm and the interface risk — programmatic interfaces (API) and agentic coding tools like Claude Code score highest, given their potential to automate actions. Impact captures real-world effects via safety-classifier scores and investigators' assessment.

Why it deliberately uses addition, not multiplication

Traditional cyber risk is Threat × Vulnerability × Impact, reflecting whether a hypothetical attack would succeed. The flaw: if any factor is zero, the whole score collapses to zero. But the question the red team wants to answer is different — which AI-involved actors and techniques warrant the most attention from defenders?

Across the 13,873 observations, the three things actors most often ask AI for are clear: build pre-engagement offensive tooling, make it harder to detect, and harvest data from compromised systems. The most common technique family is T1587 (Develop Capabilities — 574/832 accounts, of which malware development is 560). Defense evasion is the single largest tactic category, present in 84.4% of accounts.

A clear pattern: heavy up front, light once inside the network

Once actually inside a target network — adapting to a live environment — actors rarely use the LLM for real-time decisions. The later-stage tactics together account for just 8.7% of all observations, less than defense evasion alone. This pattern held steady all year.

A subtle H2 shift: less standalone malware (Develop Capabilities −12%, Phishing −8.6%), more help with specific operational phases — more accounts using the model for work that implies they're already inside the network.

So what do those T codes actually mean as actions? Here's every attack term in the piece, in plain language. Lost on one? Come back here.

Lateral movement is rare in the dataset, yet highly correlated with the top ARiES scores. The highest-risk actors are the ones most likely to use the model for post-compromise, hands-on-keyboard work — remote services, credential dumping, web shell deployment, internal discovery. Going from "using AI to prepare" to "using AI to act inside a live network" is the key marker of high AI enablement.

The counterintuitive finding: the metrics threat-intel relies on are weak predictors

The attributes threat-intelligence teams typically lean on — assessed skill, interface choice, number of techniques — are all weak predictors of how much uplift AI gives an actor.

The takeaway: the actors who get the most uplift from AI aren't necessarily more sophisticated, don't necessarily use coding tools, and don't necessarily span the killchain — they simply use Claude for more hands-on techniques. On the current trajectory, these operational techniques will become tomorrow's baseline, and a new way to measure the riskiest actors will be needed.

The red team analyzed the actor behind the November 2025 AI-enabled espionage campaign, labeled GTG-1002, which compromised government and critical-infrastructure targets across multiple countries. Technique count or tactic type alone can't explain why it's the highest-risk actor observed to date — its profile resembles dozens of medium-risk accounts.

The most dangerous actors now use AI to orchestrate attacks, not just build the tools that enable them, and the framework investigators rely on hasn't caught up. ATT&CK captures individual techniques, but the behaviors that distinguish the highest-risk actors — agentic orchestration of an entire killchain, autonomous target selection — aren't in the taxonomy.

The red team's proposed next step: add cross-cutting categories to ATT&CK that help investigators identify the agentic, autonomous, decision-making behaviors that chain multiple techniques together. The findings are also reshaping Anthropic's own safeguards — four of them: