Independent monitor · Global evidence

How much lead time do defenders have?

Published evidence on how fast AI cyber capability is rising, how quickly open-weight models follow, and what has actually been reported in the wild. Every number is sourced. We do not estimate missing values.

AISI is the primary comparable open-versus-closed cyber gap for the headline. Global peer research, laboratory disclosures and agency reporting broaden the evidence base.

Lead-time headline

4 to 7 months

On AISI's evaluations, leading open-weight models trail the closed frontier on cyber by this range (Jul 2026). Capability that is frontier-only today may be widely downloadable within months.

AISI, How far behind the frontier are leading open weight models on cyber? (Jul 2026)

Caveat: Range results are weaker evidence than narrow tasks. Gap narrowed from 6 to 10 months. Lab results are not real-world attack rates.

Published evidence

Capability, access and reporting

Plotted observations and published ranges only. No inferred attack-rate curve.

A · Frontier capability

Published capability signals

On AISI's evaluations, marked observations only. Hover or tap a point for its source and caveat.

Published apprentice-level result ICS range milestone, separate from percentage scaleDashed connector is for readability only, not data or a forecast.

Sources and caveats for plotted points

Late 2023: Apprentice-level cyber task success: 9%
AISI, Frontier AI Trends key findings (Dec 2025)
Lab task success rates on narrow tasks, not real-world attack rates. AISI notes the trend is not guaranteed to continue.
Late 2025: Apprentice-level cyber task success: 50%
AISI, Frontier AI Trends key findings (Dec 2025)
Lab task success rates on narrow tasks, not real-world attack rates. AISI notes the trend is not guaranteed to continue.
May 2026: First ever completion of the Cooling Tower ICS range: 3 of 10
AISI, How fast is autonomous AI cyber capability advancing? (13 May 2026)
Simulated industrial control range without active defenders. Not evidence of real-world OT compromise.

Global peer evidence

Three lenses on model capability

Independent evaluations and developer disclosures add context. Their tasks and scales differ, so they are never merged into one score.

METR

70 to 80%

Mar 2025

0Separate 0 to 100 scale100

Tasks under one hour

Midpoint shown only to register the published 70 to 80% range. HCAST combines machine learning, cyber, software and reasoning tasks, so this is not a cyber-only score and is not comparable with AISI points.

UC Berkeley RDI

about 20%

Jun 2025

0Separate 0 to 100 scale100

Vulnerability reproduction

Benchmark result for reproducing known vulnerabilities from source and descriptions. It is not a real-world exploitation rate and is not comparable with AISI task success.

Artificial Analysis

56 / 100

Sep 2026

0Separate 0 to 100 scale100

Defensive cyber index leaders

Live leaderboard snapshot. The 0 to 100 composite covers defensive vulnerability finding and patching only. It is not a task success percentage, attack rate or metric comparable with AISI.

Risk disclosures

Categorical only. No comparable score published.

Sep 2025
Google DeepMind, Frontier Safety Framework 3.0
Frontier Safety Framework defines tracked cyber capability levels
Jul 2026
Anthropic, Claude Opus 5 System Card
Lab system card reported a broader cyber evaluation suite
2026 system card
OpenAI Deployment Safety Hub, GPT-5.3-Codex cybersecurity
Lab system card treated the model as High cyber capability under its framework

B · Open-weight catch-up

Published cyber gap ranges

Most of 2025 compared with July 2026.

AISI, How far behind the frontier are leading open weight models on cyber?

Caveat: Published ranges are benchmark comparisons, not a forecast of future releases.

D · Curated incident count

Reported AI-orchestrated campaigns tracked

Count of curated, published incident rows only. This is not an estimate of global prevalence.

Last updated: 5 Oct 2026

Capability and reported activity

C · Dual evidence timeline

Co-occurrence on a timeline is not proof of cause.

Lab capability

2023 → 2026

Reported AI-orchestrated activity

CapabilityNewer Mythos Preview checkpoint: The Last Ones 6 of 10 (May 2026)

CapabilityFirst ever completion of the Cooling Tower ICS range: 3 of 10 (May 2026)

CapabilityLab system card reported a broader cyber evaluation suite (Jul 2026)

Reported activityTaiwan government confirms hybrid AI-agent campaign reporting (13 Aug 2026)

CapabilityLab system card treated the model as High cyber capability under its framework (2026 system card)

CapabilityArtificial Analysis Cyber Index leaders scored 56 (Sep 2026)

Published lab point Reported AI-orchestrated activity Context, not AI-attributed

Open full timeline

Sourced incident reporting

Reported AI-orchestrated activity

Independently corroborated

high confidence

Taiwan government confirms hybrid AI-agent campaign reporting

Taiwan’s digital affairs authorities confirmed a campaign against government networks using a hybrid of conventional techniques and open-source AI-agent tooling. Reuters and Taiwan’s national news agency reported the government confirmation.

Reuters, 13 Aug 2026 Focus Taiwan, 13 Aug 2026

Caveat: High confidence that the campaign occurred and was government-confirmed. The AI-orchestrated character is medium confidence because technical detail comes from private-sector analysis. Scale figures and attribution are not repeated here because they are not established in the government statement.

Reported AI-orchestrated activity

Self-reported by developer

medium confidence

AI-orchestrated espionage campaign reported by Anthropic

According to Anthropic, a group it assessed as state-sponsored used its coding agent to attempt intrusions into roughly 30 targets, with a small number of successes. Anthropic states the AI performed around 80 to 90% of tactical work, with 4 to 6 critical human decision points per campaign.

Anthropic, 13 Nov 2025 BBC News, 14 Nov 2025

Caveat: Self-reported by the AI developer. Independent researchers have questioned some claims. Not independently verified.

All incident reporting

Latest news

Daily reporting lane · live items

Last refreshed: 5 Oct 2026, 15:25 BST

28 Sept 2026·Artificial Analysis
Frontier
Policy
Artificial Analysis launches a cyber defence index
An independent composite compares agent performance on defensive vulnerability discovery and patching. Its score is not an attack-rate measure.
27 Aug 2026·NCSC
OT
Policy
NCSC warns of increased targeting of operational technology
Increased OT targeting across sectors globally, including the UK, with some limited real-world disruption. Not attributed to AI.
13 Aug 2026·Focus Taiwan
Incident
Policy
Taiwan confirms hybrid AI-agent cyber campaign reporting
Government confirmation supports the existence of the campaign, while autonomy, scale and attribution details remain more uncertain.
Jul 2026·AI Security Institute
Open-weight
How far behind the frontier are leading open weight models on cyber?
On AISI's evaluations, the open-weight cyber gap is estimated at 4 to 7 months, narrower than 6 to 10 months through most of 2025.
13 May 2026·AI Security Institute
Frontier
OT
How fast is autonomous AI cyber capability advancing?
A newer Mythos Preview checkpoint delivered the first completion of both AISI cyber ranges, including the Cooling Tower ICS range.

All news

Check your readiness

Lead Time Check is a sibling tool that helps you assess how prepared your organisation is.

Check your readiness

Subscribe to The AI Cyber Risks Briefing

A short weekly briefing, every Monday (UK time).