AI models' cybersecurity capabilities advance faster than safety benchmarks
The UK AI Security Institute found that Claude Mythos and GPT-5.5 have rapidly advanced in autonomous cybersecurity capabilities, solving previously unsolved cyber range tasks and doubling in capability every 4.7 months—faster than safety institute benchmarks can measure. Researchers warn this acceleration suggests a growing potential for AI cyber tools to pose practical real-world threats.
What happened
The UK AI Security Institute tested a newer version of Claude Mythos and found it completed both cyber ranges, solving 'The Last Ones' in 6 of 10 attempts and 'Cooling Tower' in 3 of 10 attempts—the first time any model completed the second range.
AISI found that the length of cyber tasks AI models could complete doubled every 4.7 months since late 2024, accelerating from an 8-month doubling rate estimated in November 2025, causing the evolution to outpace the institute's measurement benchmarks.
Reported impact
AISI noted that AI models are rapidly advancing in their ability to handle cyber tasks with serious implications for cybersecurity, especially given the models' capability for detecting software vulnerabilities.
The pace of evolution suggests growing capacity for AI cyber tools to materialize in practical threats.
Index analysis
Models' cyber capabilities reached the ceiling of what AISI's test suite could calculate at an 80 percent success rate, indicating the benchmarks could no longer track the rate of advancement.
Governance controls
AISI conducted testing under conservative circumstances with limitations, including a 2.5 million token limit per task.
Classification
Sources and evidence
This record was researched and written by the Index, based on the following original reporting.