Anthropic, the company behind Claude (one of the world's most advanced AI models), just published a landmark report mapping a year's worth of AI-enabled cyber threats. The findings are sobering — and directly relevant to every UK family online.
The Headlines
On June 12, 2026, the US government issued an export control directive suspending access to Anthropic's most advanced models — Claude Fable 5 and Claude Mythos 5 — over national security concerns.
One day earlier, on June 11, Anthropic published their Frontier Red Team analysis of 832 banned accounts caught using Claude for malicious cyber activity between March 2025 and March 2026.
The results were published jointly with Verizon's 2026 Data Breach Investigations Report (DBIR) — the gold standard for cybercrime statistics worldwide.
📊 The Numbers That Matter
| Metric | Value |
|---|---|
| Accounts analysed | 832 |
| Period | Mar 2025 — Mar 2026 |
| Used AI for malware writing | 67.3% (560 accounts) |
| Used AI for lateral movement (deep network compromise) | 6.5% (54 accounts) |
| Medium-to-high risk actors (first 6 months) | 33% |
| Medium-to-high risk actors (second 6 months) | 56% |
| Risk increase | 1.7× in 6 months |
🔬 What Anthropic Found
1. AI Makes Attackers More Dangerous
The most common use of AI was writing malware (67.3% of the accounts studied). But the trend is moving deeper into the attack lifecycle:
- AI-assisted phishing — fell by 8.6% (attackers are moving past this)
- AI-assisted account discovery — rose by 8.9% (finding valid accounts inside compromised networks)
- AI-assisted lateral movement — used by 6.5% of accounts (navigating deep inside networks)
What does this mean? Attackers are no longer using AI just to write phishing emails. They're using it to penetrate deeper into systems, find valuable data, and cause more damage — autonomously.
2. Old Threat Assessment Models Are Broken
Traditionally, security teams judged an attacker's risk level by:
- How many techniques they used
- What tools they employed
- How technically skilled they appeared
None of that works anymore.
"The least-skilled actors in our dataset used about 16 distinct techniques on average, whereas the most skilled used about 20." — Anthropic Frontier Red Team
AI flattens the skill gap. A teenager with a Claude account can now perform attacks that previously required a nation-state's resources.
3. MITRE ATT&CK Framework Needs Updating
The industry-standard MITRE ATT&CK framework — used by every major cybersecurity company — does not fully capture AI-enabled threats.
Anthropic found that the highest-risk actors don't just use AI for individual tasks. They build architectures that chain together multiple attack stages and let AI run them with minimal human input.
🇬🇧 What This Means for UK Families
Here's the translation from technical report to real-world impact:
Phishing Is Evolving Fast
AI-generated phishing emails are now indistinguishable from genuine messages. The old "look for spelling mistakes" advice is dangerously outdated. AI writes perfect English, mimics writing styles, and personalises messages using data scraped from social media.
Voice Cloning Scams Will Surge
If 3 seconds of audio is enough to clone a voice (as we reported in our DarkWatch briefings), AI makes this trivial. Expect more "Hello Mum, I've been in an accident, please send money" calls.
The Speed of Attacks Is Increasing
When AI can write malware, probe networks, find accounts, and move laterally — all without human intervention — the window between an attack starting and your money being stolen shrinks from days to minutes.
🛡️ How to Protect Your Family Right Now
1. Enable Multi-Factor Authentication (MFA) Everywhere
If a criminal gets your password, MFA stops them. Use an authenticator app, not SMS.
2. Update Your "Phishing Test"
The old spelling-mistake test is dead. New test:
- ✅ Did they ask for something unusual?
- ✅ Are they creating urgency ("act now or lose everything")?
- ✅ Does the request come through an unexpected channel?
3. Use a Password Manager
If you reuse passwords, one breached account = all accounts breached. A password manager generates and stores unique passwords for every site.
4. Freeze Your Credit
AI can aggregate data from multiple breaches faster than ever. Freeze your credit with Experian, Equifax, and TransUnion — it's free and stops criminals opening accounts in your name.
5. Stay Updated
The threat landscape changes weekly. Bookmark CyberAware UK — we track the dark web so you don't have to.
🔮 The Bigger Picture
This isn't just an Anthropic report — it's a warning shot for the entire cybersecurity industry.
Anthropic themselves are moving fast:
| Date | Announcement | Significance |
|---|---|---|
| Jun 12 | US suspends Fable 5 / Mythos 5 access | Government acknowledging AI national security risk |
| Jun 12 | TCS partnership | Claude entering regulated industries (banking, insurance) |
| Jun 11 | DXC alliance | Claude powering systems for airlines, banks |
| Jun 11 | Claude Corps fellowship | Training next-gen AI safety professionals |
| Jun 9 | Claude Fable 5 / Mythos 5 launch | Next-gen models with unknown capabilities |
| Jun 3 | MITRE ATT&CK mapping report | Published here — the core of this article |
| Jun 1 | Confidential S-1 filing | Anthropic moving toward IPO |
| May 28 | Claude Opus 4.8 | Stronger coding and agentic abilities |
🐾 BULLY'S VERDICT
"AI doesn't sleep. It doesn't get tired. And now, criminals are using it to run attacks 24/7. But here's the thing — the same technology that makes them faster can make you safer. Knowledge is still your best defence. Stay sharp. Stay suspicious. And when something feels off — trust that feeling."
— BULLY, CyberAware UK Digital Threat Response Unit
Sources: Anthropic Frontier Red Team Report, Verizon 2026 DBIR, Anthropic Newsroom