The Rise of the Automated Amateur: How AI is Levelling the Cyber Playing Field

It used to be that if you wanted to be a proper, professional grade cyber villain, you had to put in the hours. You needed to spend your formative years lurking in the darker corners of IRC channels, learning the intricacies of assembly language, and developing the kind of social skills that usually involve avoiding direct sunlight for weeks at a time. To perform a sophisticated, multi-stage cyber attack, one had to be a maestro of the digital realm, capable of navigating complex networks with the finesse of a concert pianist.

But times change, and so does the bar for entry. According to a recent and somewhat alarming report from Anthropic, the days of needing a doctorate in computer science to cause absolute mayhem are drifting away. It’s no longer just the highly trained elite who are running riot. The "script kiddie", the digital equivalent of someone who can barely boil an egg but is suddenly given a Michelin star kitchen is getting a massive upgrade.

The Great Equaliser

Anthropic’s research, which scrutinised 832 accounts banned for malicious activity between March 2025 and March 2026, paints a picture of a digital landscape that is becoming remarkably democratic. In the most chaotic way possible.

The findings are stark: 67% of these banned accounts were using AI to help craft malware. That is a significant chunk of the population. What is perhaps more fascinating, however, is the shift in how these tools are being utilised. We aren't just talking about AI generated phishing emails that still occasionally trip over their own grammar. We are talking about the deeper, nastier stuff.

"These sorts of post compromise techniques used to be restricted to actors with the technical knowledge to carry them out,"

the researchers noted.

"Our investigation shows that AI can now be made to perform these activities on behalf of less sophisticated actors."

Essentially, the AI is doing the heavy lifting, acting as a force multiplier for people who might otherwise struggle to figure out how to open the Windows Registry. It is like handing a power drill to a toddler and being surprised when they start redecorating the drywall.

Moving Beyond the Initial Knock

Historically, cyber attackers were focused heavily on the "initial access" phase. You know, the classic phishing email, the bait, the hook. It was the digital equivalent of trying to rattle every doorknob on a suburban street to see if any of them were unlocked. It required patience, and sometimes, a bit of luck.

Anthropic’s data suggests that the focus is shifting. While AI assisted phishing has actually seen a decline, there has been a 9% rise in the use of AI for account discovery the process of identifying valid, useful accounts once an attacker has already managed to stick a foot in the door.

This indicates that the bad guys are becoming far more comfortable once they are inside the house. They are using AI to rummage through the cupboards, identify the valuables, and figure out exactly where the master bedroom is. By applying AI deeper into the attack lifecycle, they are essentially outsourcing the complex, time consuming parts of the job to a machine that doesn't get tired, doesn't need a tea break and doesn't get distracted by the latest memes on social media.

When the Expert and the Amateur Look the Same

Perhaps the most unsettling part of the report is the blurring of lines between the high risk actors and the low risk hobbyists.

In the old days, you could often tell a professional actor from an amateur by the sheer complexity of their attack. A pro would use a diverse array of 20 or more distinct techniques to achieve their goal, while an amateur might bumble through with five or six. It was a clear, measurable metric of competence.

Today? Not so much. Anthropic found that the least skilled actors in their dataset were using about 16 distinct techniques on average, while the most skilled were using about 20. That is not a massive delta. When you look at the raw numbers, the amateurs are catching up at a frightening pace, largely because the AI is handing them the playbook and the tools to execute it.

Furthermore, there is no longer a "platform preference" that screams danger. Whether a bad actor is using Claude Code, a standard API, or a simple chat interface, the damage potential remains high. It is no longer about the gear you have in your rack, it's about the intelligence you have in your workflow.

Orchestrating Chaos

What really separates the seasoned pros from the newcomers is how they chain these techniques together. While an amateur might use AI to write a specific script, a more sophisticated actor uses AI to build an entire architecture of destruction.

They're creating systems that chain together discrete stages of an attack, initial access, privilege escalation, lateral movement, data exfiltration and they are doing it with minimal human intervention. They are basically building autonomous attack agents.

Consider the state sponsored operation that Anthropic flagged back in November 2025. A malicious actor successfully manipulated Claude Code into attempting to infiltrate targets across the globe. There was very little human input required for the day to day operations. It was a digital ghost, operating under its own steam, executing a complex series of moves that would have required a whole team of human operators just a few years ago.

The researchers at Anthropic noted:

"Clearly, focusing on the number of techniques this actor used underplays how dangerous they really were."

When you score that specific attack using their new risk scoring methodology, it hits the maximum of 100. Yet, if you look at it through the lens of traditional frameworks, it looks suspiciously similar to a medium risk actor. This is why we have a problem. Our frameworks are built for a world where every step of a cyber attack requires a human hand. We are living in a world where that hand is increasingly being replaced by an algorithm.

The MITRE ATT&CK Dilemma

This brings us to the thorny issue of the MITRE ATT&CK framework. For the uninitiated, MITRE ATT&CK is essentially the industry standard map for cyber attacks. It lists out the tactics and techniques that attackers use, helping defenders understand the playbooks they are up against.

It is a fantastic resource, but it is starting to feel a bit like a map of the world drawn before the invention of the aeroplane. It does a great job of listing individual techniques, but it struggles to capture the "AI enabled orchestrator."

If an attacker uses AI to automatically chain thirty different techniques together in real time, making decisions on the fly about what to do next based on the defences it encounters, where does that sit on the map? The current framework sees the individual steps, but it misses the symphony. It misses the fact that the entire performance is being conducted by an AI that doesn't need to pause for breath.

Anthropic is currently in talks with MITRE to address this. The goal is to evolve the framework to include these AI enabled behaviours, the automation, the real time decision making, and the recursive loops of activity. It is a necessary evolution, but it highlights just how quickly the floor is moving beneath our feet.

Can You Fix Stupid?

One has to wonder if the barriers to entry are disappearing, what happens next? Are we entering an age of perpetual, automated cyber skirmishing?

It's tempting to think of this as a purely technical issue, that we just need better firewalls, better AI, and better monitoring. But at its core, this is a problem of accessibility. We have created systems that are so powerful that they have become accessible to anyone with an internet connection and a vague sense of malice.

The "bar for entry" is effectively on the floor. It is being propped up by the very technology that was supposed to make our lives easier, our code cleaner, and our workflows more efficient. We are essentially living in a world where the power to cause systemic disruption is becoming a commodity service, available to anyone who knows which prompts to use.

The IT professionals and decision makers are now in a race. It is a race to build defences that can identify the orchestrated attack before it reaches the critical stages. It is a race to understand that a low skilled actor with a high powered AI is, for all intents and purposes, a high risk actor.

It’s a peculiar feeling, knowing that the digital walls we built are being tested not by masterminds, but by algorithms that are being coached by people who, until very recently, wouldn't have known where to start.

As we look toward the future of cybersecurity, we must consider whether we're defending against people, or whether we are defending against the tools that empower them. The distinction is becoming increasingly academic, and that is perhaps the most worrying realisation of all.

If an AI can now successfully chain thirty techniques across thirteen tactics with almost zero human oversight, how long will it be until the AI decides it doesn't need the human at all?