Despite what we saw with OpenAI\u2019s models going rogue, creating message boards, and breaking into Hugging Face, only one advanced AI model – Anthropic\u2019s Claude Mythos – completed the full cyber kill chain autonomously in Booz Allen\u2019s tests.<\/p>\n
This doesn\u2019t mean autonomous AI attacks are overhyped. And we should point out that the models tested don\u2019t include OpenAI\u2019s soon-to-be-released Astra, which OpenAI on Tuesday said reached its \u201ccritical\u201d cybersecurity capability threshold<\/a>. This means the new model is so good at finding and exploiting zero-day bugs that it poses a significant risk to critical systems, both from malicious users and even from the model itself, which is capable of carrying out harmful cyber actions \u201cif misaligned.\u201d<\/p>\n Booz Allen asserts that most of the other 17 US and Chinese models it tested will achieve Mythos\u2019 same level of weaponization within six months, and it calls mainstream AI attacks from both financially motivated criminals like ransomware gangs and government-backed goons \u201cimminent.\u201d<\/p>\n In its first-ever Cyber Weapon Index<\/a>, the consulting and tech firm calls on the US to set and enforce sector-specific deadlines for critical infrastructure to demonstrate resilience<\/a> against AI-enabled attacks<\/a>. Booz Allen also calls on the US to develop what it calls \u201covermatch\u201d for both cyber offense and defense.<\/p>\n \u201cWe must aggressively develop agentic capabilities that accelerate authorized offensive cyber operations while simultaneously building AI-enabled defenses that detect, decide, and respond at machine speed,\u201d the report says. \u201cThe strategic opportunity is to master both – giving the United States the ability to impose costs on adversaries while making US systems faster to defend, harder to compromise, and more resilient when attacked.\u201d<\/p>\n The Cyber Weapon Index evaluated 18 models, nine from American and nine from Chinese developers, under identical conditions, and scored them on how well they autonomously identify vulnerabilities, create offensive capabilities, and execute attacks. Each model\u2019s CWI score combines its vulnerability research score (VRS), which measures whether a model can identify planted and\/or novel vulnerabilities, and a kill chain attainment score (KCAS), which awards points based on how far a model progresses through an end-to-end intrusion, tested both with and without credentials.<\/p>\n Cyber Weapon Index scores<\/p>\n The 18 models, ranked from highest to lowest based on their CWI score, are: Anthropic\u2019s Claude Mythos (80), xAI\u2019s Grok-4.5 (49), OpenAI\u2019s GPT-5.6 Sol (46), Meta\u2019s Muse Spark 1.1 (38), Moonshot AI\u2019s Kimi K3 (38), Z.ai\u2019s GLM-5.2 (37), Anthropic\u2019s Claude Opus 4.8 (36), OpenAI\u2019s GPT-5.5-Cyber (34), Nvidia\u2019s Nemotron-Ultra (33), DeepSeek-V4-Pro (23), DeepSeek-V4-Flash (17), Alibaba\u2019s Qwen3.5-397B (17), MiniMax-M3 (15), Nvidia\u2019s Nemotron-Super (15), Anthropic\u2019s Claude Sonnet 5 (13), Z.ai\u2019s GLM-4.5-Air (11), Alibaba\u2019s Qwen3.6-35B (9), and Alibaba\u2019s Qwen3-Coder (4).<\/p>\n Claude Mythos\u2019<\/a> performance was especially impressive or concerning, depending on one\u2019s views of autonomous AI attacks<\/a>. When the testers gave the model stolen employee credentials, it successfully broke into its target network and gained administrator-level control in every attempt. Plus, it independently identified how to gain higher-level access based on what it found within the network – not by following a predetermined attack plan.\u00a0<\/p>\n Even without credentials, Claude Mythos still gained access to the network and ultimately achieved full domain compromise.<\/p>\n While only Claude Mythos executed the entire cyber kill chain without any human assistance, three other models – Grok-4.5, Muse Spark 1.1, and GLM-5.2 – reached full domain access and control. Four others – GPT-5.6 Sol, Kimi K3, GPT-5.5-Cyber, and DeepSeek-V4-Pro – achieved lateral movement across the controlled network environment.\u00a0<\/p>\n Claude Opus 4.8 and Qwen3.5-397B obtained credentials, which allowed the models to expand access and privileges. And all but one – Qwen3-Coder – autonomously gained initial access to the network.<\/p>\n While advanced models are exceedingly good at offensive cyber capabilities, \u201ctheir real-world impact depends heavily on the vulnerabilities they face and the systems built around them,\u201d according to the report.\u00a0<\/p>\n When the testers intentionally introduced vulnerabilities, US, Chinese, open-weight, and closed models all scored near ceiling on the VRS component. When tested against real bugs, however, all nine of the frontier API models scored zero. One unnamed leading model even correctly analyzed the vulnerable component, but then dismissed it as safe. Only Claude Mythos exploited it.\u00a0<\/p>\n \u201cThat concentration of capability creates a national-security imperative: protect the most advanced models and prevent their highest-risk cyber capabilities from being operationalized by adversaries,\u201d the authors wrote.\u00a0<\/p>\n This is one of the areas where defenders still have an opportunity to outpace the attackers, Booz Allen suggests: \u201cReal-world offensive capability still trails benchmark performance, giving defenders valuable time to strengthen defenses before that gap closes.\u201d<\/p>\n Why attack harnesses matter<\/p>\n Another interesting finding is that the attack harness matters at least as much as, if not more than, the model itself. The attack harness – this is the software that connects a model to hacking tools and the orchestration logic wrapped around the artificial intelligence model to automate offensive cyber actions – can \u201cdramatically amplify\u201d the model\u2019s ability to stay focused, adapt and change course as needed, recover from failure, and chain individual actions into a multi-stage attack, the authors found.<\/p>\n \u201cThe result is not a \u2018smarter\u2019 model but rather a system that makes its intelligence far more actionable while also lowering the expertise required to use it,\u201d the report says. \u201cOur testing demonstrates the effect: when paired with an attack harness, Claude Sonnet rivaled Claude Mythos\u2019 performance.\u201d<\/p>\n However, it also exposes a blind spot, they note. \u201cWe do not yet know the full kill-chain capability of open-weight or Chinese models when paired with optimized harnesses, but our results strongly suggest that fully capable model-and-harness combinations exist today,\u201d according to Booz Allen.<\/p>\n Similarly, the index\u2019s findings suggest that Chinese frontier and open-weight models, while still trailing leading American frontier models, aren\u2019t that far behind in their offensive security skills and could be deployed in real-world attacks. <\/p>\n This means \u201cthe United States may neither control nor fully understand the capabilities it could face,\u201d the report says. \u201cAnd, as cyber agents become more autonomous, defenders must prepare not only for deliberate attacks but for agents that exceed their intended mission or continue operating beyond an adversary\u2019s control.\u201d\u00ae<\/p>\n","protected":false},"excerpt":{"rendered":"Despite what we saw with OpenAI\u2019s models going rogue, creating message boards, and breaking into Hugging Face, only…\n","protected":false},"author":2,"featured_media":604391,"comment_status":"","ping_status":"","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[20],"tags":[345,343,344,85,46,125],"class_list":["post-604390","post","type-post","status-publish","format-standard","has-post-thumbnail","category-artificial-intelligence","tag-ai","tag-artificial-intelligence","tag-artificialintelligence","tag-il","tag-israel","tag-technology"],"_links":{"self":[{"href":"https:\/\/www.newsbeep.com\/il\/wp-json\/wp\/v2\/posts\/604390","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.newsbeep.com\/il\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.newsbeep.com\/il\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.newsbeep.com\/il\/wp-json\/wp\/v2\/users\/2"}],"replies":[{"embeddable":true,"href":"https:\/\/www.newsbeep.com\/il\/wp-json\/wp\/v2\/comments?post=604390"}],"version-history":[{"count":0,"href":"https:\/\/www.newsbeep.com\/il\/wp-json\/wp\/v2\/posts\/604390\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/www.newsbeep.com\/il\/wp-json\/wp\/v2\/media\/604391"}],"wp:attachment":[{"href":"https:\/\/www.newsbeep.com\/il\/wp-json\/wp\/v2\/media?parent=604390"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.newsbeep.com\/il\/wp-json\/wp\/v2\/categories?post=604390"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.newsbeep.com\/il\/wp-json\/wp\/v2\/tags?post=604390"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}