Autonomous Cyberattacks Leave Companies Six Months to Accelerate Their Defenses

A Model Has Completed an Entire Compromise on Its Own

Cyberattacks conducted by artificial intelligence agents are no longer limited to individual tasks such as writing malicious code or analyzing a vulnerability. At least one frontier model has demonstrated that it can autonomously manage the entire compromise of a realistic enterprise network, from identifying weaknesses to executing the attack.

On September 2, Booz Allen confirmed that Anthropic's Mythos 5 had operated as an autonomous hacker in a production-grade enterprise environment. The company also introduced the Cyber Weapon Index, or CWI, a metric designed to assess two capabilities together: identifying and exploiting vulnerabilities, then continuing the operation against a target.

Mythos 5 scored 80 points. Its closest competitor, SpaceXAI's Grok-4.5, scored 49.

The result does not mean that autonomous systems are already reliable in every scenario. It does show, however, that the complete offensive chain can be executed without requiring human instructions at every step. That is the significant leap.

Brad Medairy, president of Booz Allen's National Cyber practice, estimates that substantial parity between frontier models and Chinese models could emerge within roughly six months. This is not a firm deadline, but a preparation window: once similar capabilities are available across multiple platforms, cost and scale could matter more than the top spot in the rankings.

Tests Show Real Autonomy, but Not Yet Consistent Reliability

The CWI results are consistent with assessments conducted by the AI Security Institute, a research arm of the UK government's Department for Science, Innovation, and Technology.

In June, the institute reported that Mythos had completed an end-to-end attack chain during capture-the-flag contests. In the same context, OpenAI's GPT-5.5 completed a sequence consisting of 32 steps.

Success rates remain limited. Mythos completed the attack in three out of ten attempts, while GPT-5.5 succeeded in two out of ten. Both therefore remained below 50%.

The figure should be interpreted cautiously, but not dismissed. A success rate of 20% or 30% may seem low when evaluating a single attempt; it becomes more serious when an attacker can run numerous attempts in parallel, without fatigue and at progressively lower marginal cost.

Automation also changes the nature of the risk. A system capable of maintaining state across phases can reconstruct the exposed attack surface, select an exploit, verify the access it has gained, and search for new targets. It does not merely automate a command: it orchestrates a path.

The current rankings are therefore less important than the speed at which less advanced models can close the gap. If a cheaper system achieves sufficient performance, autonomous attacks may become economically viable without being flawless.

The Attack on Taiwanese Servers Shows How Timelines Are Compressing

Laboratory tests are not the only signal. In July, a Chinese-speaking cyber-threat group attacked Taiwanese government servers in an operation conducted over four days.

According to an analysis by Tenable, the agents involved in the activity autonomously decided which systems to map, which techniques to retrieve from public sources, and when to expand the operation into other sectors. They reportedly did not receive detailed human instructions for every individual action.

Tenable linked the case to about half a dozen other AI-powered attacks. It is not known how much of the operation was fully autonomous and how much depended on human supervision. The operational advantage is already visible, however: many reconnaissance, technique-selection, and execution activities can be compressed into a much shorter window.

This calls into question the response times commonly used by companies. A response within four hours may be considered fast for a human team, but it could come after an agent has already enumerated multiple systems, tried several paths, and begun lateral movement.

The advantage does not necessarily come from more sophisticated exploits. It may come from volume: more attempts, against more assets, conducted simultaneously.

Open-Weight Models and Harnesses Could Lower the Cost of Attacks

The acceleration may come not only from frontier models, but also from open-weight models. These models allow more direct control over execution and can reduce the costs and restrictions associated with proprietary services.

Nico Waisman, CISO at offensive cybersecurity vendor XBOW, reports a significant improvement in the company's cyber capabilities. If an open-weight model becomes effective enough, offensive automation could become the option with the best economic return rather than remaining an experimental demonstration.

The economics depend on at least three variables:

• token and infrastructure costs;
• the percentage of attacks completed successfully;
• overall capability as measured by indicators such as the CWI.

The underlying model is only one part of the system. Harnesses—the combination of tools, procedures, operational memory, controls, and orchestration components that allow AI to act—also play a decisive role.

XBOW combined commercially available models, human expertise, and proprietary harnesses to identify six vulnerabilities in Google Chrome and organize them into two attack chains. The advantage did not come from exclusive access to a more powerful model, but from the integration of software, operational tools, and specialized personnel.

Evaluating an offensive agent therefore requires examining which commands it can execute, which sources it can consult, how much autonomy it has, and whether it retains context across different phases. The permissions it requires and the presence of human checks also matter.

Noise Remains a Limitation, but It Could Decline

The Cyber Weapon Index does not adequately measure stealth. Current agents tend to be noisy: they generate many requests, attempts, and easily observable events because they have not been optimized to conceal their activity.

This characteristic gives defenders a temporary advantage. Aggressive scans, repeated authentication attempts, anomalous access, and automated sequences can feed effective detection rules.

It would not be prudent, however, to treat that noise as a permanent feature. More mature harnesses could reduce unnecessary attempts, spread activity over time, and select techniques more effectively. Experienced operators could also make an agent more discreet.

Booz Allen is also proposing deception-based countermeasures in the short term. The Guile solution inserts false leads, unproductive paths, and dead ends designed to confuse automated agents.

According to Medairy, models fail when faced with these deceptions in more than 90% of cases, while humans rarely make the same mistakes. Deception can therefore slow automation, but it does not replace segmentation, access controls, and monitoring. It is an additional barrier.

How to Build a Defense That Can Respond at Machine Speed

Applying patches alone is not enough. Vulnerability remediation remains essential, but no organization can eliminate every exposure immediately. An autonomous agent can search for the path that remains open while the team is fixing the one it has already identified.

The first priority is to map critical assets, dependencies, and the paths that can be used to extend a compromise. Accounts, systems, and segments should have limited privileges so that a single breach does not provide access to the entire infrastructure.

Companies must then automate the steps that currently slow the defensive cycle:

• detection-rule optimization;
• event triage and enrichment;
• alert prioritization;
• isolation of compromised assets;
• deployment of repetitive countermeasures;
• continuous verification of control effectiveness.

Companies should also test containment, not just prevention. A useful simulation should measure how quickly credentials can be blocked, a system segmented, and lateral movement interrupted.

The next six months are not a firm prediction that a universal, infallible attack will arrive. They are instead the period in which to prepare for the convergence of three factors that are already observable: more capable models, better harnesses, and lower costs.

A defense that relies primarily on manual decisions starts at a disadvantage. The goal is not to eliminate human involvement, but to reserve it for critical decisions while automating detection, verification, and containment at the same speed at which agents can attack.