The U.K.’s AI Security Institute found OpenAI’s GPT-5.5 can autonomously execute complex cyberattacks, completing a 32-step corporate network simulation in two of ten attempts. The model also solved a reverse-engineering challenge in just over 10 minutes, a task requiring 12 hours for a human expert. Researchers warned offensive AI cyber capabilities are improving rapidly and identified a universal jailbreak that bypassed the model’s safety guardrails.
A U.K. government agency has found that OpenAI’s newest artificial intelligence model can autonomously carry out complex cyberattacks. The AI Security Institute (AISI) published findings showing GPT-5.5 is among the strongest models it has evaluated for offensive cyber capabilities, roughly on par with Anthropic’s Claude Mythos.
The report found GPT-5.5 is the second model to complete AISI’s most demanding test, a 32-step simulated corporate network attack called “The Last Ones.” It did so autonomously in two out of 10 attempts, a simulation AISI estimates would take a human expert around 20 hours.
Perhaps the most striking result involved a fiendishly difficult reverse-engineering puzzle. GPT-5.5 solved the challenge in 10 minutes and 22 seconds, at a cost of $1.73 in API usage, while a human expert required approximately 12 hours. On AISI’s battery of advanced cybersecurity tasks, GPT-5.5 achieved an average pass rate of 71.4% on the most difficult “Expert” tier.
AISI concluded that GPT-5.5‘s performance suggests rapid improvement in cyber capabilities may be part of a general trend. The agency warned that further advances could arrive in quick succession if offensive cyber skill is emerging as a byproduct of wider AI improvements.
The report also flagged significant concerns about the model’s safety guardrails. Researchers identified a universal jailbreak that elicited harmful content across all malicious cyber queries tested, an attack that took six hours of expert red-teaming to develop.
The findings land against a worrying backdrop detailed in the U.K. government’s annual Cyber Security Breaches Survey, which found that 43% of businesses suffered a cyber breach or attack in the past 12 months. In response, the government announced approximately $110 million in new funding to boost cyber resilience.
