AI Offensive Cyber Capabilities Are Doubling Every 5.7 Months
Agentic AIAI offensive cyber capabilities have been doubling every 9.8 months since 2019. Since 2024, that rate has accelerated to every 5.7 months. Researchers at Lyptus Research, an AI safety firm, say their findings may still be an underestimate.
The research used the METR time-horizon method — an evaluation framework that measures how long a task takes a human expert, then tests whether AI systems can complete equivalent tasks autonomously. Lyptus evaluated 291 tasks with 10 professional security experts as the human baseline, then ran frontier models against the same task set.
What the Numbers Actually Mean
The “doubling” refers to task complexity, not raw capability claims. At the current frontier, both Opus 4.6 and GPT-5.3 Codex achieved a 50% success rate on offensive security tasks that would take human experts approximately three hours — using a two-million-token budget per task. With a ten-million-token budget, GPT-5.3 Codex reached the equivalent of 10.5 hours of human expert work.
Open-source models trail by approximately 5.7 months — meaning today’s frontier capability becomes open-source capability in roughly the same window as the current doubling rate. The full dataset is publicly available on GitHub and Hugging Face, allowing independent verification.
The compound effect of this rate is the critical variable. Doubling every 5.7 months means a capability that can handle three-hour tasks today reaches six-hour tasks by October, twelve-hour tasks by April 2027. Capabilities that are currently expensive and specialized become accessible and cheap on a similar schedule.
Why the Rate Matters More Than the Level
Current AI offensive capabilities are already significant enough to concern defenders — but the slope matters as much as the current position. Most enterprise security investments are calibrated against today’s threat baseline with modest buffer for future capability growth. If that baseline is growing at 5.7 months per doubling, security architectures designed for 2025’s AI threat profile will be misaligned with 2026’s.
The research also underscores a structural asymmetry: offensive AI capabilities benefit from the same model improvements that drive productivity gains in software development and analysis. AI safety work focused on agentic threat surfaces is attempting to get ahead of this curve, but the gap between offensive capability growth and defensive tooling maturity remains wide.
The So What
For security teams and platform engineers, the Lyptus findings suggest two concrete responses. First, threat modeling should incorporate capability growth curves, not just current AI offensive baselines. A penetration testing framework built around what AI can do today is stale faster than traditional tooling assumed. Second, the 5.7-month doubling window is tight enough that annual security reviews are the wrong cadence. The environment is changing quarterly. Teams that reassess their agentic attack surface on a quarterly cycle — and specifically track METR-benchmark equivalent capabilities in current frontier models — are better positioned than those relying on annual assessments.
Photo by cottonbro studio on Pexels
Source: The Decoder
Content created with AI assistance and reviewed for accuracy.
Join the conversation
Stack Insiders is our free community for readers who want to go deeper — share resources, ask questions, and connect with others across every vertical we cover.
Join Stack Insiders →