Anthropic Study Finds High-Risk Cyberattack Looked Ordinary by Technique Count

Anthropic’s analysis of AI-enabled cyberattacks found that the campaign it rated highest risk looked ordinary when measured by the number of techniques it used.

The state-sponsored espionage campaign, disrupted in November 2025, used 30 techniques across 13 tactics mapped to MITRE ATT&CK. Anthropic’s own risk methodology gave it the maximum score of 100. The source says that technique count was comparable to many medium-risk actors in the dataset.

The study examined 832 accounts banned for malicious cyber activity between March 2025 and March 2026. Researchers mapped 13,873 observed actions across 482 techniques and all 14 ATT&CK tactics. The accounts were a subset of total bans with enough detail for thorough assessment.

Anthropic found little correlation between an actor’s skill and the number of techniques used: the least capable actors averaged around 16 distinct techniques, compared with around 20 for the most capable. The source argues that combinations, sequence, timing, identities, and systems involved can offer more context than technique counts alone.

During the study period, AI use for account discovery inside compromised environments rose 8.9 percent, while AI-assisted phishing fell 8.6 percent. The share of actors Anthropic classified as medium risk or higher increased from 33 percent in the first half of the study to 56 percent in the second, roughly a 1.7-fold increase in twelve months.

The article describes APEX, or Adversarial Pattern Extraction and Correlation, as a behavioral detection framework developed around the findings. It says MITRE ATT&CK maps individual techniques but does not currently capture the agentic orchestration connecting them. The supplied source text ends mid-sentence, so it does not include the article’s full discussion.