AI in the Cyber Kill Chain: Weapon or Target?

Where do adversaries actually use artificial intelligence today, where only in the lab, and what does this mean for prioritizing defense? This whitepaper filters the publicly available evidence through the 14 tactics of MITRE ATT&CK and separates two questions that are constantly mixed up in the debate: how well a use is documented, and who is capable of it today.

Audience

CISOs, heads of IT, management (Germany, Austria, Switzerland)

Methodology

MITRE ATT&CK v18, MITRE ATLAS v5.6, Threat-Informed Defense

Classification

TLP:CLEAR, sharing permitted

Evidence as of

September 17, 2026, version 2.0

Sources

Anthropic, MITRE ATT&CK (Campaign C0062), MITRE ATLAS 5.6, Google Threat Intelligence Group, Czybik et al. (USENIX Security 2026), Heiding et al. (2024), Agencia Española de Protección de Datos

Defending efficiently against cyberattacks requires aligning with real adversary behavior. This analysis applies the perspective of Threat-Informed Defense to the use of artificial intelligence. The MITRE ATT&CK framework serves as the vocabulary for the phases of an attack, MITRE ATLAS for attacks on AI systems. The two questions, how well a use is documented and who is capable of it today, are assessed separately.

Evidence: how well is the use documented?

Documented means documented multiple times or independently. Isolated means observed in the field in individual cases. Lab means shown only under test conditions.

Zone: who is capable of it today, and whom does it affect?

Zone 1 is the mass market, cheap and scaling. Zone 2 is well-resourced actors with repeated use. Zone 3 is individual campaigns that cannot be repeated at scale.

A tactic can be documented through two state actors and still be Zone 3. Conversely, a technique without field evidence remains outside the zones, even if it looks impressive in the lab.

Before analyzing adversary tactics, a conceptual blur must be resolved. In strategic discussions, AI as the adversary’s tool is regularly equated with AI as the target of an attack. Anyone who wants to protect their own AI systems needs a different threat model (MITRE ATLAS) from anyone defending against an actor who uses AI to prepare a classic attack (MITRE ATT&CK).

The two perspectives meet at one point, and the case study below shows it: the adversary first had to defeat the model’s safeguards (ATLAS: LLM Jailbreak) before being able to use it as a tool against third parties (ATT&CK: Obtain Capabilities, Artificial Intelligence).

Corrected compared with version 1: in ATLAS, prompt injection is not an initial access technique. Plugin Compromise no longer exists as a separate technique in ATLAS 5.6 and has been removed. Model extraction is listed under Exfiltration, not under Model Access.

When analyzing AI as a weapon of adversaries, the industry relies predominantly on reports from commercial AI providers about suspended accounts. A considerable survivorship bias comes into play here. When providers show in detailed transparency reports how they stop activities ranging from cyber operations to weapons development, this mainly proves the existence of that filter. Inevitably, the actors that become visible are those careless enough to use monitored cloud interfaces with complete logging.

That professional actors switch to local models is not a guess. The phishing study cited below ran entirely on locally operated open-source models, and the PROMPTSTEAL malware documented by Google queries an open model via a Hugging Face interface. The evidence is nevertheless sufficient for a structured categorization. In Threat-Informed Defense, the rule is: not observed means exactly that, namely not observed. It does not mean impossible.

In September 2025, Anthropic discovered an espionage operation that the company attributes with high confidence to a Chinese state actor and refers to as GTG-1002. MITRE lists it as Campaign C0062. It is the first documented campaign in which an adversary had an AI agent system carry out the tactical work of an intrusion. Of around 30 targeted organizations, a handful were successfully compromised according to Anthropic’s validation.

Humans were not absent but present at four decision points. It is exactly these points that define what autonomous meant in this campaign.

Initialization

Setting up the cover identity and the prompts used to get the model to cooperate in a supposedly authorized security test.

Reconnaissance to exploitation

Approval of the transition from passive reconnaissance to active exploitation of vulnerabilities found.

Credentials to movement

Approval of stolen credentials for lateral movement in the network.

Data exfiltration

Final decision on which data is exfiltrated.

The most important finding for defense is in Anthropic’s own report, and it puts the headline into perspective.

The case thus proves two things at once. Autonomous attack chains are no longer theory. And they do not scale yet, because every result had to be validated by humans. Both feed into the matrix.

The overview arranges the 14 ATT&CK tactics chronologically. Each row names the observed AI use, the evidence level, the source and the zone. The shape of the curve is the message: documented scaling at the beginning of the chain, individual cases in the middle, gaps exactly where the hype is loudest.

Two gaps are a finding in themselves. For privilege escalation and command and control, precisely the stages on which the narrative of the fully autonomous attack hinges, there is still no documented AI-related ATT&CK technique. Campaign C0062 managed without either, because the stolen credentials were sufficient.

Two independent studies describe the same effect from two directions. The Harvard study by Heiding, Schneier and colleagues measures the effect: in an experiment with 101 participants, fully automated AI emails achieved a click rate of 54 percent, exactly the level of human experts. The control group with generic phishing was at 12 percent. AI does not outperform the expert. It replaces them.

The study by BIFOLD, TU Berlin, Inria and Ruhr University Bochum measures the price of this replacement with 4,010 real recipients.

The click rates in this study are lower than at Harvard: 3.9 percent generic, 10 percent AI-personalized, 24.2 percent for human experts. The difference lies in the study design, not in the finding. Both studies show that AI approaches the effect of human work at a fraction of the cost. The last figure is the most important for defense: if only one out of almost 4,000 emails stands out technically, the email itself is no longer a detection feature.

In November 2025, Google documented for the first time malware that queries a language model during execution. PROMPTSTEAL, tracked by CERT-UA as LAMEHUG, has an open model generate the commands for system reconnaissance and document collection instead of carrying them hard-coded. The actor is APT28, and the use took place against Ukrainian targets. This is not a demonstration but a tool in operation.

The second observation comes from a supervisory authority. On September 15, 2026, the Spanish data protection authority AEPD reported the first personal data breach notified to it that was carried out by an AI agent. The agent found vulnerabilities in files, logged in, independently searched for further vulnerabilities in the application, modified personal data and accessed invoices. The information comes from the notification by the affected organization and has not yet been fully verified by the authority. The route is remarkable: the case was not discovered by a vendor but reported as a regular incident under Art. 33 GDPR.

Both cases involve reconnaissance and data collection. That is no coincidence. These are the phases in which an agent can do the least wrong and in which hallucinations cost the least.

Persistence, credential theft, lateral movement and data exfiltration are documented in the field through C0062, each as an isolated case. At the same time, the campaign shows why this does not yet become a mass phenomenon. The adversary had to verify every claim the model made, because it reported credentials that did not work and rated findings as critical that were publicly known. With around 30 targets, the outcome was a handful of successful intrusions, and the effort required matched that of a state program.

Version 1 of this paper called this zone a lab illusion. That was wrong. The tactics exist in the field. What is true is that today they depend on three conditions that hardly any actor meets at the same time: access to a powerful agent system without effective safeguards, the resources for continuous human validation, and targets whose value justifies this effort.

For privilege escalation and command and control, even this isolated case is missing. Anyone who aligns their investments with these two stages is planning against something nobody has observed.

AI does not make the impossible possible, but it makes the known drastically cheaper and faster. Both incidents documented in 2026 confirm this: they were not novel exploits but well-known attack paths, carried out at a speed and cost that were previously unattainable.

This leads to a clear prioritization. Zone 1 affects every company, today, with tools that cost three cents and no longer trigger any filter. Zone 2 affects companies in the sights of well-resourced actors. Zone 3 affects hardly anyone today but will be tomorrow’s Zone 2 as soon as the models become more reliable.

Defense must therefore focus primarily on Zone 1 and Zone 2, where AI gives the adversary real economies of scale. Specifically, this means: a second factor on every remote access, because personalized phishing reliably defeats the first factor. Detection that does not rely on the quality of the language but on behavior after the click. And visibility of automated reconnaissance in your own network, because that is where Zone 2 begins.

Zone 3 belongs in monitoring and in crisis team exercises, not in investment planning. Anyone who ignores it will miss the moment it scales. Anyone who prioritizes it ahead of Zone 1 loses to everyday reality. If you cannot handle Zone 1, you will never experience Zone 3, because the adversary does not need it.