TLDR Tech / InfoSec
Mapping AI-enabled cyber threats: Insights from the LLM ATT&CK Navigator (13 minute read)
Anthropic mapped 13,873 technique observations from 832 banned accounts onto MITRE ATT&CK and found that medium-or-higher-risk actors climbed from 33% to 56% in a year, with most actors leaning on AI for early-stage capability development (T1587 malware, used by 69%) and defense evasion (T1027, T1562, and T1055) while the highest-risk actors instead drove AI into post-compromise, hands-on-keyboard work like lateral movement (T1021), OS credential dumping (T1003), and web shell deployment (T1505.003). The standout case, GTG-1002, hit the maximum risk score of 100 not through technique breadth (30 techniques, comparable to medium-risk actors) but by weaponizing Claude Code on a Kali host with pentest tools wired in as MCP servers, turning the model into an autonomous operator that chained reconnaissance through SSRF exploitation, SSH key and cloud-secret harvesting, and lateral movement with minimal human input. Defenders should treat agentic orchestration rather than raw skill or technique count as the new high-risk signal, build detections for multistep autonomous execution and AI-directed pivots that MITRE does not yet enumerate, and compress vulnerability-to-patch timelines while applying AI defensively at matching urgency.
Read the full story