What Can Frontier AI Models Actually Do in an AI Cyber Attack?

In an AI cyber attack, frontier models are not primarily writing novel malware or discovering zero days. They supply judgment and comprehension at machine cost: reading permission models, understanding OAuth flows, correlating misconfigurations across large estates, and chaining low severity findings into a working attack path. The UK AI Security Institute's evaluation of Claude Mythos Preview found it was the first model to solve a 32-step corporate intrusion range from start to finish, in 3 of 10 attempts, averaging 22 of the 32 steps. The practical consequence for enterprises is economic, not magical: the long tail of boring, individually harmless findings just became cheap to explore.

What can frontier AI models actually do in a cyber attack?

Frontier models can read, reason about, and act inside unfamiliar technical environments at a speed and cost no human team can match. That is the capability that matters. Published evaluations demonstrate three things concretely: strong performance on expert-level offensive security tasks, multi-hour coherent task execution, and completion of full attack paths on realistic ranges.

Here is what is demonstrated versus what is reasonable inference.

Demonstrated, in published evaluations and disclosed incidents:

Inference, and worth labelling as such: that the cost curve above makes low-value, high-effort intrusion paths worth attempting for the first time. That inference is where enterprise risk actually lives, and it deserves scrutiny rather than acceptance.

What was actually scarce for attackers before frontier models?

Comprehension was scarce. Exploits were never the bottleneck for competent attackers. Understanding a specific, weird, undocumented enterprise environment was.

Consider what a human operator had to do before. Read a company's API documentation. Work out which identity provider federates which application. Figure out whether a particular service account's scope actually reaches the object they want. Notice that a local admin account sits outside the IdP. Each of those tasks takes hours of skilled attention, and most of them produce nothing. The expected value of exploring a mid-sized company's authorization mess was negative.

Three things were genuinely scarce:

Frontier models supply all three at machine cost. Not novelty. Patience.

Because a zero day gets you code execution on one host, while a permission model tells you where the data is and who is already allowed to take it. Authorization comprehension converts directly into access without triggering a single exploit detection.

The reframe matters for budget decisions. A zero day is expensive, burns on use, and gets patched. An over-scoped OAuth grant with no IP restriction is free, durable, and indistinguishable from legitimate integration traffic. Palo Alto Networks' Unit 42 has assessed that frontier AI increases risk from both zero-day and known N-day vulnerabilities largely by lowering the barrier for unskilled attackers to construct complex exploit chains, and by compressing the window between discovery and exploitation.

Decision rule: if your AI threat model spends more effort on malware novelty than on effective authority mapping, it is aimed at the wrong cost curve.

Can AI actually launch cyber attacks on its own, and how is frontier AI different from regular AI for hacking?

Yes, on test ranges, under evaluation conditions, with meaningful failure rates. Frontier models differ from earlier generations in one respect that matters operationally: they maintain coherent multi-step plans over hours instead of producing useful single answers.

DimensionAI-assistedAI-autonomousHuman roleOperator drives each stepHuman sets the goal, model plansFailure recoveryHuman re-plansModel re-plans within the runObserved todayWidespread, hard to attributeDemonstrated in evaluationsTime horizonMinutes per taskMulti-hour coherent executionDetection signalHuman-paced actionsMachine-paced, unusual sequencing

The honest read: AI-assisted attacks are the present. AI-autonomous attacks are demonstrated in controlled ranges and not yet the dominant real-world pattern.

Common mistake: treating range results as field results. A 3-in-10 success rate against a benchmark does not mean 3-in-10 against your environment, which is messier and also less documented. AISI itself notes its ranges lack real-world defensive features such as active monitoring and incident response.

Frontier models do not break modern encryption. No published evaluation demonstrates cryptographic breaks. What they exploit better than humans is scale-dependent reasoning: the relationships between thousands of entitlements, tokens, and integrations that no person can hold in working memory.

Categories where models have a genuine edge:

Firewalls are largely beside the point here. The traffic is authenticated API traffic from sanctioned applications. Bearer tokens assume possession equals authorization, so a stolen token looks exactly like the integration it belongs to.

What does the evidence say about how attackers are really getting in?

Identity and authorization, overwhelmingly. Valid credentials, over-scoped tokens, and trusted third-party integrations produce more enterprise impact than exploit chains, and AI makes finding those paths cheaper rather than inventing new ones.

The numbers are consistent across independent sources. Unit 42 found identity weaknesses played a material role in 90% of its 2026 investigations, with 65% of initial access driven by identity-based techniques. The 2026 Verizon Data Breach Investigations Report shows vulnerability exploitation leading at the moment of first contact, while credential abuse appears somewhere in 39% of breaches across the full chain, more than any other vector.

The entry point moved. The attack path did not.

Now add AI agents, which hold bearer tokens as their primary authentication mechanism and act with the full authority of whoever provisioned them. Patterns across large enterprise deployments consistently show agents over-permissioned relative to their workflows, and agents moving far more data than human users.

That is machine insider risk. Agents hold credentials, access data, and make decisions like insiders. No insider risk program covers them.

Below is an illustrative chain, not a disclosed incident. It is constructed to show how individually low severity findings compose. Every link would be triaged as informational or low on its own.

Read the last link again. The grant outlives the account. Disabling the human does not revoke the machine. That is the orphaned agent pattern, and it is where theoretical configuration and effective authority diverge most sharply.

How do you detect when AI is being used in an AI cyber attack?

You usually cannot detect the model. You detect the machine-paced authorization behavior it produces. The signal is in sequencing, breadth, and timing of identity events, not in payload content.

Practical detection signals, ranked by usefulness:

Edge case worth planning for: perfectly legitimate AI adoption produces two of these signals routinely. Detection has to correlate identity, agent, and data context, or it drowns in false positives. That is the difference between ghost chasing theoretical risk and runtime truth.

Severity-based triage stops working. If exploration is cheap, the attacker's filter is no longer "is this finding valuable" but "does this finding connect." Defenders filtering by CVSS will systematically miss the paths.

Three shifts follow:

Are there regulations or laws about AI in cyber warfare?

There is no comprehensive treaty governing AI in cyber operations. What exists is a mix of national guidance, safety-institute evaluation regimes, and enterprise-facing frameworks that auditors are already using.

What applies today:

Plan on the assumption that today's evaluation results describe tomorrow's widely available tooling, rather than waiting for a regulatory trigger.

Start with inventory, then authority, then enforcement. In that order, because you cannot govern what you cannot see and you cannot scope guardrails around agents you have not found.

Chains are fragile. Every link in the illustrative path above is individually low severity, which means every link is individually cheap to break. Remove the IP-unrestricted service account and the chain stops at step three. Bring the local admin under the IdP with MFA and it stops at step six. Revoke grants on account suspension and step eight fails. Attackers need every link. Defenders need one.

What to do about AI cyber attacks, starting this quarter

The useful question is not whether frontier models can write malware. It is what happens when comprehension becomes cheap. Published evaluations show these systems completing multi-step intrusions on realistic ranges, sustaining coherent plans for hours, and scaling predictably with compute. Combine that with the fact that most real enterprise breaches run through identity and authorization rather than novel exploits, and the conclusion is uncomfortable but actionable: the long tail of low severity findings is now worth an attacker's time.

Three next steps for this quarter:

Obsidian Security operates as the runtime truth layer for this problem: a connector-free view of every agent across supported AI platforms, correlation of the runner's identity against the agent's effective authority, and identification of toxic combinations before they compound. Probabilistic agents need deterministic guardrails. Start by seeing them.

‍