I’ve written on and off for a few years about what happens when attackers gain access to capable AI, but perhaps I’ve been asking the wrong question.
What happens when AI no longer simply assists the adversary but becomes the attacker?
Booz Allen’s Cyber Weapon Index (CWI) try’s to measure this. Instead of testing if an AI model understands cyber security or can generate exploit code, researchers at Booz put leading models into an enterprise environment and measured what they could achieve.
Interestingly, the evidence coming from the frontier providers, which I discuss later, points towards the same change in offensive cyber capability.
From Knowledge to Capability
Cyber security benchmarks have traditionally been good at testing knowledge.
The CWI measures models operating autonomously against an enterprise network. Initially, only one of the 18 models tested could complete the full attack lifecycle. Less than a week later, another had reached the same threshold and five new models had entered the top 18.
The leader board was changing almost as soon as it was published. But full autonomy isn’t the only important finding. AI doesn’t need to master the entire attack lifecycle before the economics of a cyberattack begin to change.
AI Doesn’t Need to Become a Superhuman Hacker
The cyber industry, and investors, naturally focus on the most capable model. For defenders, the capability spreading through the rest of the field may matter more.
We know that reconnaissance, initial access and credential attacks can now be automated, attackers can scale the front end of their operations while reserving scarce human expertise for the difficult parts.
Traditional offensive operations have always come at a cost. Reconnaissance takes time, vulnerability research requires expertise and lateral movement requires judgement. Failed attacks need operators to understand what happened and try something else. Human attackers therefore have finite capacity.
AI doesn’t need to create a superhuman hacker. It needs to make competent cyberattacks economically scalable. The important metric may not be whether AI produces a better attacker, it could be how many attackers it allows one human to become.
Anthropic’s latest threat intelligence suggests this is no longer only an evaluation question. In real-world operations it disrupted between December 2025 and August 2026, AI was being used to execute and orchestrate cyber operations rather than simply assist human operators. Anthropic also found that an operating model previously associated with a state sponsored campaign had begun appearing across a much broader range of threat actors.
This is a useful correlation with the CWI and the capability being measured in controlled environments that were starting to see in the real world. Now we have actors being able to operate with the speed, scale and capability that previously required larger teams and rare specialist cyber expertise.
There is an issue here that doesn’t get the necessary headlines, in my view. Autonomous attacks are not free, not even in testing. Long-running agents can consume substantial token and compute budgets, they can fail unpredictably and often require repeated attempts. Today, some autonomous attacks may still be less attractive than using human expertise, but those economics are moving.
Across four generations of Claude, Anthropic found the amount of AI processing needed to successfully exploit a vulnerability fell by around 70%. In another experiment, the potential value of vulnerabilities discovered by AI was already comparable to the cost of running the models.
This isn’t evidence that autonomous cyberattacks are commercially viable at scale, as these are still controlled experiments. What ultimately matters to an attacker isn’t the number of tokens consumed, but the cost of a successful outcome.
Tomorrow’s Attackers, Yesterday’s Weaknesses
Sophisticated AI attackers don’t necessarily require increasingly sophisticated vulnerabilities, as much of the opportunity already exists.
Exposed infrastructure, weak credentials, unpatched vulnerabilities, insecure configurations and poorly protected legacy systems remain at large! Recent attacks against industrial environments are a useful reminder that AI can make specialist offensive techniques more accessible without changing the underlying security failure that made exploitation possible.
In my view, AI will transform the attacker much faster than it transforms the attack surface.
Attackers remain economically rational. They’ll adopt autonomous AI when it makes successful attacks cheaper, easier or more scalable than existing methods. We need to watch out for when autonomous offensive capability becomes not merely possible, but economically preferable.
Tomorrow’s autonomous attackers will continue to spend much of their time (sadly) exploiting yesterday’s security failures.
Capability Is Only Half the Problem
Open-weight models add an interesting dimension to the offensive AI problem.
Unlike models accessed through a provider controlled service, open-weight models make their underlying trained parameters available for others to download and run on their own infrastructure. This gives organisations greater control over deployment, but also means the original provider has far less control over how they are subsequently used.
Provider-controlled models can be surrounded by identity controls, monitoring, safeguards and restrictions on access to higher-risk cyber capabilities. I explored this recently in When Intelligence Becomes a Controlled Capability.
Once sufficiently capable open weights are distributed, models can be run privately, modified and connected to offensive tooling without the original provider remaining between the model and its operator.
This doesn’t necessarily make open models inherently dangerous. They bring substantial benefits for research, security, sovereignty and organisations that need greater control over their AI infrastructure.
However, the risk changes when advanced capability moves from the frontier into widespread use. We have two races in flight, greater frontier capability and the speed at which sufficient capability becomes widely reproducible.
The strategic risk isn’t simply that AI creates a better hacker. Open-weight models could help turn offensive cyber capability from scarce expertise into reproducible infrastructure.
The Evidence Is Converging
Anthropic has reported substantial improvements in complex multi-stage cyber operations, while still identifying weaknesses when models encounter unexpected obstacles during longer attacks.
OpenAI has gone further. It assesses Astra as having reached its critical cyber security capability threshold. With appropriate tools and access, OpenAI found the model capable of discovering previously unknown vulnerabilities and developing ways to exploit hardened systems without continuous human direction.
The UK’s AI Security Institute (AISI) is seeing a similar trajectory. Its cyber evaluations have found frontier models increasingly capable of progressing through extended corporate network attacks, with additional compute materially improving performance. Importantly, the results remain uneven. More difficult environments continue to expose limitations, reinforcing that autonomous offensive capability is advancing rapidly but isn’t yet universally reliable.
AISI’s research suggests that leading open-weight models may be only months behind the closed-model cyber frontier. Different evaluators are using different methodologies, but the direction of travel is becoming harder to ignore. Once capable autonomous systems can be replicated and operated in parallel, we’ll move beyond the automation of cyberattack towards its industrialisation.
The Model Is Only Part of the Weapon
The model may be the wrong unit through which to assess cyber risk.
Give a capable model tools, credentials, memory, infrastructure and permission to act and you’ve created something materially different from the model originally evaluated. Booz Allen found that the surrounding attack harness can significantly change offensive performance.
Anthropic’s latest threat intelligence points in the same direction, with agentic scaffolding increasingly being used to connect models to different stages of real-world offensive cyber operations. Organisations are increasingly deploying agents capable of accessing corporate data, executing code and interacting with other systems.
Attackers Don’t Have Change Control
Most enterprise security operations remain fundamentally human-speed organisations. Alerts enter queues, analysts investigate, incidents are escalated, decisions are made, changes are approved and eventually remediation follows.
Defenders are understandably cautious about allowing AI to isolate machines, disable accounts or modify production systems without human approval. Attackers have no equivalent governance problem, but this is not only a speed issue, it’s a capacity problem.
If offensive AI allows a small number of attackers to operate at far greater scale, defensive AI will need to multiply scarce defensive expertise as well.
For many organisations, particularly smaller critical infrastructure operators, the question will be whether AI gives the people they already have materially greater operational capability.
I don’t think the answer is unrestricted defensive autonomy. But organisations will need to decide where human authority remains essential and where controlled autonomy becomes necessary to operate at the speed and scale of the threat.
The Warning Is Bigger Than the Index
Anthropic’s latest threat intelligence suggests some of what the CWI is warning about may already be moving from evaluation environments into real-world operations.
Booz Allen is observing autonomous intrusion capability. Anthropic is seeing stronger multi-stage attack performance and emerging operational adoption. OpenAI now assesses that a frontier model has crossed its critical cyber capability threshold. AISI is independently observing the same broader capability trajectory.
Humans will not disappear from cyber operations, and maybe there is some good news for defenders.
AI changes the speed, scale and accessibility of attack. It doesn’t make the fundamentals of cyber security obsolete. If anything, it increases the cost of continuing to get them wrong. Tomorrow’s autonomous attackers will still spend much of their time exploiting yesterday’s security failures.
The Cyber Weapon Index (and other similar leader boards) should be treated less as a ranking of dangerous models and more as an early warning indicator. Because the most important number may not be the score at the top of the index. It may be how quickly advanced offensive capability becomes cheap, reproducible and available to everyone else.