Anthropic Attack Navigator: Mapping AI-Enabled Cyber Threats and Introducing the ARiES Risk Score

TL;DR

Anthropic published the Attack Navigator, an analysis that maps 832 AI‑enabled threat actors onto the MITRE ATT&CK framework, showing that the share of medium‑or‑higher risk actors grew from 33% to 56% in one year and introducing the AI Risk Enablement Score (ARiES) to quantify AI‑augmented cyber risk.

Overview of the Attack Navigator

The Attack Navigator is an interactive tool that visualizes how malicious actors misuse Anthropic’s Claude models across all 14 MITRE ATT&CK tactics and 482 unique sub‑techniques. The study covers activity from March 2025 to March 2026, focusing on accounts banned for violating Anthropic’s Usage Policy. The analysis was contributed to the 2026 Verizon Data Breach Investigation Report.

Dataset and Methodology

Scope: 832 banned accounts with sufficient detail to map their behavior onto ATT&CK V18.
Observations: 13,873 technique instances across the full ATT&CK matrix.
Risk Scoring: Each actor receives an ARiES score (0‑100) composed of three components:
1. Threat (0‑35): Intent clarity, technical sophistication, evasion tactics, and threat‑intel signals.
2. Vulnerability (0‑35): Model’s contribution to the harm and risk profile of the access interface (API, Claude Code, etc.).
3. Impact (0‑30): Real‑world consequences as judged by safety classifiers and investigators.
Outcome: Actors are categorized into low, medium, high, and critical risk tiers.

Key Findings

1. Growing AI‑Enabled Threat Landscape

The proportion of actors with ARiES ≥ 33 (medium risk) rose from 33% in the first half of the study period to 56% in the second half – a 1.7× increase.
High‑risk actors concentrate on techniques with the highest per‑actor risk weight, such as lateral movement, credential dumping, and web shells.
Access method (API vs. Claude Code) does not predict risk; the decisive factor is the techniques requested from the model.

2. Agentic Scaffolding Drives Autonomy

Risk differentiation is shifting from what actors ask the model to how they build surrounding code, tooling, and orchestration layers.
The November 2025 cyber‑espionage campaign (GTG‑1002) achieved a perfect ARiES = 100 by using Claude Code as an autonomous attack platform, not merely a code‑generation assistant.
Autonomous orchestration—real‑time pivot decisions, multi‑stage execution without human input—is not captured by existing ATT&CK IDs.

3. ATT&CK Framework Gaps

While 13,873 observations map to existing ATT&CK techniques, autonomous kill‑chain orchestration and AI‑directed execution lack dedicated IDs.
The taxonomy must evolve to include cross‑cutting categories for agentic and autonomous behaviors.

Technique‑Level Insights

AI‑Assisted Capability Development

T1587 (Develop Capabilities) appears in 69% of actors; T1587.001 (Malware Development) in 560 accounts.
Common uses: generating custom scripts, DLL injection code, fingerprint‑evasion routines, and automated account management.
Follow‑up techniques: T1027 (Obfuscation) (64.7%), T1005 (Data from Local System) (55.9%), T1562 (Impair Defenses) (54.9%).

Limited Real‑Time Decision Making

Only 6.5% of actors used models for lateral movement; fewer than 12 used models for remote services (RDP/SSH/SMB).
Privilege escalation and impact stages see model usage in 22.5% of cases.
Traditional high‑value techniques (Active Directory abuse, Kerberos ticket attacks, cloud‑infrastructure manipulation) are under‑represented.

Defense Evasion Dominates

84.4% of actors employ at least one defense‑evasion technique.
Top evasion techniques:
- T1027 (Obfuscation) – 64.7%
- T1562 (Impair Defenses) – 54.8%
- T1055 (Process Injection) – 30.3%
Later‑stage tactics (impact, exfiltration, privilege escalation, lateral movement) collectively account for <9% of observations, indicating a focus on early‑stage assistance.

High‑Risk Actor Profile

Actors using lateral movement have ARiES scores 10.5 points higher on average.
The 54 actors employing lateral movement average 56.4 (vs. overall mean 46.8).
High‑risk techniques (3‑5× more common among top actors):
- T1021 (Remote Services: SSH/SMB)
- T1078.003 (Valid Accounts)
- T1003 (OS Credential Dumping)
- T1560 (Archive Collected Data)
- T1505.003 (Web Shell)
Traditional predictors—technical skill, interface choice, technique breadth—show weak correlation with ARiES (r ≈ 0.27‑0.28). Median actor uses 16 techniques, a breadth that previously signaled a mature operation.

The Rise of Live‑Exploitation Actors

Medium‑or‑higher risk actors grew from 33.5% to 56.1% across the study year.
Increase in operational techniques: +8.9% in T1087 (Account Discovery) and +6.2% in T1020 (Automated Exfiltration).
Low‑skill actors are now employing models for in‑network activities previously limited to elite groups.
Implication: defenders can no longer rely on skill‑based heuristics; operational technique usage will become the baseline.

Novelty of Agentic Threat Actors

The GTG‑1002 campaign illustrates that autonomous orchestration—AI executing commands, making tactical decisions, and chaining techniques—drives the highest risk scores.
Key differentiators:
1. Autonomous execution of reconnaissance, discovery, and exploitation.
2. Live pivoting using harvested credentials and cloud‑metadata tokens.
3. Human‑level strategic direction with AI handling tactical implementation.
Technique count alone (30 techniques across 13 tactics) does not explain the elevated risk; the scaffolding around the model does.

Defensive Responses Informed by the Navigator

Enhanced Classifiers: Updated safety classifiers to flag high‑ARiES behaviors and agentic misuse patterns.
Real‑Time Safeguards: Deployed request‑level blocks for prohibited activities (e.g., ransomware development, mass exfiltration).
Cyber Verification Program (CVP): Routes dual‑use activities through a verification pipeline for defensive practitioners.
Project Glasswing: Proactively studies offensive capabilities of upcoming models before public release.
Framework Collaboration: Engaged MITRE to extend ATT&CK with AI‑native categories and shared indicators with industry and government partners.

Implications for the Future of Threat Intelligence

Framework Evolution: ATT&CK must incorporate cross‑cutting categories for autonomous, agentic, and AI‑directed behaviors.
Risk Metrics Shift: Traditional skill‑based assessments will be supplanted by metrics that capture orchestration depth and AI reliance.
Defender AI Adoption: Defenders need equally sophisticated AI tools, rapid vulnerability remediation, and broader intelligence sharing to stay ahead.
Long‑Term Outlook: If the industry responds with urgency, frontier AI can ultimately aid defenders more than attackers by automating bug discovery and hardening code.

Accessing the Navigator

Open the interactive LLM ATT&CK Navigator: https://red.anthropic.com/2026/attack-navigator/navigator.html

This article synthesizes Anthropic’s “Mapping AI‑enabled cyber threats” research release (June 3 2026) without adding or altering any factual content.