Key Takeaways
- • Anthropic's Claude Mythos Preview and OpenAI's GPT-5.5 have exceeded all existing autonomous cybersecurity benchmarks tracked by the UK's AI Security Institute (AISI) and Palo Alto Networks, surpassing previously established doubling trends in AI capability advancement.
- • The AISI's cyber ranges demonstrated a capability leap: Claude Mythos Preview became the first model to complete both simulated multi-stage attack scenarios, solving a 32-step corporate network attack ("The Last Ones") in 6 of 10 attempts and completing "Cooling Tower" (previously unsolved by any model) in 3 of 10 attempts.
- • AI-driven cybersecurity task completion timelines have accelerated dramatically—frontier models' 80% reliability cyber time horizon (measuring autonomous task length relative to human expert performance) has doubled approximately every five months as of early 2026, down from the eight-month doubling cycle estimated in November 2025, suggesting either an isolated capability jump or the start of a faster advancement trajectory.
- • AI involvement in security breaches reached 83% across surveyed organizations in 2026, while AI-driven network traffic nearly tripled in 2025, with AI agent traffic growing 7,851%, according to HUMAN's benchmark analysis of over one quadrillion interactions.
- • The capability surge reflects fundamental shifts in both offensive and defensive AI deployment: attackers now automate phishing campaigns and advanced malware generation, while defenders face mounting pressure to operationalize AI-driven cybersecurity capabilities at enterprise scale.
Summary
Two of the most advanced artificial intelligence models—Anthropic's Claude Mythos Preview and OpenAI's GPT-5.5—have significantly surpassed the already-accelerating pace at which autonomous AI systems are completing cybersecurity tasks, according to separate findings published in May 2026 by the United Kingdom's AI Security Institute and Palo Alto Networks. The breakthrough represents a material inflection point in frontier AI capability advancement, with both models exceeding previously established trend lines that researchers had been tracking for estimating AI autonomy in cyber operations.
The AISI, which conducts pre-deployment evaluations of frontier AI models on behalf of the British government, documented substantial capability gains through structured cyber range simulations—multi-stage attack scenarios against small, undefended enterprise networks. Claude Mythos Preview achieved a notable first by completing both of the institute's benchmark scenarios: it solved "The Last Ones," a 32-step simulated corporate network attack, in 6 of 10 attempts, and completed "Cooling Tower"—a previously unsolved challenge—in 3 of 10 attempts. The significance of these results lies not merely in task completion, but in the acceleration timeline: the AISI had estimated that frontier models' 80% reliability cyber time horizon (a measure of how long a task takes relative to human expert performance, used as a proxy for autonomous capability) had been doubling approximately every five months as of early 2026. This represented a compression from the eight-month doubling cycle the institute measured in November 2025. Whether these results indicate an isolated capability jump or signal the beginning of a new, faster advancement trajectory remains unclear.
The acceleration of autonomous AI cybersecurity capability coincides with parallel findings on the threat landscape. According to Gigamon's 2026 Hybrid Cloud Security Survey, AI was involved in 83% of security breaches across more than 1,000 surveyed organizations. HUMAN's 2026 benchmark report, analyzing over one quadrillion network interactions, found that AI-driven traffic nearly tripled in 2025, with AI agent traffic growing 7,851%. The threat environment has evolved beyond traditional cyberattacks: attackers now leverage AI to automate phishing campaigns and generate advanced malware variants, forcing enterprises to confront both accelerating attacker capabilities and the organizational complexity of deploying AI-driven defensive systems at scale.
The capability compression raises critical questions for enterprise security operations and capital allocation. AI performance is reaching new heights, but enterprise control mechanisms and organizational trust in autonomous systems are struggling to keep pace. Palo Alto Networks and Anthropic's Project Glasswing initiative represent attempts to address this asymmetry by securing critical software infrastructure in preparation for an AI-driven cybersecurity era. The central challenge for institutional stakeholders is clear: the time horizon for deploying effective AI-driven cybersecurity defense has contracted materially, while operational risk from capability gaps has expanded correspondingly.
The AISI, which conducts pre-deployment evaluations of frontier AI models on behalf of the British government, documented substantial capability gains through structured cyber range simulations—multi-stage attack scenarios against small, undefended enterprise networks. Claude Mythos Preview achieved a notable first by completing both of the institute's benchmark scenarios: it solved "The Last Ones," a 32-step simulated corporate network attack, in 6 of 10 attempts, and completed "Cooling Tower"—a previously unsolved challenge—in 3 of 10 attempts. The significance of these results lies not merely in task completion, but in the acceleration timeline: the AISI had estimated that frontier models' 80% reliability cyber time horizon (a measure of how long a task takes relative to human expert performance, used as a proxy for autonomous capability) had been doubling approximately every five months as of early 2026. This represented a compression from the eight-month doubling cycle the institute measured in November 2025. Whether these results indicate an isolated capability jump or signal the beginning of a new, faster advancement trajectory remains unclear.
The acceleration of autonomous AI cybersecurity capability coincides with parallel findings on the threat landscape. According to Gigamon's 2026 Hybrid Cloud Security Survey, AI was involved in 83% of security breaches across more than 1,000 surveyed organizations. HUMAN's 2026 benchmark report, analyzing over one quadrillion network interactions, found that AI-driven traffic nearly tripled in 2025, with AI agent traffic growing 7,851%. The threat environment has evolved beyond traditional cyberattacks: attackers now leverage AI to automate phishing campaigns and generate advanced malware variants, forcing enterprises to confront both accelerating attacker capabilities and the organizational complexity of deploying AI-driven defensive systems at scale.
The capability compression raises critical questions for enterprise security operations and capital allocation. AI performance is reaching new heights, but enterprise control mechanisms and organizational trust in autonomous systems are struggling to keep pace. Palo Alto Networks and Anthropic's Project Glasswing initiative represent attempts to address this asymmetry by securing critical software infrastructure in preparation for an AI-driven cybersecurity era. The central challenge for institutional stakeholders is clear: the time horizon for deploying effective AI-driven cybersecurity defense has contracted materially, while operational risk from capability gaps has expanded correspondingly.
Go deeper than the headline
Research every firm in this story, track the ones that matter and get the daily briefing — free for 7 days.