Independent monitor · Global evidence
Published evidence on how fast AI cyber capability is rising, how quickly open-weight models follow, and what has actually been reported in the wild. Every number is sourced. We do not estimate missing values.
AISI is the primary comparable open-versus-closed cyber gap for the headline. Global peer research, laboratory disclosures and agency reporting broaden the evidence base.
Lead-time headline
4 to 7 months
On AISI's evaluations, leading open-weight models trail the closed frontier on cyber by this range (Jul 2026). Capability that is frontier-only today may be widely downloadable within months.
Caveat: Range results are weaker evidence than narrow tasks. Gap narrowed from 6 to 10 months. Lab results are not real-world attack rates.
Why it matters
Every figure below is live from this monitor's published data, with its source and caveat.
Once a model's weights are published, anyone can download it, run it offline and strip out its safety training. The developer can no longer monitor use or withdraw access. So when open-weight models catch up with the frontier on cyber tasks, that capability is open to criminals and hostile states as well as to defenders.
1 · The catch-up window
4 to 7 months
On AISI's cyber evaluations, leading open-weight models trail the closed frontier by this range (Jul 2026), down from 6 to 10 months (Most of 2025). What only frontier labs can do today may be freely downloadable within months.
Caveat: Benchmark comparisons, not a forecast of future releases. Range results are weaker evidence than narrow tasks. Lab results, not real-world attack rates.
2 · Capability is climbing
9% to 50%
Success on apprentice-level cyber tasks by the best tested frontier model, Late 2023 to Late 2025. Today's frontier result is a preview of what open-weight models may match within the window above.
Caveat: Lab task success rates on narrow tasks, not real-world attack rates. AISI notes the trend is not guaranteed to continue.
3 · Industrial systems are in scope
3 of 10 attempts
In May 2026, a frontier model completed AISI's simulated industrial control system range for the first time. Plant and OT teams should expect open-weight models to follow.
Caveat: Simulated industrial control range without active defenders. Not evidence of real-world OT compromise.
4 · Misuse is already reported
2 campaigns
Reported AI-orchestrated campaigns tracked here. In August 2026, Taiwan's government confirmed a campaign against its networks that combined conventional techniques with open-source AI-agent tooling.
Caveat: A curated count of published reports, not global prevalence. The AI-orchestrated character of the Taiwan campaign is medium confidence, as technical detail comes from private-sector analysis.
What you can do: treat the lead-time range as your planning window. Read the open-weight evidence, review sourced incident reporting, and check your site's readiness with Lead Time Check.
Weekly reporting lane · live items
Last refreshed: 5 Oct 2026, 15:25 BST
An independent composite compares agent performance on defensive vulnerability discovery and patching. Its score is not an attack-rate measure.
Increased OT targeting across sectors globally, including the UK, with some limited real-world disruption. Not attributed to AI.
Government confirmation supports the existence of the campaign, while autonomy, scale and attribution details remain more uncertain.
On AISI's evaluations, the open-weight cyber gap is estimated at 4 to 7 months, narrower than 6 to 10 months through most of 2025.
A newer Mythos Preview checkpoint delivered the first completion of both AISI cyber ranges, including the Cooling Tower ICS range.
Taiwan’s digital affairs authorities confirmed a campaign against government networks using a hybrid of conventional techniques and open-source AI-agent tooling. Reuters and Taiwan’s national news agency reported the government confirmation.
Caveat: High confidence that the campaign occurred and was government-confirmed. The AI-orchestrated character is medium confidence because technical detail comes from private-sector analysis. Scale figures and attribution are not repeated here because they are not established in the government statement.
According to Anthropic, a group it assessed as state-sponsored used its coding agent to attempt intrusions into roughly 30 targets, with a small number of successes. Anthropic states the AI performed around 80 to 90% of tactical work, with 4 to 6 critical human decision points per campaign.
Caveat: Self-reported by the AI developer. Independent researchers have questioned some claims. Not independently verified.
Global peer evidence
Independent evaluations and developer disclosures add context. Their tasks and scales differ, so they are never merged into one score.
METR
70 to 80%
Tasks under one hour
Midpoint shown only to register the published 70 to 80% range. HCAST combines machine learning, cyber, software and reasoning tasks, so this is not a cyber-only score and is not comparable with AISI points.
UC Berkeley RDI
about 20%
Vulnerability reproduction
Benchmark result for reproducing known vulnerabilities from source and descriptions. It is not a real-world exploitation rate and is not comparable with AISI task success.
Artificial Analysis
56 / 100
Defensive cyber index leaders
Live leaderboard snapshot. The 0 to 100 composite covers defensive vulnerability finding and patching only. It is not a task success percentage, attack rate or metric comparable with AISI.
Risk disclosures
Categorical only. No comparable score published.
Sep 2025
Google DeepMind, Frontier Safety Framework 3.0Frontier Safety Framework defines tracked cyber capability levels
Jul 2026
Anthropic, Claude Opus 5 System CardLab system card reported a broader cyber evaluation suite
2026 system card
OpenAI Deployment Safety Hub, GPT-5.3-Codex cybersecurityLab system card treated the model as High cyber capability under its framework
Published evidence
Plotted observations and published ranges only. No inferred attack-rate curve.
A · Frontier capability
On AISI's evaluations, marked observations only. Hover or tap a point for its source and caveat.
Late 2023: Apprentice-level cyber task success: 9%
AISI, Frontier AI Trends key findings (Dec 2025)Lab task success rates on narrow tasks, not real-world attack rates. AISI notes the trend is not guaranteed to continue.
Late 2025: Apprentice-level cyber task success: 50%
AISI, Frontier AI Trends key findings (Dec 2025)Lab task success rates on narrow tasks, not real-world attack rates. AISI notes the trend is not guaranteed to continue.
May 2026: First ever completion of the Cooling Tower ICS range: 3 of 10
AISI, How fast is autonomous AI cyber capability advancing? (13 May 2026)Simulated industrial control range without active defenders. Not evidence of real-world OT compromise.
B · Open-weight catch-up
Most of 2025 compared with July 2026.
Caveat: Published ranges are benchmark comparisons, not a forecast of future releases.
D · Curated incident count
2
Count of curated, published incident rows only. This is not an estimate of global prevalence.
Last updated: 5 Oct 2026
C · Dual evidence timeline
Co-occurrence on a timeline is not proof of cause.
Lab capability
2023 → 2026
Reported AI-orchestrated activity
Lead Time Check is a sibling tool that helps you assess how prepared your organisation is.
Check your readiness