UK AISI cyber time horizon test: Mythos Preview, GPT-5.5

In plain words

The UK AI Security Institute (AISI) tracks how long a cyber task an AI model can finish on its own, measured by how long a human expert would need for the same task. AISI reports that this length has been doubling every few months, and that two recent models, Claude Mythos Preview and GPT-5.5, went well past its earlier trend. In a separate test, a newer Mythos Preview checkpoint completed both of AISI's simulated network attacks for the first time. AISI stresses that these are controlled tests and do not show how models would fare against defended, real-world systems.

What was tested

AISI measures two things. The first is a "time horizon": the length of task, in human expert time, that a model completes with a given chance of success. AISI focuses on an 80% success threshold. The tasks sit in what AISI calls its narrow cyber suite. They ask a model to identify and exploit weaknesses in target systems, using skills such as reverse engineering and web exploitation in self-contained setups. AISI says these tasks cover only some of the capabilities relevant to real-world cyberattacks.

The second is a pair of cyber ranges. These measure whether a model can carry out a cyberattack against a small, undefended enterprise network where initial access has already been gained. Each range demands sustained planning and execution. The ranges are named "The Last Ones" and "Cooling Tower".

A good result is a longer task length completed reliably, or a range completed in more of ten attempts. AISI gives an example reading of a time horizon result: Claude Sonnet 4.5 would succeed 80% of the time at cyber tasks taking human experts 16 minutes, in AISI's testing setup with 2.5M tokens per task, so long as the tasks resemble those in the narrow suite.

How the test works

Each task in the narrow suite gets an estimate of how long a cyber expert would take. For over a third of the tasks, AISI timed human experts to set a baseline. The rest use expert estimates, which AISI says could be over- or underestimates. AISI calculates each model's success rate across all tasks and estimates the task length completed at the chosen likelihood of success.

AISI deliberately limits each task to 2.5M tokens so results can be compared over time. It also uses a simple agent scaffold. AISI says both choices understate what models can do. Without the cap, success rates are so high that time horizons become impossible to calculate. For reference, AISI says its cyber range experiment uses up to 100M tokens and that performance would likely still improve beyond that budget, especially for recent models.

To track the pace of progress, AISI fits an exponential curve to historical results for the most capable models at any given time. It calls this an imperfect model, not a future prediction and not a fixed law. The cyber ranges are not used to estimate time horizons, because AISI currently has only two of them.

The systems discussed are Claude Mythos Preview (including a newer checkpoint than the one in AISI's earlier pre-deployment report), GPT-5.5 and, as an example, Claude Sonnet 4.5. Range results are counted out of 10 attempts.

Results

AISI reports that in February 2026 it estimated the 80%-reliability cyber time horizon had doubled every 4.7 months since reasoning models emerged in late 2024. That was around half its November 2025 estimate of 8 months. Claude Mythos Preview and GPT-5.5 have since significantly outperformed this trend. AISI says it is unclear whether they are an isolated break or part of a new, faster trend.

On the cyber ranges, the newer Mythos Preview checkpoint solved "The Last Ones" in 6 of 10 attempts and "Cooling Tower" in 3 of 10 attempts. AISI says this was the first time a model completed the second range, and the first completion of both. GPT-5.5 solved "The Last Ones" on 3 of 10 attempts. The table shows these range results. With ten attempts per range, small gaps between counts should not be read as firm rankings.

AISI also reports that Mythos Preview and GPT-5.5 have large upper-bound error bars because of near-100% success rates on the longest tasks in the narrow suite. In a footnote, AISI says GPT-5.5 achieves a 100% success rate on five of six tasks estimated over 8 hours under the cap, and solves the sixth on every attempt once the cap is removed. Mythos Preview completes all six long tasks 100% of the time with the cap. AISI concludes this places some of the latest models at the limit of what its narrow suite can measure.

For comparison, AISI cites METR, a research non-profit that estimates time horizons for software engineering. METR's results imply a consistent doubling time of 4.2 months on software tasks since late 2024. In AISI's footnote, the estimated METR doubling time with Mythos Preview included is 4 months.

What the results do and do not show

This report's publication date is not stated, so a reader should treat it as describing the models AISI had tested at the time of writing, not necessarily the current state of the field. Later TOSWO pages may cover newer tests of related systems, such as the Kimi K3 cyber test by UK AISI and CAISI; results there may differ from those described here.

AISI measured how fast task length has grown on one narrow suite and how often two models completed two simulated networks. It says no single benchmark result should be read as a precise measure of AI capability. It names several limits. The longest time horizon estimates rely on only six tasks of eight hours or more, and there are only a few human baselines for those six. Human experts could be faster or slower than those timed. The curve is fit on a small number of models, though AISI says any single omission only shifts the pre-Mythos doubling time to between 4.1 and 5.0 months. The cyber ranges are undefended networks, and the token cap and simple scaffold understate model ability.

AISI also states what the evidence does not tell it: how the pace of progress will evolve, when AI will reach any particular capability threshold, or how these capabilities will translate against defended, real-world systems. It adds that notable capability jumps do not always require new model releases, since later iterations of the same model can change estimates.

TOSWO Research's reading: the two model results sit at the edge of what the suite can measure, so the size of the jump is less certain than the direction. The tester itself says the direction has been consistent across the models, methods and independent data it examined.

Why it matters

AISI concludes that frontier AI's autonomous cyber and software capability is advancing quickly, with the length of cyber tasks completed doubling on the order of months, not years. It says stronger capabilities are already producing tangible opportunities and risks, that cyber defenders have reported significant advances in vulnerability discovery with recent models, and that access to today's controlled capabilities may diffuse over time. In its words, "The time to invest in strong security baselines is now."⁠¹ AISI notes that the National Cyber Security Centre recently published advice on using AI models to find vulnerabilities, and says frontier AI can strengthen attackers as well as defenders.

AISI says it is developing tougher evaluations: new cyber ranges, enhancements to existing ones, and active cyber defences to better reflect real-world conditions.

TOSWO Research's reading: because the tester's own measuring tools are close to their ceiling, readers who rely on such benchmarks may find that earlier scores say less about the newest models. How TOSWO treats such measures is described in how TOSWO measures AI risk, and other tests of this kind are collected under simulations.

Questions readers ask

What is a cyber time horizon?

It is the length of task, measured by how long human experts would take, that a model completes with a stated chance of success. AISI uses an 80% threshold in a setup with 2.5M tokens per task. It calls the measure inexact but useful for tracking trends.

How fast is AI cyber capability advancing according to AISI?

AISI estimated in February 2026 a doubling every 4.7 months since late 2024, and an earlier estimate of 8 months in November 2025. Claude Mythos Preview and GPT-5.5 then exceeded both trends. AISI says it is unclear whether this is a new, faster trend.

Did any model complete both of AISI's cyber ranges?

AISI reports that a newer Mythos Preview checkpoint did. It solved "The Last Ones" in 6 of 10 attempts and "Cooling Tower" in 3 of 10. GPT-5.5 solved "The Last Ones" on 3 of 10 attempts.

Does this show AI can attack real company networks?

No. AISI says the ranges are small, undefended enterprise networks with initial access already gained. It says the evidence does not show how these capabilities translate against defended, real-world systems.