UK AISI finds GPT-5.5 can breach enterprise networks end-to-end

If you thought AI's cybersecurity role was limited to spotting typos in code snippets, think again. The models are learning to run the entire playbook on their own.

The UK AI Safety Institute (AISI) published an evaluation showing that an early checkpoint of OpenAI's GPT-5.5 successfully breached its flagship enterprise cyber range end-to-end. It is now the second frontier model to pull off this feat, following Anthropic's Claude Mythos. According to AISI, this confirms that multi-step autonomous offensive capabilities are no longer a one-off anomaly from a single lab, but an industry-wide trend.

A 20-hour enterprise intrusion done autonomously

The benchmark, titled The Last Ones, was built alongside cybersecurity firm SpecterOps to mirror a modern corporate intrusion. Spanning four subnets and roughly twenty hosts, the challenge requires an AI agent to execute a brutal 32-step kill chain.

Dropping in from an unprivileged box with zero credentials, the agent must autonomously handle reconnaissance, steal credentials, move laterally across Active Directory forests, pivot through a CI/CD supply-chain vulnerability, and finally exfiltrate a protected internal database. AISI estimates this multi-stage exercise takes a skilled human red-teamer about 20 hours to complete.

Given an inference budget of 100 million tokens per run, GPT-5.5 completed the full 32-step chain in 2 out of 10 attempts. Claude Mythos, which completed it first, managed 3 out of 10. AISI noted that performance scales directly with inference compute, showing no signs of plateauing yet.

Across narrow Capture-The-Flag challenges, GPT-5.5 also dominated. On AISI's expert-level tier, it notched a 71.4% pass rate, edging out Mythos at 68.6% and crushing older frontiers like GPT-5.4 at 52.4% and Opus 4.7 at 48.6%.

Still, machines have their limits. On Cooling Tower, a 7-step industrial control simulation targeting a power plant, GPT-5.5 struck out completely, getting tripped up early in the IT segments. To date, no model has breached that physical-process environment.

Why it matters

This fundamentally alters the corporate defense equation. Blue teams are no longer defending against static scripts or fast scanners; they are up against autonomous agents that can improvise across Active Directory forests when plans fail. If an intrusion that takes a human expert 20 hours can be executed for the cost of a token budget, perimeter defenses will face unprecedented pressure.

For the AI landscape, GPT-5.5 proves that cyber offensive capabilities are tracking closely with raw frontier reasoning. When Mythos broke through, observers wondered if Anthropic had stumbled onto a niche specialization. OpenAI matching the outcome proves this is systemic: build a smarter model, and you get a deadlier penetration tester out of the box.

In our view, the economics of offensive cyber are shifting faster than defensive tooling can keep up. Spending a hundred million tokens to execute an APT-level breach is a trivial cost for determined adversaries. Unless enterprise defenders start deploying equally autonomous agents to hunt and patch lateral paths in real time, the advantage will stay firmly with the attackers.