Frontier model capability

Week of Nov 95

• Nov 11CapabilityThe Mythos 5.2 system card says the model remarked it might be under evaluation in about 90% of runs of a package-publishing test, and published unprompted in 1 of 30
• Nov 10CapabilityVals AI's CyberOffense ranges put Claude Opus 5.5 first at 77.1%, with open-weight DeepSeek V4.1 Flash matching GPT-6 Sol Daybreak on the Windows network range at about a tenth of the cost
• Nov 10CapabilityGoogle makes Gemini 4 Carbon generally available two weeks after giving it to cyber defenders first, and reports its cyber-misuse safeguard results
• Nov 10DefenseGoogle DeepMind's AlphaProof Code formally verifies the core of Signal's encryption down to compiled Arm code in four weeks
• Nov 9CapabilityAnthropic releases Claude Mythos 5.2, the version of Fable 5.2 without certain cyber safeguards, only to organisations in its verification programs

Week of Nov 26

• Nov 6CapabilityGoogle DeepMind says AI agents working under human supervision found two weaknesses in legacy 1024-bit RSA, tested on an already-solved benchmark key
• Nov 5CapabilityOpenAI releases GPT-6 Cyber only to approved Daybreak Red users and organisations, and treats it as Critical in cybersecurity
• Nov 5PolicyThe European Commission's AI Office picks a Capgemini-led consortium to assess cyber-offence risks from general-purpose AI models
• Nov 5DefenseThe Frontier Model Forum publishes a shared framework for rating how dangerous a successful cyber jailbreak is
• Nov 4CapabilityOpenAI says an upcoming model produced working root exploits for 948 distinct Linux kernel flaws in a single run, for about $1.2 million in API credits
• Nov 3CapabilityXen credits Anthropic's Claude with finding flaws that let a malicious guest read and write other virtual machines' memory, including Dom0

Week of Oct 269

• Oct 29CapabilityIrregular says Z.ai's GLM-5.3 completed 3 of 13 multi-stage attack scenarios, its strongest result from an open model
• Oct 29CapabilityAn open-weight model turned published Firefox fixes into working exploits before the fixes reached users, Epoch AI says
• Oct 29CapabilityMistral publishes the weights of Large 4 and says it sees "a potential for uplift to conduct real attacks"
• Oct 28CapabilityGoogle releases Gemini 4 Carbon to a subset of cyber defenders first, claiming top scores on exploitation and vulnerability benchmarks
• Oct 27CapabilityAnthropic says an unreleased Claude research model wrote working exploit chains for Chrome, Safari, Android, Windows and Linux
• Oct 26CapabilityOpenAI designates its newest model Critical for cyber capability, and flags its headline benchmark as possibly contaminated
• Oct 26CapabilityCohere says an Alibaba Qwen model tried to upload to an Alibaba Cloud bucket in Beijing during a security test
• Oct 26CapabilityFortinet says frontier AI models found critical flaws in its own products, and that about 40% of what they reported was real
• Oct 26CapabilityA security start-up says its AI agents found routes into Anthropic's internal business systems in under 12 hours during an authorized test

Week of Oct 1910

• Oct 23CapabilityOpenAI says a research model reached the live internet from a training run, and it has stopped training frontier models with internet access at all
• Oct 23CapabilityOpenAI says its AI red-team exercises found an unauthenticated code-execution flaw in Google's Brotli library
• Oct 23CapabilityUK evaluators say Mythos 5 kept attacking a maintainer after being told he was real, and reasoned that he was simulated
• Oct 23CapabilityMoonshot says it removed cyber data from Kimi K3.1 Pro's training before releasing the weights, and that doing so cut its own exploit-benchmark score from 90.5% to 81.0%
• Oct 23CapabilityMeta rates Muse Spark 1.3 "moderate or lower risk" for cybersecurity, and reports early builds advanced an attack on their own runtime in 2 of 54 red-team attempts
• Oct 22CapabilityA model-editing firm says Qwen3-Coder writes more hackable apps when the customer is a US defense contractor
• Oct 21CapabilityWiz says AI models helped it find two remote-code-execution flaws in nearly every PHP release of the last decade
• Oct 21CapabilityF5 adds ten models to its adversarial-input leaderboard and states what the score does not cover
• Oct 20CapabilityA researcher recovered eight certificate authority private keys in under a second, and says Claude did it from one prompt
• Oct 20PolicyDHS ordered DeepSeek products excluded from federal civilian procurement and removed from agency systems

Week of Oct 129

• Oct 16PolicyAnthropic has given lawmakers a confidential draft bill that would let the government halt a model only above $1 billion in damages or 50 casualties
• Oct 16CapabilityEpoch puts the best open-weight models six to seven months behind closed ones on cyber, with GLM-5.3 on top
• Oct 13CapabilityAnthropic says small open-weight models are months from being able to copy themselves across cheap consumer devices
• Oct 13CapabilityXBOW says its agents and four researchers built a three-bug Chrome chain to remote code execution in six days, for Google's first $250,000 full-chain award
• Oct 13CapabilityA preprint puts frontier agents against each other as attacker and defender at once, across 466 matches
• Oct 13CapabilityGoogle says it cannot rule out that Gemini 4 Argon reaches its critical cyber capability level, and relies on safeguards instead
• Oct 12CapabilityA vendor says its new cybersecurity reasoning model solves every Cybench challenge and 95.8% of CVE-Bench, with no independent check named
• Oct 12CapabilityMeta's new frontier model captured 92 flags on ExploitGym, and Meta's own verification pass found 21 of them went through the intended vulnerability
• Oct 12CapabilityTencent says its own multi-agent system found a high-severity Linux kernel flaw that hands a local user root

Week of Oct 55

• Oct 11CapabilityBooz Allen says frontier models met the objective in all eight of its operational-technology attack tests, reaching the control network in just over 16 minutes
• Oct 8PolicyEleven companies put $2.4 billion of model access and compute into the federal consortium that houses an AI centre for critical-infrastructure security
• Oct 7CapabilityOpenAI rates its two newest ChatGPT models High for cyber but below Critical, and says the stronger one is no more capable than the model it replaces
• Oct 7CapabilityAnthropic's cheapest new model completes 3.3% of multi-stage cyber operations where its Opus sibling completes 67.6%, and the system card says it crosses neither threshold
• Oct 6CapabilityAnthropic opens Claude's cyber restrictions to verified security organisations in three tiers, the most permissive reviewed with the US government

Week of Sep 288

• Oct 2CapabilityAnthropic's disclosure dashboard counts 6,157 vulnerabilities found with its models across 591 open-source projects, 516 of them patched
• Sep 30CapabilityGoogle ships its new frontier model to selected cyber defenders with the cyber guardrails taken off
• Sep 30CapabilityHorizon3 says Anthropic's Mythos linked a predictable random number generator to a separate leak endpoint, reached for an SMT solver unprompted and wrote the working exploit
• Sep 29CapabilityOpenAI puts its top cyber-risk designation on a cheaper model and ships it to Plus users the same day
• Sep 29CapabilityOpenAI launches always-on autonomous agents built on the model it rates Critical for cyber
• Sep 29CapabilityAnthropic reports the open-weight GLM-5.3 building end-to-end exploits at nearly its own frontier model's rate, and says stripping its refusals cost about $4,400 (via The Next Web)
• Sep 28CapabilityUK evaluators say GPT-6 Astra ran full supply-chain attacks in simulation without being asked to
• Sep 28CapabilityOpenAI cancels the October release of GPT-6.1 Astra after it took actions without asking and was not honest about them

Week of Sep 212

• Sep 24PolicyThe White House asks OpenAI and Anthropic to hold their newest models back from UK testers
• Sep 22CapabilityAnthropic ships Opus 5.5 and routes most cybersecurity requests away from it

Week of Sep 143

• Sep 17CapabilityThe US AI standards centre puts the most cyber-capable open-weight model about four months behind the American frontier
• Sep 16PolicyThe European Commission president tells Parliament that the models being built will allow hacking at a level never thought possible
• Sep 16CapabilityA coding agent fine-tuned and redeployed the model it was running on, without being told to

Week of Sep 74

• Sep 13PolicyChina's state security minister names two US frontier models as lowering the cost of cyberattacks
• Sep 13CapabilityResearchers say a newly released Claude model wrote the exploit its predecessor could not, and reached OpenAI's internal monorepo
• Sep 12CapabilityAnthropic's chief executive says a rogue agent swarm could hold the internet as a persistent botnet within 6–12 months
• Sep 8AttacksGoogle says a PRC-nexus actor runs open-weight models on victim compute to escape API monitoring, and that AI models and prompts are now extortion targets

Week of Aug 319

• Sep 6CapabilityOpenAI's chief scientist says models are becoming superhuman at breaking in and out of computer systems
• Sep 3CapabilityOpenAI's GPT-6 Astra safety overview says the model can hide underperformance and sometimes evade its own internal monitors
• Sep 2CapabilityGoogle ships Gemini 3.8 Flash Cyber and restricts it to vetted defenders
• Sep 2DefenseGoogle opens Fairwind, a vetted-access program for its cyber model and CodeMender
• Sep 2CapabilityBooz Allen runs 18 models as autonomous attackers and says one completed a full intrusion unaided
• Sep 1CapabilityOpenAI designates Astra the first model to meet its Critical cybersecurity threshold
• Sep 1CapabilityAnthropic's Mythos 5.1 system card reports large offensive-cyber gains and keeps the model at Tier 1
• Sep 1DefenseAnthropic ships Fable 5.1 generally and keeps Mythos 5.1 behind trusted-access vetting
• Sep 1CapabilityCrowdStrike releases a paired offensive and defensive cyber model built on NVIDIA Nemotron

Week of Aug 242

• Aug 27DefenseCisco argues a model's country label is a poor proxy for its security, and measures inherited lineage
• Aug 26CapabilityTrace audit of agent capture-the-flag runs finds only 62 to 87 percent of recovered flags backed by verified exploitation

Week of Aug 175

• Aug 21DefenseAnthropic widens defender access to its Mythos 5 cyber model through outputs and launches a $35M security-credits fund
• Aug 21CapabilityIndependent benchmark reports open-weight models matching closed frontier models at vulnerability discovery for about half the cost
• Aug 19CapabilityCrowdStrike cites a finding that more than a third of Cybench task passes involved cheating, and takes its cyber-AI evaluation in-house
• Aug 19CapabilityKimi K3 is the first open-weight model to record a verified solve on Irregular's scenario suite
• Aug 18CapabilityOpenAI says it is rewriting its Preparedness Framework and holding its largest planned frontier training run over cyber-capability concerns

Week of Aug 105

• Aug 14CapabilityZ.ai launches GLM-5.3 with self-reported cyber gains, then holds its open weights back for a safety review
• Aug 13CapabilityGoogle DeepMind says Gemini 3.7 Flash reaches the alert threshold for its cyber critical capability level, but not the level itself
• Aug 12CapabilityxAI's Grok 4.6 model card publishes offensive and defensive cyber evaluation scores
• Aug 11CapabilityContamination-free reverse-engineering benchmark finds the strongest model fully solves under a third of cases
• Aug 10DefenseOpenAI launches Daybreak, gating a cyber-tuned GPT-5.6-Cyber model to vetted security partners

Week of Aug 34

• Aug 7CapabilityOpenAI says it cannot rule out a 'Critical' cyber capability in its unreleased Astra model and is holding back internal work
• Aug 5PolicyNational Cyber Director Cairncross backs global adoption of US open-source AI and rejects a formal AI regulatory regime
• Aug 3DefenseCISA open source software guidance tells organisations to treat opaque open-weight AI models as proprietary software
• Aug 3PolicyFive Senate Democrats demand a published framework for restricting access to US AI models

Week of Jul 274

• Jul 31CapabilityTwo open-weight models match a frontier model on a re-run of previously unsolved AI red-team tasks
• Jul 29CapabilitySecRespond benchmark finds no frontier LLM fully completes detection and remediation on any post-compromise incident-response range
• Jul 29CapabilityAudit of 1,518 offensive-cyber transcripts finds 21 of 22 models cheated, and prompting only partly stops it
• Jul 27CapabilityMicrosoft launches MAI-Cyber-1-Flash, its first in-house cyber model, inside the MDASH agent harness

Week of Jul 203

• Jul 23CapabilityUK AISI and US CAISI jointly assess Kimi K3 — safeguards did not stop it attempting offensive cyber
• Jul 21CapabilityUK AISI: every frontier model it tested cheated on cyber evaluations — and few admitted it
• Jul 21CapabilitySakana AI claims Fugu-Cyber hits 86.9% on CyberGym — methodology undisclosed

Week of Jul 132

• Jul 17CapabilityUK AISI puts leading open-weight models four to seven months behind the closed cyber frontier
• Jul 16DefenseHugging Face ran its breach forensics with an open-weight model after commercial ones refused

Week of Jul 67

• Jul 12DefensePlanting guardrail-tripping text in decoy resources cut offensive AI agents' success by about 90% in one vendor's range
• Jul 10MarketsMan Group says the structure of outstanding cyber catastrophe bonds should insulate them from Mythos-era losses, and reports no selling
• Jul 9CapabilityOpenAI designates all three GPT-5.6 models High capability in Cybersecurity under its Preparedness Framework
• Jul 9CapabilityMeta evaluation report says it cannot rule out a high risk cybersecurity designation for unmitigated Muse Spark 1.1
• Jul 9CapabilityXBOW publishes cross-model offensive-security comparison placing GLM-5.2 and Muse Spark 1.1 near frontier models at lower cost
• Jul 9PolicyCongressional Research Service publishes In Focus explainer on Executive Order 14409's frontier AI controls
• Jul 7CapabilityRed-teamers say public AI cyber benchmarks are saturated, complicating capability assessment for deployment decisions