Sophistication stopped identifying the operator. Detection has to score the workflow.

Anthropic says the operating model it associated with a suspected state-sponsored autonomous campaign in November 2025 has now spread across every class of cyber actor it investigated. Its September 2026 threat report covers operations disrupted from December 2025 through August 2026, including state-linked groups, financially motivated criminals and politically motivated individuals.

The operational consequence is sharper than another warning that attackers use AI. Anthropic concludes that sophistication is no longer a reliable signal of who sits behind an intrusion. AI can supply reconnaissance, tool development, exploitation and data processing that previously implied a larger, more specialised team.

Tradecraft quality is becoming cheaper

Anthropic reports that a majority of the cyber operations it describes used AI for direct execution or orchestration, not only conversational assistance. Multi-agent frameworks performed reconnaissance, exploitation and data exfiltration while humans retained decisions such as target selection and review of stolen data.

The report also describes public offensive-agent frameworks reproducing much of the same scaffolding. That changes the economics of attribution. A small operator can inherit planning loops, parallel execution and specialist-like workflows without building an equivalent human team.

When sophisticated tradecraft can be rented from a model, sophistication stops being a dependable proxy for the sophistication of the operator.

Detect the orchestration layer, not just the payload

Anthropic's cases remain grounded in familiar intrusion mechanics: stolen credentials, exposed services, unpatched edge devices, SQL injection and phishing. What changed was the speed and coordination around them. The report describes breaches completed in two to three hours and individual operators handling dozens of victims in parallel.

SOC detections should therefore add workflow signals to conventional indicators. Correlate rapid reconnaissance across unrelated assets, repeated tool creation or mutation, machine-paced transitions between discovery and exploitation, and parallel victim handling under the same infrastructure or identity. Static malware signatures still matter, but they no longer describe the whole operating system of the attack.

Separate capability assessment from actor attribution

Threat-intelligence teams should record two judgements independently: what the intrusion demonstrated and what evidence supports attribution. A technically polished chain may justify a high capability rating without justifying a state-level actor label. Conversely, weak initial access can feed an automated workflow that becomes operationally fast and broad.

The practical change is to revisit analytic confidence models. Reduce the weight assigned to code quality, task breadth and execution speed when those features can plausibly come from commodity agent scaffolding. Increase the weight of infrastructure history, targeting logic, operational security mistakes, language evidence, access patterns and independently corroborated links.

AI is compressing the labour cost of cyber operations, not erasing attribution. Defenders should keep measuring sophistication, but treat it as a property of the observed workflow rather than an identity card for the person or organisation running it.

Written by the Devence Lab research team.