Credit: Getty Images

Last week, Anthropic announced it was restricting the initial release of its Mythos Preview model to “a limited group of critical industry partners,” giving them time to prepare for a model that it said is “strikingly capable at computer security tasks.” Now, the UK government’s AI Security Institute (AISI) has published an initial evaluation of the model’s cyber-attack capabilities that adds some independent public verification to those Anthropic reports.

AISI’s findings show that Mythos isn’t significantly different from other recent frontier models when it comes to tests of individual cyber-security related tasks. But Mythos could set itself apart from previous models through its ability to effectively chain these tasks together into the multi-step series of attacks necessary to fully infiltrate some systems.

“The Last Ones” finally falls

AISI has been putting various AI models through specially designed Capture the Flag challenges since early 2023, when GPT-3.5 Turbo struggled to complete any of the group’s relatively low-level “Apprentice” tasks. Since then, performance of subsequent models has risen steadily, to the point where Mythos Preview can complete north of 85 percent of those same Apprentice-level CTF tasks.

While that’s technically a high-water mark for AISI’s CTF tests, recent competing models like GPT-5.4 and Anthropic’s own Opus 4.6 and Codex 5.3 showed comparable results (within 5 to 10 percent accuracy) across multiple CTF difficultly levels in recent months. That doesn’t seem like a level of improvement that would necessitate the kind of protectionist limited release Anthropic has undertaken for Mythos Preview.

Where Mythos showed more relative cyber-attack potential, though, is in “The Last Ones” (TLO), a test range that AISI set up to simulate a 32-step data extraction attack on a corporate network. The test, which requires “chaining dozens of steps together across multiple hosts and network segments” was intended to simulate the kind of sustained operations that would take a trained human roughly 20 hours to complete, AISI estimates.

Here, Mythos outshined all previous models, becoming “the first model to solve TLO from start to finish,” AISI said. While Anthropic’s new model only succeeded in 3 out of 10 attempts, even the average Mythos Preview run got through 22 of the 32 required infiltration steps, significantly higher than the 16-step average achieved by Claude 4.6.

Mythos Preview still has its limitations, though. AISI points out that the model still struggles with “Cooling Tower,” an even more difficult seven-step test designed to simulate an attempted disruption of the control software for a power plant. But AISI also writes that it expects “our evaluations would continue to improve with more inference compute” past the 100 million token budget imposed for its tests.

Small, weakly defended systems beware

Overall, Mythos’ performance on TLO suggests that the model “is at least capable of autonomously attacking small, weakly defended and vulnerable enterprise systems where access to a network has been gained,” AISI writes. That said, the group cautions that its simulated cyber ranges lack the kind of active defenders and defensive tooling often present in critical real-world systems. AISI’s TLO test is also designed to have specific vulnerabilities that might not exist in real-world systems and doesn’t penalize models for the kind of detection that might cause a real-world infiltration attempt to fail.

For those reasons, AISI says it can’t be sure whether “well-defended systems” would fall to an automated attack from Mythos Preview. But as future models match or outperform Mythos’ capabilities, AISI warns that those designing system protections should similarly utilize AI models to help harden their defenses.