AI Narrows Skill Gap, Enables Advanced Crypto Hacks

Anthropic’s Frontier Red team reviewed 832 accounts banned between March 2025 and March 2026 for carrying out cyberattacks using AI tools. The report finds AI is performing advanced tasks for users with limited technical skill, weakening the link between an attacker’s expertise and the level of threat they pose.

The least-skilled actors in the sample averaged about 16 distinct techniques per case, while the most skilled averaged about 20. The report found no consistent connection between the platform used-Claude Code, an API, or a chat interface-and attacker risk. The share of actors classified as medium risk or higher rose from 33% in the first half of the study period to 56% in the second half.

Across the attack life cycle, AI-assisted phishing declined by 8.6%, while AI-assisted account discovery inside compromised networks increased by 8.9%. The report documents AI being applied to operationally demanding techniques such as privilege escalation, lateral movement and account discovery, tasks that previously required higher technical ability.

Among the 832 banned accounts, 67.3% used AI to assist in malware development and 6.5% used AI to support lateral movement within compromised systems.

The Frontier Red team wrote, “Now that AI can perform highly technical tasks on an actor’s behalf, there’s little correlation between the skill of a threat actor and how many techniques they use.” The team added that where in the attack life cycle actors apply AI can help identify higher‑risk behavior, but that this signal is weakening.

The report highlights implications for the cryptocurrency industry and notes that 40 major hacks were recorded in May 2026. Anthropic presents the findings as operational patterns intended for security teams and organizations that monitor exchanges, protocols and digital wallets.

The analysis is based on patterns observed across the banned accounts and includes percentages on AI use in malware creation and lateral movement, plus shifts in the distribution of risk categories between March 2025 and March 2026.