Attackers Aren’t Using AI to Move Laterally: Here's Why

TL;DR

• Anthropic’s Attack Navigator data shows AI-assisted lateral movement at just 6.5% of tracked threat actors, well below defense evasion (84.4%), malware development (69%), and data harvesting (55.9%).

• Attackers are using AI to get in and stay hidden. They aren’t using it to move around because your network makes that part easy.

• The 72-hour cloud environment compromise documented by Infosecurity Magazine wasn’t sophisticated AI tradecraft. It was a flat environment in AWS with misconfigured permissions and exposed secrets.

• The absence of AI lateral movement is not good news; it’s an indictment of network architecture.

• The structural answer is Communication Governance: define what workloads can talk to, enforce it at the network layer, and shrink the Blast Radius before the attacker ever arrives.

We have spent the last two years bracing for the AI-powered attacker: autonomous agents hopping through networks, chaining exploits at machine speed, and outpacing every defender. The threat research community has been watching carefully. And what Anthropic’s Attack Navigator research actually found is both less alarming and more damning than the hype suggested.

Less alarming: AI-assisted lateral movement is nearly nonexistent. Only 6.5% of tracked threat actors used AI to support movement through a compromised environment. Compare that to 84.4% using it for defense evasion and 69% using it for malware development. The dangerous stuff is happening before the attacker even touches your environment.

More damning: the reason attackers aren’t reaching for AI to navigate compromised networks is that they don’t need it. They are finding the network is already flat enough that a human can walk it. When something is easy, you don’t automate it. Necessity is the mother of invention, and the network isn’t putting up much of a fight.

What the Data Actually Says

Anthropic’s research is the most rigorous public dataset we have on how threat actors are actually using AI-assisted capabilities in operations. The findings are precise: threat actors are using AI heavily for the phases where effort is high and repetition is grinding. Coding malware, writing obfuscation wrappers, scanning for defensive coverage gaps. The pre-intrusion and initial access phases are where AI is earning its keep.

Post-compromise is a different story. Lateral movement sits at 6.5%. Privilege escalation is at 22.5%. Real-time decision-making inside a live environment barely registers. The researchers note specifically that “cloud infrastructure attacks, Kerberos exploits, and container escapes show notably lower representation.”

The one place AI-assisted lateral movement does appear, it is alarming for a different reason. The small cohort of actors who do use AI for lateral movement averaged a risk score 10.5 points higher than those who don’t, with an average score of 56.4 against a dataset mean of 46.8. These are the most capable threat actors in the dataset, and when they do use AI for movement, it is because they are operating in environments that actually require it. That means the other 93.5% found environments that didn’t.

What that means for your environment is worth sitting with. The AI-enabled attacker that arrives at your perimeter today is better equipped than the one from two years ago. The malware is cleaner, the obfuscation is tighter, and the initial access is faster. Every phase before the attacker sets foot inside your environment has been optimized. Then they get inside, and the optimization stops, because it doesn’t need to continue.

If your first real detection opportunity is post-compromise, and the attacker doesn’t need any additional capability to move freely once they’re in, the question of “did we detect the AI-assisted attack” is already the wrong question. The attacker arrived with better tools and found the same open floor plan. The tools are not the problem you need to solve.

Flat Networks Don’t Need to Be Hacked. They Just Need to Be Entered.

The 72-hour cloud environment compromise reported in Infosecurity Magazine illustrates the dynamic clearly. An attacker used agentic AI to execute four concurrent workstreams inside an AWS environment: credential theft, persistence, data exfiltration, and destructive impact. Instead of navigating a complex network, the AI was automating a checklist in an environment that had already handed over the keys.

The root cause was not a zero-day or an advanced technique. It was, in the researchers’ words, “control gaps in secrets management, identity governance, deployment workflows, and cloud permissions.” The attacker didn’t need AI to move laterally because there was no lateral to speak of. Every workload could reach every other workload. Every service had broader permissions than it needed. The flat network did the attacker’s job for them before they wrote a single line of agent code.

This is the pattern I have seen across IR engagements for two decades. Attackers are efficient. They use the minimum effort required to achieve their objective. If your environment makes lateral movement trivial, they will do it manually, quickly, and without breaking a sweat. The complexity of the lateral movement phase is a direct reflection of how much resistance the network provides.

Right now, it is providing very little.

Good AI, Bad AI. Can Your EDR Tell the Difference?

Anthropic’s data tells us what attackers are doing with AI before they ever touch your environment. They are building better tools: cleaner malware, tighter obfuscation, faster initial access. The weapon arrives more capable than it used to. But what happens at the endpoint once it does?

Sophos’s analysis covered by The Hacker News answers that question, and the answer is uncomfortable. We can’t tell good AI from bad. That finding puts two distinct problems on the table. They are related but not the same, and both of them point to the same conclusion.

1. The first problem is pace. AI is enabling attackers to develop, vary, and deploy techniques faster than detection engineering can respond. The window between “new technique in the wild” and “detection rule in production” has always been where defenders lose. AI compresses the attacker’s iteration cycle without compressing the defender’s. The attacker can generate new malware variants, new obfuscation wrappers, new evasion logic at a rate no threat intel pipeline matches. Writing more rules just means you are always one step behind on a treadmill that keeps accelerating.

2. The second problem is identity. AI coding agents are triggering enterprise detection rules designed to catch human attackers, because they are doing exactly what human attackers do: accessing credential stores, using legitimate system tools to avoid detection, establishing persistence. Credential access accounted for 56.2% of blocked activity in Sophos’s analysis. Agents are decrypting browser-stored credentials using Windows’ built-in credential decryption API. They are enumerating stored credentials. They are writing persistence scripts to startup folders. The research isn’t about threat actors, but legitimate developer tools.

And when Sophos notes that “decrypting browser credentials does not become safe because an agent did it instead of a person,” they are describing a friend-from-foe problem that no detection rule can cleanly solve.

This is not a new problem with a new name. Living-off-the-land techniques have been eroding detection fidelity for years. Attackers using built-in system utilities to download payloads, enumerate credentials, and maintain persistence: all legitimate tools, all abused, all generating alerts that look identical to normal administrative activity.

The security industry’s answer has been to write more detection rules, tune more thresholds, and hire more analysts to triage the output. The result is exactly what you would expect: overwhelmed SOC teams, alert queues that can’t be cleared, critical signals buried under noise, and burnout rates that are quietly hollowing out the analyst workforce.

AI didn’t create that problem. It inherited it, and it is making it structurally worse. If a sophisticated EDR platform with years of behavioral training data cannot reliably distinguish an AI coding agent from a threat actor, a tired analyst working their fourth consecutive twelve-hour shift is not going to close that gap. Sophos is one of the best in the business. If they are struggling to tell friend from foe in a one-week window of agent activity, the answer cannot be “detect it better.” Detection is already at capacity on both problems. The only way out is to reduce what there is to detect.

If benign AI agents are already indistinguishable from attackers at the endpoint, what happens when threat actors begin applying the same agentic orchestration to lateral movement at scale? Anthropic’s research identifies agentic orchestration as the highest-risk multiplier, not technique volume or raw sophistication. The GTG-1002 espionage campaign, a nation-state actor tracked in Anthropic’s research, achieved a perfect risk score of 100 by autonomously chaining dozens of AI tool operations across cloud services, not by doing anything individually novel.

The 6.5% figure reflects where the effort-to-reward ratio is today. The moment your network stops being free real estate, the calculus changes. You want to create that friction before the calculus changes, not after.

Think about what that board conversation looks like when it does change. Right now, a CISO can stand in front of their board and say “we have no evidence of AI-assisted lateral movement in the wild.” That is a true statement today, but it has an expiration date. The organizations that waited for detection-era tooling to catch up to the AI threat in previous cycles know how that story ends: the tooling never quite catches up, the attacker iterates faster than the defender, and the post-incident review identifies a gap that had been visible for years.

Building Communication Governance after AI-assisted lateral movement becomes common is the same mistake, in the same sequence, with a shorter recovery window. The organizations that close this now will have a different board conversation: not “we detected it,” but “the path didn’t exist.”

Four Questions for Your Next Architecture Review

The goal isn’t to add another detection layer. Detection is already struggling to keep pace, and the Sophos data makes clear that agent-generated activity is eroding the signal quality defenders depend on. The goal is to reduce what an attacker can reach from any given starting point, so that the question of AI-assisted movement becomes less relevant.

What can each workload communicate with, and why? This is a question of network-layer communication. If you can’t answer this question for your cloud environment in the next ten minutes, that is the answer. Workload communication should be intentional and explicitly permitted, not open by default with exceptions carved out after something goes wrong.

What is the Blast Radius of your highest-privilege service account? The 72-hour compromise moved fast because high-privilege credentials were reachable inside a flat cloud environment and the permissions attached to them were broad. Map from credential to reachable resources, not from resource to required permissions. The attacker’s view is what matters.

What does your network tell you about workload-to-workload communication today? Not alerts. Baselines. If you have no behavioral baseline for workload-to-workload communication, you cannot distinguish the beginning of a lateral movement chain from normal operations. You will only see it when the damage is done.

Where are your communication paths governed versus assumed? Governance means defined, documented, and enforced at the network layer. Assumed means “we haven’t had a problem yet.” In a flat cloud environment, assumed communication paths are the attack paths. There is no meaningful difference.

Bottom Line

Anthropic’s data tells us that lateral movement is so easy right now that they haven’t needed to automate it yet. That is a more urgent finding than any risk score.

The organizations that are not watching a threat actor chain through their environment in 72 hours have one thing in common: they have invested in Communication Governance. They know what workloads talk to what. They have enforcement at the network layer that isn’t dependent on detecting attacker behavior. They have reduced the Blast Radius of any single compromise before the attacker arrives.

This is the Containment Era: a structural commitment to making lateral movement expensive before it begins. The payload evolves, but the network path requirement does not.

See what attack paths exist in your environment today with the free Workload Attack Path Assessment.

Stay current on what attackers are doing with the research we publish at the Aviatrix Threat Research Center.