AI-Driven Attacks Push MITRE ATT&CK Toward Autonomous, Agentic Orchestration

A year-long study of 832 accounts abusing AI for cyber operations maps 482 MITRE ATT&CK sub-techniques across all tactics, revealing rising risk and a shift from mere technique counts to orchestrated, autonomous attacks. The researchers introduce the LLM ATT&CK Navigator and the ARiES risk score, showing high-risk actors rely on agentic scaffolding to chain techniques and operate with limited human input. The findings urge expanding ATT&CK to capture AI-native behaviors, and inform enhanced defenses, real-time safeguards, and collaboration with Verizon and MITRE to keep threat vocabularies pace with AI-enabled threats.