ai risk today logo svg bl font
Menu
SUBSCRIBE
SUBSCRIBE
ai risk today logo svg bl font
Menu

NCSC

Blurred photo of a computer monitor showing dense multicolored code, from the UK government's AI vulnerability scanning pilot 2026.

UK Government Finds 407 Cyber Vulnerabilities Using Frontier AI

, , , , , , , , , , ,

The GC3’s month-long scanning program across nine departments uncovered critical flaws, including one that let any outsider run code on a government server by posting a comment.

 

The Government Cyber Coordination Centre (GC3), a partnership between the National Cyber Security Centre (NCSC) and the Department for Science, Innovation and Technology, published a case study on 12 June 2026 detailing a month-long series of weekly hackathons. Hacker teams used AI vulnerability scanning to review public code repositories across nine UK government organizations, working with frontier AI models including Claude Mythos and GPT-5.5. They identified 407 security flaws, including critical weaknesses that could let attackers bypass login controls, access sensitive data, or run code directly on government servers.

The most significant find: a flaw in a code repository used by a major government service that let any outsider run code directly on the government’s server by posting a comment. From there, an attacker could have used those credentials to approve code changes, reach connected systems, and remove any trace of the intrusion.

 

Teams built three distinct approaches.

  • One put each code repository through a six-stage AI pipeline, with each stage reviewing and pushing back on the conclusions of the one before it.
  • A second ran standard security scanning tools first to generate an initial list of potential issues, then used AI to trace how those issues could be chained into an actual attack.
  • A third built five custom AI tools that turned a complex audit across hundreds of services into something repeatable.

 

The GC3 drew four conclusions.

  1. Structure beats model choice. Teams that gave AI a defined job at each step consistently outperformed those using it without a clear structure.
  2. The specific AI model matters less than expected. With the right structure, slightly older models performed as well as the latest frontier ones at scanning code.
  3. AI finds potential issues faster than humans can check them. If the AI isn’t given clear boundaries on where to look, it flags far more potential issues than the security team has time to investigate.
  4. Finding vulnerabilities and fixing them are separate problems. All critical issues were patched through existing processes, but generating the actual fixes still requires human review.

 

GC3 will run a second phase with more departments, additional models, and coverage of government code that isn’t published publicly. AISI and NCSC will deepen involvement as the program moves further from controlled testing into live environments.

Abstract digital visualization of multiple translucent data panels with warning and alert icons flowing toward a glowing blue security shield with a checkmark, representing frontier AI's autonomous cyber threat capabilities

Frontier AI Can Now Execute Autonomous Cyberattacks. The Pace Is Accelerating.

, , , , , , , , , , , , ,

Key Takeaways

  • Frontier AI models can now autonomously execute cyberattacks against enterprise networks without human direction. Anthropic’s Mythos completed both of AISI’s simulated network attack exercises, including “Cooling Tower,” which no prior model had ever solved.
  • Autonomous cyber capability has doubled every 4.7 months since late 2024; Claude Mythos Preview and GPT-5.5 significantly exceeded that rate. 
  • Defenders and attackers have access to the same tools. Cyber defenders already report significant advances in vulnerability discovery using recent models.
  • AISI warns that cyber attackers will soon gain access to the same frontier AI models that are currently limited to a small pool of large tech companies, government organizations, and cyber experts. The time for organizations to invest in strong security is now.

AISI published new data confirming that frontier AI models can autonomously complete cyberattacks against enterprise networks. The rate at which those capabilities are improving is accelerating.

This is not a theoretical risk. AISI’s most recent testing found that Mythos successfully completed autonomous attacks against two simulated enterprise networks in the majority of attempts. One of those networks, “Cooling Tower,” had never been solved by any prior model.

AISI measures this progress using “time horizon” benchmarks: the time it takes a frontier model to reliably complete a task on its own, compared to how long the same task would take a human cyber expert. Since late 2024, that capability has been doubling every 4.7 months, itself an acceleration from the 8-month doubling time AISI reported in November 2025. Two recent models, Claude Mythos Preview and GPT-5.5, substantially exceeded even that faster trend.

Currently, access to Mythos and GPT-5.5 is gated. Anthropic granted access to only a few dozen organizations, including big tech companies, cybersecurity firms, and U.S. and allied government organizations. OpenAI limits access to GPT-5.5 through its Trusted Access For Cyber program, vetting users to ensure security. Over time, cybercriminals will find ways to access these tools and exploit cyber vulnerabilities. AISI stresses the time to implement strong security governance is now. 

AISI is developing tougher evaluation tools, including new cyber ranges with active defenses, to keep pace with model progress. The UK’s National Cyber Security Centre (NCSC) has published guidance on using AI models to find vulnerabilities.