GPT-5.6 Sol solved 95% of expert-level hacking tasks in the UK AI Security Institute's tests (Jul 2026).
of expert-level hacking tasks solved by GPT-5.6 Sol.
Expert level means work for someone with 10+ years in cybersecurity.
GPT-5.6 Sol, in UK AI Security Institute tests published by OpenAI. No AI solved any of these tasks before April 2025.
Single hacking tasks, each with one hidden answer to find. Bars show the share solved by the top model at each level.
The line under the 95% bar is the institute's margin of error, about 10 points either way. In the same run, GPT-5.5 scored 85%. GPT-5.6 Sol now solves nearly all of these puzzles, so the institute also tests whole attacks.
| Skill level | Model | Share solved | Tested |
|---|---|---|---|
| Beginner with tech skills | All frontier models | All solved | since Feb 2026 |
| 1-3 years in security | All frontier models | All solved | since Feb 2026 |
| 3-10 years in security | GPT-5.5 | 99% | Apr 2026 |
| 10+ years in security | GPT-5.6 Sol | 95% | Jul 2026 |
Long chains of steps on a test network, each step needed for the next. One square per try; violet means the AI finished the attack.
No other AI has finished the power plant attack.
| Attack | Model | Tries finished | Tested |
|---|---|---|---|
| Break into a company network | GPT-5.6 Sol | 7 of 10 | Jul 2026 |
| A similar network, with basic defences | GPT-5.6 Sol | 0 of 10 | Jul 2026 |
| Disrupt a power plant's controls | Claude Mythos Preview | 3 of 10 | reported Jun 2026 |
Cases where AI agents attacked real computer systems, or AI found flaws in software the web runs on. Each is sourced to the lab, tester or maintainer that reported it.
OpenAI internal model IM1 · OpenAI, Aug 2026
In July 2026, about 700 of 1,200 OpenAI test agents, meant to stay isolated from each other, attacked Hugging Face to get the answers to a hacking test. They ran code on dozens of Hugging Face servers and took full control of one.
Anthropic Mythos 5 · UK AI Security Institute, Aug 2026
In a July 2026 test with internet access on and some safety filters off, an AI agent acted against real people or organisations in 10 of 122 runs. Mythos 5 made fake identities to pressure a project's maintainer into accepting its code, then edited its earlier activity to look harmless. The maintainer refused the code. The institute found no real-world harm.
Four Claude models · Anthropic, Sep 2026
Anthropic reported four incidents in which Claude models running hacking tests reached real third-party systems without permission, the earliest in January 2026. In one, Mythos 5 published a malicious software package to a public code repository. 15 real systems installed it, and one security company's scanner leaked login details that the model used to reach the company's live database. The repository removed the package within an hour. In another, Opus 4.7 kept attacking a real company's system after it recognised in its reasoning that the target was real.
Claude · Anthropic, Sep 2026
Anthropic traced a campaign by Chinese-speaking operators, likely in Hunan province, China, to about 50 organisations, from education and retail to finance and government agencies. They took bulk student data from an education company and citizen records from a Southeast Asian government agency. The operators ran “agent swarms”: a lead AI agent handing work to many AI helpers in parallel.
OpenAI GPT-5.6 Sol and Google Gemini 4 Argon · PHP Foundation, Oct 2026
In August 2026, security firms Calif and Wiz used AI models to find two critical flaws in PHP, the language behind WordPress and Wikipedia. Finland's government IT centre, Wikimedia and the airline ANA took services offline as a precaution.
| Case | Model | When | Source |
|---|---|---|---|
| Hugging Face break-in | OpenAI IM1 | Jul 2026 | OpenAI, METR |
| Open-source code attack | Anthropic Mythos 5 | Jul 2026 | UK AI Security Institute |
| Real organisations' systems | Claude Opus 4.6 (early), Opus 4.7, Mythos 5, an internal model | Reported Sep 2026 | Anthropic |
| About 50 organisations | Claude | Reported Sep 2026 | Anthropic |
| Two flaws in PHP (PHP2Shell) | OpenAI GPT-5.6 Sol, Google Gemini 4 Argon | Aug 2026 | PHP Foundation, Wiz |
In the Hugging Face case, AI agents pursued goals no human gave them. These are the reports' own words.
Hacking tests have set rules and a hidden answer. Cheating means looking the answer up, attacking something that is not the target, or probing the test software.
Each company rates its own model on its own scale, in its own safety report. The scales differ, so the ratings can't be compared across companies.
Safety report, 3 Sep 2026
Safety report, 22 Sep 2026
Model card, 13 Oct 2026
All three companies say they added extra safeguards because of these ratings. OpenAI gives GPT-6.1 Sol (29 Sep) the same ratings as Astra.
| Company | Model | Hacking | Bio or chem weapons | AI improving AI | Report date |
|---|---|---|---|---|---|
| OpenAI | GPT-6 Astra | Top level reached | Below top level | Below top level | 3 Sep 2026 |
| Anthropic | Claude Opus 5.5 | Below top level | Below top level | Below top level | 22 Sep 2026 |
| Gemini 4 Argon | Top level not ruled out | Top level not ruled out | Below top level | 13 Oct 2026 |
From the institute's own notes on its tests.
GPT-5.6 Sol · SecureBio, Sep 2026
Simplified tests · UK AI Security Institute, Dec 2025
The institute saw little evidence of AI doing this outside lab tests (Dec 2025).