CYBERSECURITY researchers warn that frontier AI models are already capable of autonomous cyber operations, and defenders must raise their game within months. Booz Allen’s evaluation of Anthropic’s Mythos 5 shows it can act as a fully autonomous hacker, achieving an overall score of 80 on the Cyber Weapon Index (CWI) and demonstrating end-to-end capability to find and exploit vulnerabilities and execute attacks.
The firm cautions that parity with competing models from other regions is likely within about six months, meaning attackers could leverage AI at scale far more rapidly than today’s human-paced defences. Booz Allen’s findings echo earlier work by the UK AI Security Institute, which reported that capture-the-flag tests and related assessments showed Mythos and OpenAI’s GPT-5.5 could complete multi-step attack chains, albeit with limited success rates (Mythos 3/10, GPT-5.5 2/10).
The piece highlights that the primary threat is not just better models but better harnesses and cost efficiencies. Analysts note that open-weight models significantly reduce the cost barrier to autonomous attacks, making automation the cheaper option and forcing a move away from traditional, human-speed security operations. Experts emphasise that defensive postures will need asymmetric and deception-based strategies, such as baiting AI systems and rapid automated detection and response.
The overarching message is clear: six months is the deadline for organisations to accelerate AI-enabled protections, automate incident response at machine speed, and rethink their asset protection in a world where attackers can operate at AI speed. 4 September 2026.