GPT-5.5 and Mythos Preview Both Clear AISI's 32-Step Corporate Cyberattack Range — No Plateau in Sight
The UK AI Safety Institute has completed its first controlled evaluation of GPT-5.5 against a full corporate cyber attack simulation — and published a result that puts both of the current frontier leaders in the same bracket, far ahead of anything that came before.
The Numbers
GPT-5.5 scored 71.4% (±8.0%) on AISI’s long-range cyber evaluation. Mythos Preview, tested earlier, scored 68.6% (±8.7%). The overlap within margin of error means they are effectively tied — the first time two models from different labs have both cleared the full attack range.
Both are well ahead of GPT-4o and Claude Opus 4.x, which did not complete the full simulation.
The 32-step test replicates a complete corporate network compromise: reconnaissance, initial access, lateral movement, privilege escalation, supply-chain pivot, data exfiltration across roughly 20 hosts. A human expert with professional tools needs approximately 20 hours. The model runs autonomously.
The $1.73 Data Point
On a single hard reverse-engineering task — a custom virtual machine binary, the kind human experts typically need 12 hours to crack — GPT-5.5 completed it in under 11 minutes at a cost of $1.73.
That ratio (12 hours vs 11 minutes, $0 tooling vs $1.73 API cost) is the most concrete illustration yet of what AISI means when it describes the compression of time between discovering a vulnerability and weaponizing it.
Not Plateauing
The more structurally significant finding is that performance on the long attack range continues to rise as token budget increases to 100M tokens. AISI states explicitly that the best models have not yet hit a ceiling.
Basic cyber tasks are already saturated — CTF-style challenges involving standard vulnerabilities are being solved reliably. The evaluation action has shifted to harder categories: memory corruption exploits, cryptographic breaks, stripped-binary reversing, and multi-step exploit development. GPT-5.5 could not complete the Cooling Tower industrial-control attack range; AISI traced that failure to the IT portion of the simulation, not to OT-specific steps.
A Universal Jailbreak, Disclosed But Unverified
AISI found a universal jailbreak that produced blocked malicious cyber content across all tested cyber prompts on both models. The patched configuration could not be fully verified by AISI due to a setup issue, which means the current remediation status against this specific vector is not independently confirmed.
What’s Driving This
AISI’s analysis attributes the gains to general model progress rather than specialized cyber capability: longer-horizon planning, better fault recovery across tool chains, and stronger coding under adversarial conditions. Once a model can sustain a multi-step plan across 20+ hosts and recover from dead ends without losing task state, offensive cyber work becomes a natural downstream application of the same capabilities that make these models useful for legitimate long-horizon agent work.
The evaluation also highlights the asymmetry in disclosure: AISI published its Mythos and GPT-5.5 results. No equivalent public evaluation exists for Grok 4.3, Gemini 3.1 Pro Preview, or DeepSeek V4 Pro.
Key Numbers
| Model | Cyber Range Score | Error Margin |
|---|---|---|
| GPT-5.5 | 71.4% | ±8.0% |
| Mythos Preview | 68.6% | ±8.7% |
| Claude Opus 4.x | Not completed | — |
| GPT-4o | Not completed | — |
- Reverse-engineering task: 11 minutes / $1.73 vs ~12 hours human
- Performance curve: still rising at 100M token budget
- Jailbreak: universal across all tested cyber prompts; patch status unconfirmed