Claude Mythos: The First AI to Complete a 32-Step Enterprise Cyberattack
Agentic AIClaude Mythos Preview is the first AI model to complete a 32-step simulated corporate network takeover end to end — doing so in 3 of 10 attempts, at a task complexity that typically requires 20 hours of manual work by a human attacker.
Context
The UK AI Safety Institute’s independent evaluation of Claude Mythos Preview isn’t a benchmark release in the traditional sense. Anthropic has not made the model publicly available. Instead, access is restricted to approximately 50 organizations through Project Glasswing — a consortium that includes Amazon, Apple, Microsoft, Cisco, CrowdStrike, Google, and NVIDIA — explicitly because of the model’s security capabilities. The AISI evaluation provides the most detailed public accounting of what those capabilities are.
The evaluation arrives in a specific context. AI offensive cyber capabilities have been escalating across successive model generations, but prior progress remained incremental. Expert-level Capture-the-Flag challenges — tasks that no model could complete before April 2025 — now see a 73% success rate from Mythos Preview. That’s a qualitative shift, not a marginal improvement.
The Detail
The primary benchmark was “The Last Ones” (TLO), a cyber range simulation spanning a complete corporate network attack chain: reconnaissance through full network takeover across multiple segments. Human specialists estimate 20 hours to complete the 32-step sequence manually. No AI model had previously completed it end to end.
Mythos Preview completed the full sequence in 3 out of 10 attempts. Across all attempts, it averaged 22 of 32 steps. Claude Opus 4.6 — itself a capable model — averaged 16 steps in the same evaluation. The gap between generations is substantial: 22 versus 16 completed steps represents a different class of sustained, multi-stage attack capability.
AISI’s methodology used three progressive testing layers: chat-based probing for initial capability assessment, isolated CTF challenges targeting specific skills, and multi-step attack simulations spanning network segments. Token budgets reached 100 million tokens for comprehensive testing, with researchers finding that performance continued to scale to that limit — the model did not plateau.
The evaluation identifies two clear constraints. Mythos Preview failed to complete the operational technology (OT/ICS) range, where it got stuck on IT sections rather than demonstrating specific OT-layer weakness — a distinction AISI was careful to draw. The simulated ranges also lacked active defenders and defensive monitoring, meaning results should be read as performance against weakly defended systems with access already established, not hardened production environments with active incident response.
The So What
The AISI report is a careful document. It distinguishes clearly between what Mythos Preview can do in controlled conditions and what it would accomplish against real defended infrastructure. Those caveats matter: enterprise security teams with active monitoring, hardened configurations, and incident response capacity are not equivalent to the simulated environments tested.
But the directional implication doesn’t disappear. A model that completes 3 of 10 end-to-end enterprise attack chains in simulation — where its predecessor averaged half as many steps — represents a measurable capability shift. The restricted distribution through Project Glasswing reflects Anthropic’s judgment that the model’s offense profile warrants controlled access. The practical question for security teams is how that profile translates as similar capabilities proliferate across model generations. AISI’s data gives defenders a concrete benchmark to plan against.
Photo by Tima Miroshnichenko on Pexels
Source: UK AI Safety Institute
Content created with AI assistance and reviewed for accuracy.
Join the conversation
Stack Insiders is our free community for readers who want to go deeper — share resources, ask questions, and connect with others across every vertical we cover.
Join Stack Insiders →