Published April 13, 2026 by the UK AI Security Institute, in its Cyber & Autonomous Systems category. It evaluates Claude Mythos Preview, announced by Anthropic on April 7, 2026, and is the evaluation AISI's later GPT-5.5 report takes as its baseline.
AISI's stated framing is that the result is a step up within an already-fast trend rather than a discontinuity: Mythos Preview "represents a step up over previous frontier models in a landscape where cyber performance was already rapidly improving." The post situates the measurement in AISI's own evaluation history, which it dates to 2023 and describes as a progression "from chat-based probing, to capture-the-flag challenges, to the multi-step cyber-attack simulations" — noting that two years earlier "the best available models could barely complete beginner-level cyber tasks."
Capture-the-flag results
The capture-the-flag suite asks models to identify and exploit weaknesses in target systems to retrieve hidden "flags," with results reported as average success rate at a given difficulty level. AISI reports that on expert-level tasks — a tier no model could complete before April 2025 — Mythos Preview succeeds 73% of the time.
The published charts are images and their underlying data is not in the page; the captions record the run parameters. Non-expert and apprentice-level results run from GPT-3.5 Turbo to Mythos Preview, with models through Claude 4 Opus averaging 10 runs up to 2.5M tokens and models from GPT-5 onward averaging 5 runs up to 2.5M tokens. Practitioner and expert-level results cover models since August 2025, all averaging 5 runs up to 50M tokens.
AISI's later GPT-5.5 evaluation reports Mythos Preview at 68.6% (±8.7%) rather than 73%. The two figures are not in conflict: the April 30 report averages across a combined set of 27 Practitioner and 21 Expert tasks, while the 73% figure here is stated for expert-level tasks alone (Our evaluation of OpenAI's GPT-5.5 cyber capabilities (UK AISI, April 2026)).
Cyber range results
AISI's stated reason for building ranges is that "even expert-level CTFs only test specific skills in isolation," whereas real attacks "require chaining dozens of steps together across multiple hosts and network segments." "The Last Ones" (TLO) is a 32-step corporate network attack simulation spanning initial reconnaissance through full network takeover, which AISI estimates would require a human 20 hours to complete. A fuller description is in the companion range paper, arXiv:2603.11214, which is not held here.
Claude Mythos Preview is the first model to solve TLO from start to finish, in 3 of its 10 attempts. Across all attempts it completed an average of 22 of 32 steps; Claude Opus 4.6, the next best performer, averaged 16.
Figure 3's caption records the comparison set and run counts: Mythos Preview, Opus 4.6 and GPT-5.4 average 10 runs up to 100M tokens; Opus 4.5, GPT-5.1 Codex and Sonnet 4.5 average 15 runs up to 10M and 5 runs up to 100M; GPT-5.3-Codex averages 10 runs up to 10M and 5 up to 100M; Sonnet 3.7 and GPT-4o average 10 runs up to 10M only.
Two limits on the result are stated in the same section. Mythos Preview could not complete "Cooling Tower," AISI's operational-technology range — but AISI adds that this "does not necessarily show that the model is bad at executing attacks in operational technology (OT) environments," because the model got stuck on the range's IT sections. And performance had not plateaued at the budget tested: AISI ran the ranges to 100M tokens, states that Mythos Preview's performance "continues to scale up to this limit," and expects improvements beyond it.
What AISI concludes, and declines to conclude
The conclusion is stated with an explicit floor and an explicit precondition: success on one range indicates the model is "at least capable of autonomously attacking small, weakly defended and vulnerable enterprise systems where access to a network has been gained."
AISI then limits the inference in the same paragraph. Its ranges "have important differences from real-world environments that make them easier targets" — they lack active defenders and defensive tooling, and impose "no penalties for the model for undertaking actions that would trigger security alerts. This means we cannot say for sure whether Mythos Preview would be able to attack well-defended systems." This is an absence of evidence rather than a finding of inability, and AISI treats the question as open: its stated future work is to evaluate against "ranges simulating hardened and defended environments, including ranges with active monitoring, endpoint detection and real-time incident response," and to track AI-enabled vulnerability discovery and penetration testing against real systems. The defended counterpart range, "Doing Life," is recorded in the Fable 5 / Mythos 5 system card as unsolved by any model tested.
AISI also argues the evaluation regime itself must change: as capabilities improve, "evaluation environments that lack defences will no longer be challenging enough to discriminate between the capabilities of the most cyber-capable models or assess trends."
Defensive guidance
The post's closing section addresses organisations rather than developers. AISI states that Mythos Preview "can exploit systems with weak security posture, and it is likely that more models with these capabilities will be developed," and points to security basics — regular application of security updates, robust access controls, security configuration, and comprehensive logging — alongside the National Cyber Security Centre's Cyber Essentials scheme. It describes AI cyber capabilities as dual use, noting a joint AISI–NCSC post on how defenders can harness and prepare for frontier AI.
Provenance and citation fidelity
Captured from AISI's own domain. The evaluation subject is an early preview snapshot, not shipped Claude Mythos: AISI's later GPT-5.5 post describes it as "an early snapshot of Anthropic's Claude Mythos Preview," and its post on the pace of autonomous cyber capability notes AISI subsequently received access to a newer checkpoint.
The conclusion sentence is quoted in altered form by Could rogue agent swarms take over the entire internet in the next six months? (Marcus, Hamiel and Korman, September 2026), which renders it as Mythos being able to "autonomously compromise [only] small, weakly defended vulnerable systems." Four differences from the published text run in the same direction: compromise replaces attacking; enterprise is dropped, widening the subject from corporate networks to systems generally; the network-access precondition is dropped, though it is the condition under which the result was obtained; and the essay's bracketed [only] — marked as its own insertion — converts AISI's floor ("at least capable of") into a ceiling.
Relationships
- supports: Claude Mythos Preview — the first independent pre-deployment cyber evaluation of the preview
- contradicts: Could rogue agent swarms take over the entire internet in the next six months? (Marcus, Hamiel and Korman, September 2026) — the essay's quotation inverts the modality of this report's conclusion
- related: Our evaluation of OpenAI's GPT-5.5 cyber capabilities (UK AISI, April 2026) — the successor evaluation that takes this result as its baseline
- related: How Far Behind the Frontier are Leading Open Weight Models on Cyber? (UK AISI, July 2026), UK AISI / CAISI Preliminary Assessment of Kimi K3's Cyber Capabilities (July 2026) — later AISI results on the same TLO range
- related: System Card: Claude Fable 5 & Claude Mythos 5 (Anthropic, June 2026) — records Mythos 5 matching this result at 6/10, and the unsolved defended range
- related: AI and Cybersecurity, Autonomous cyber-agents, AI Benchmarks and Evaluation, UK AI Safety Institute (AI Security Institute)