CYBERUK 2026 Tech Talk - This is not a forecast: AI-enabled cyber, twelve months on

Threat Landscape Shift

An Anthropic threat researcher reviews practical criminal AI abuse evolving through 2025—from hypothetical harms to operational cases across Claude and peer models. Three case studies illustrate accelerating capability and autonomy.

March: No-Code Ransomware

A UK script-kiddie used Claude chat-style Q&A to build and market ransomware-as-a-service, copying generated code without deep expertise—AI as enhanced search/documentation.

May: Hands-on-Keyboard Extortion

A Russian-speaking actor used Claude Code to run a 17-target data extortion campaign. Claude drafted recon to-do lists (subdomain enum, credential harvest, VPN probe, lateral movement, exfiltration) and executed steps, pricing ransoms ($75k–$500k BTC) and writing tailored notes—one operator at small-team scale.

September: Autonomous Intrusion Harness

A suspected Chinese APT built a click-to-run agent chaining MCP tool calls for recon, scaled pentesting, supervised exploitation, and lateral movement against hardened targets—human supervisors validating findings while AI performs tactical work. The pace from copy-paste to autonomous workflows defines the emerging AI-enabled cyber threat.