What Can Frontier AI Models Actually Do in an AI Cyber Attack?

Quick Answer

In an AI cyber attack, frontier models are not primarily writing novel malware or discovering zero days. They supply judgment and comprehension at machine cost: reading permission models, understanding OAuth flows, correlating misconfigurations across large estates, and chaining low severity findings into a working attack path. The UK AI Security Institute's evaluation of Claude Mythos Preview found it was the first model to solve a 32-step corporate intrusion range from start to finish, in 3 of 10 attempts, averaging 22 of the 32 steps. The practical consequence for enterprises is economic, not magical: the long tail of boring, individually harmless findings just became cheap to explore.

Key Takeaways

• Frontier models now complete end-to-end simulated intrusions. AISI found Claude Mythos Preview was the first model to solve its 32-step corporate range from start to finish, in 3 of 10 attempts, averaging 22 of 32 steps against Claude Opus 4.6's average of 16.
• Capability on expert-level tasks moved sharply. AISI reports Mythos Preview succeeds on expert-level capture-the-flag challenges 73% of the time, a tier no earlier model completed at all.
• Capability scales with compute. Raising the inference budget from 10 million to 100 million tokens produced gains of up to 59% on the same range.
• Multi-hour autonomy is measurable. METR's February to March 2026 Frontier Risk Report put the most capable shared model's 50% time horizon between 16 and 20 hours on its software engineering suite.
• The evidence on real breaches points at identity. Unit 42 found identity weaknesses played a material role in 90% of its 2026 investigations, with 65% of initial access driven by identity-based techniques.
• The real target is identity and authorization, not cryptography. No published evaluation shows frontier models breaking modern encryption.
• Agents create a new class of machine insider risk: credentials, effective authority, and no insider risk program covering them.
• Attack chains are fragile. Breaking one link, usually an identity or authorization link, collapses the whole path.

What can frontier AI models actually do in a cyber attack?

Frontier models can read, reason about, and act inside unfamiliar technical environments at a speed and cost no human team can match. That is the capability that matters. Published evaluations demonstrate three things concretely: strong performance on expert-level offensive security tasks, multi-hour coherent task execution, and completion of full attack paths on realistic ranges.

Here is what is demonstrated versus what is reasonable inference.

Demonstrated, in published evaluations and disclosed incidents:

• Autonomous completion of a 32-step corporate intrusion range. AISI's evaluation of Claude Mythos Preview recorded the first end-to-end solve of "The Last Ones," in 3 of 10 attempts, with an average of 22 steps completed against Claude Opus 4.6's 16.
• Expert-tier performance on capture-the-flag challenges, where Mythos Preview succeeded 73% of the time on a tier no previous model had completed.
• Log-linear scaling with inference compute. A March 2026 study measuring models against the same ranges found that increasing the token budget from 10 million to 100 million yielded gains of up to 59%, with no plateau observed. Claude Opus 4.5 rose from an average of 7.6 steps to 11.0 on that budget change alone, and the authors note the technique requires no technical sophistication from the operator.
• Multi-hour coherent execution. METR's Frontier Risk Report covering February to March 2026 estimated the most capable shared model's 50% time horizon at between 16 and 20 hours on its Time Horizon 1.1 software engineering suite.
• Government-level concern based on those evaluations, reflected in the Australian Cyber Security Centre's updated guidance on frontier models.

Inference, and worth labelling as such: that the cost curve above makes low-value, high-effort intrusion paths worth attempting for the first time. That inference is where enterprise risk actually lives, and it deserves scrutiny rather than acceptance.

What was actually scarce for attackers before frontier models?

Comprehension was scarce. Exploits were never the bottleneck for competent attackers. Understanding a specific, weird, undocumented enterprise environment was.

Consider what a human operator had to do before. Read a company's API documentation. Work out which identity provider federates which application. Figure out whether a particular service account's scope actually reaches the object they want. Notice that a local admin account sits outside the IdP. Each of those tasks takes hours of skilled attention, and most of them produce nothing. The expected value of exploring a mid-sized company's authorization mess was negative.

Three things were genuinely scarce:

1. Patience for low-yield reconnaissance. Reading 400 pages of a SaaS platform's permission model to find one gap.
2. Cross-domain fluency. Knowing OAuth, SAML, a specific CRM's sharing rules, and a CI/CD platform's token scopes simultaneously.
3. Willingness to fail. Most chains do not work. Humans stop trying.

Frontier models supply all three at machine cost. Not novelty. Patience.

Why is reading a permission model more valuable to an attacker than finding a zero day?

Because a zero day gets you code execution on one host, while a permission model tells you where the data is and who is already allowed to take it. Authorization comprehension converts directly into access without triggering a single exploit detection.

The reframe matters for budget decisions. A zero day is expensive, burns on use, and gets patched. An over-scoped OAuth grant with no IP restriction is free, durable, and indistinguishable from legitimate integration traffic. Palo Alto Networks' Unit 42 has assessed that frontier AI increases risk from both zero-day and known N-day vulnerabilities largely by lowering the barrier for unskilled attackers to construct complex exploit chains, and by compressing the window between discovery and exploitation.

Decision rule: if your AI threat model spends more effort on malware novelty than on effective authority mapping, it is aimed at the wrong cost curve.

Can AI actually launch cyber attacks on its own, and how is frontier AI different from regular AI for hacking?

Yes, on test ranges, under evaluation conditions, with meaningful failure rates. Frontier models differ from earlier generations in one respect that matters operationally: they maintain coherent multi-step plans over hours instead of producing useful single answers.

The honest read: AI-assisted attacks are the present. AI-autonomous attacks are demonstrated in controlled ranges and not yet the dominant real-world pattern.

Common mistake: treating range results as field results. A 3-in-10 success rate against a benchmark does not mean 3-in-10 against your environment, which is messier and also less documented. AISI itself notes its ranges lack real-world defensive features such as active monitoring and incident response.

What vulnerabilities can AI exploit that humans cannot, and can frontier AI break encryption or bypass firewalls?

Frontier models do not break modern encryption. No published evaluation demonstrates cryptographic breaks. What they exploit better than humans is scale-dependent reasoning: the relationships between thousands of entitlements, tokens, and integrations that no person can hold in working memory.

Categories where models have a genuine edge:

• Toxic combinations. Individually low severity findings that only become critical together. Humans triage by severity label and miss the combination.
• Cross-platform authorization drift. An identity in Entra, an entitlement in a CRM, a token in a CI system, a grant in an agent builder. Four consoles, one path.
• Undocumented behavior. Reading actual API responses rather than published docs to infer real permission boundaries.
• Agent-to-agent pathways. Agent A with limited scope invoking Agent B with broad scope.

Firewalls are largely beside the point here. The traffic is authenticated API traffic from sanctioned applications. Bearer tokens assume possession equals authorization, so a stolen token looks exactly like the integration it belongs to.

What does the evidence say about how attackers are really getting in?

Identity and authorization, overwhelmingly. Valid credentials, over-scoped tokens, and trusted third-party integrations produce more enterprise impact than exploit chains, and AI makes finding those paths cheaper rather than inventing new ones.

The numbers are consistent across independent sources. Unit 42 found identity weaknesses played a material role in 90% of its 2026 investigations, with 65% of initial access driven by identity-based techniques. CrowdStrike's 2026 Global Threat Report found 82% of detections involved no malware at all, with adversaries working through valid credentials, trusted identity flows, and approved SaaS integrations. The 2026 Verizon Data Breach Investigations Report shows vulnerability exploitation leading at the moment of first contact, while credential abuse appears somewhere in 39% of breaches across the full chain, more than any other vector.

The entry point moved. The attack path did not.

Now add AI agents, which hold bearer tokens as their primary authentication mechanism and act with the full authority of whoever provisioned them. Patterns across large enterprise deployments consistently show agents over-permissioned relative to their workflows, and agents moving far more data than human users.

That is machine insider risk. Agents hold credentials, access data, and make decisions like insiders. No insider risk program covers them.

What does an AI assembled attack chain look like in practice?

Below is an illustrative chain, not a disclosed incident. It is constructed to show how individually low severity findings compose. Every link would be triaged as informational or low on its own.

1. A public-facing portal leaks API endpoint names and OAuth client IDs.
2. Reconnaissance identifies connected applications and their authentication flows.
3. A dormant personal access token surfaces in a public code repository.
4. The token belongs to a service account with broad scope and no IP restriction.
5. That service account can read a knowledge base containing administrative runbooks.
6. The runbooks reference a local admin account outside the identity provider, with no MFA.
7. That local admin can authorize a new integration with org-wide read access.
8. Data leaves through the new integration, and the OAuth grant survives IdP suspension of the account.

Read the last link again. The grant outlives the account. Disabling the human does not revoke the machine. That is the orphaned agent pattern, and it is where theoretical configuration and effective authority diverge most sharply.

How do you detect when AI is being used in an AI cyber attack?

You usually cannot detect the model. You detect the machine-paced authorization behavior it produces. The signal is in sequencing, breadth, and timing of identity events, not in payload content.

Practical detection signals, ranked by usefulness:

1. New OAuth grant creation by accounts that have never created one, especially org-wide read scopes.
2. Token use from new network contexts on service accounts with no IP restriction.
3. Action chaining across applications within seconds: enumerate, read, authorize, export.
4. Agent invocations by users who lack direct entitlement to the data returned. This is the maker mode signature: the runner's identity does not match the agent's effective authority.
5. Activity from agents whose owner account is disabled.
6. Breadth anomalies: an integration reading object types it has never touched.

Edge case worth planning for: perfectly legitimate AI adoption produces two of these signals routinely. Detection has to correlate identity, agent, and data context, or it drowns in false positives. That is the difference between ghost chasing theoretical risk and runtime truth.

What changes for defenders when the cost of exploration approaches zero?

Severity-based triage stops working. If exploration is cheap, the attacker's filter is no longer "is this finding valuable" but "does this finding connect." Defenders filtering by CVSS will systematically miss the paths.

Three shifts follow:

• From findings to paths. Score combinations, not items. A shadow agent is medium. A shadow agent with org-wide unrestricted sensitive data access is critical.
• From configuration to runtime. Posture tells you what could happen. Runtime tells you what did. MCP tool calls in particular can only be captured as they happen, because retroactive log review cannot reconstruct them.
• From probabilistic to deterministic control. Agents run on probabilities and can deviate from intended goals. Access controls cannot be probabilistic. Deterministic guardrails cut off action options regardless of what the model decides to try.

Are there regulations or laws about AI in cyber warfare?

There is no comprehensive treaty governing AI in cyber operations. What exists is a mix of national guidance, safety-institute evaluation regimes, and enterprise-facing frameworks that auditors are already using.

What applies today:

• National guidance, including the Australian Cyber Security Centre's published advice on frontier model impact, and pre-deployment cyber evaluations run by safety institutes in the UK and US.
• Enterprise frameworks: NIST AI RMF, ISO 42001, MITRE ATLAS, OWASP Top 10 for Agentic Risks, and OWASP LCNC-SEC for low-code and no-code agent platforms. Audit committees are citing these now.
• Model-provider commitments: voluntary capability thresholds and staged release, which is why evaluation results are public at all.

Plan on the assumption that today's evaluation results describe tomorrow's widely available tooling, rather than waiting for a regulatory trigger.

What should security teams do differently right now?

Start with inventory, then authority, then enforcement. In that order, because you cannot govern what you cannot see and you cannot scope guardrails around agents you have not found.

1. Build an AI agent inventory. Every agent across Copilot Studio, Agentforce, Bedrock, Vertex, Azure AI Foundry, ChatGPT Enterprise and n8n. Record creator, owner, and status.
2. Produce an MCP server inventory. Sanctioned versus unsanctioned. Note that tools inside an MCP server are only visible at runtime.
3. Map effective authority, not theoretical configuration. What can each agent actually reach inside each application after entitlements resolve.
4. Hunt toxic combinations. Maker mode plus sensitive access. Org-wide accessibility plus broad scope. Disabled owner plus active credentials.
5. Fix the identity links first. Local admin accounts outside the IdP, service accounts without IP restriction, and non-human identities holding grants that survive account suspension.
6. Instrument runtime. Correlate the runner's identity against the agent's effective authority on every invocation.
7. Report the blast radius. Give the audit committee a number for what a single compromised public-facing agent could reach.

Chains are fragile. Every link in the illustrative path above is individually low severity, which means every link is individually cheap to break. Remove the IP-unrestricted service account and the chain stops at step three. Bring the local admin under the IdP with MFA and it stops at step six. Revoke grants on account suspension and step eight fails. Attackers need every link. Defenders need one.

What to do about AI cyber attacks, starting this quarter

The useful question is not whether frontier models can write malware. It is what happens when comprehension becomes cheap. Published evaluations show these systems completing multi-step intrusions on realistic ranges, sustaining coherent plans for hours, and scaling predictably with compute. Combine that with the fact that most real enterprise breaches run through identity and authorization rather than novel exploits, and the conclusion is uncomfortable but actionable: the long tail of low severity findings is now worth an attacker's time.

Three next steps for this quarter:

1. Answer the inventory question. How many AI agents exist, who owns them, and which owners are disabled. If you cannot answer in an afternoon, that is the first project.
2. Map effective authority for your top 20 agents. Not theoretical configuration. What they can actually reach inside each application.
3. Break one link per chain. Audit local admin accounts outside the IdP, service accounts without IP restrictions, and OAuth grants that survive suspension.

Obsidian Security operates as the runtime truth layer for this problem: a connector-free view of every agent across supported AI platforms, correlation of the runner's identity against the agent's effective authority, and identification of toxic combinations before they compound. Probabilistic agents need deterministic guardrails. Start by seeing them.