Anthropic analyzed 832 accounts: traditional defenses can't keep up with AI-powered attacks

Anthropic conducted a large-scale study of 832 malicious accounts and found a worrying trend: cybercriminals are integrating artificial intelligence into their attacks more and more actively, creating new combinations of tactics that traditional defenses are simply not ready for.

How the researchers studied the threats

Anthropic researchers analyzed the activity of 832 malicious accounts and mapped the observed patterns to MITRE ATT&CK, a foundational knowledge base of tactics and techniques used by cybercriminals and nation-state groups worldwide. MITRE ATT&CK is a long-awaited cybersecurity standard, respected across the industry, and the basis for building defenses, assessing risk and planning incident response in large organizations.

The study revealed deep patterns: which AI-assisted attack methods are becoming most widespread, how they evolve faster than classic threats, and, most important, where existing defenses show the biggest gaps and vulnerabilities.

What they found: the key findings

The results are striking and alarming at the same time. Cybercriminals are already systematically adapting their methods, going far beyond the traditional patterns that classic signature-based defenses or simple filtering rules can catch. AI-enhanced attacks use entirely new combinations of known tactics, and also create new ones:

• Are poorly represented, or not represented at all, in classic defense databases
• Evolve three to four times faster than traditional security can update
• Disguise their true intent as legitimate user activity
• Use language models for social engineering, targeted phishing and manipulation
• Automate reconnaissance, scanning and exploitation of vulnerabilities at industrial scale

Critically, AI lets attackers not merely repeat the same attacks but dynamically generate new variants in real time, bypassing existing detectors. This is a fundamentally new level of threat, one the industry has never faced at this scale.

Why defenses are falling behind

Traditional signatures and detection rules were built for an adversary whose behavior is more or less predictable and repeatable. But when an adversary can generate new attack variants in real time and actively adapt to countermeasures, a classic defense system simply cannot evolve fast enough. It is like playing chess against an opponent who rewrites the rules mid-game.

Defenses are falling behind not because someone made a design mistake, but because AI gives attackers a huge asymmetric advantage: the speed at which methods evolve, the scale of operations and the ability to adapt without human intervention.

"The techniques we relied on for years are no longer sufficient in the age of AI," the

Anthropic researchers state.

New requirements for defense

Anthropic is clear about the way forward: a purely traditional approach is no longer enough. Fundamentally new strategies are needed: behavioral analytics, real-time contextual protection, automated adaptation of detection systems, predictive ML-based threat models, anomaly analysis and risk management with feedback loops.

Companies should prepare for defense that is more proactive, predictive and adaptive, not merely reactive. The era of passive defense, where you simply block already known threats, is ending. Organizations need to move to flexible, intelligent strategies that evolve alongside new threats. In essence, defense must learn and develop like AI, or it will always lag behind.

What this means for business

For IT teams and businesses, Anthropic's findings are a serious signal to fully reassess all security strategies and investments. Old, time-tested techniques are no longer sufficient against a new generation of AI-enhanced threats. Companies urgently need to invest in modern tools, deeper behavioral analytics and adjusted response processes, and, quite likely, to develop their own AI models for defense. Otherwise the gap between attack and defense capabilities will keep widening.