UK AISI — New Mythos Checkpoint Completes Previously Unsolved Cyber Ranges
AI relevance: The UK government's AI Safety Institute independently re-tested a newer Mythos Preview checkpoint and found it completing cyber ranges that were unsolved a month earlier — providing a rare third-party measurement of autonomous AI attack capability improving within a single model version.
What happened
- The UK AISI published a blog post on May 14 testing a newer Mythos Preview checkpoint, just weeks after its initial evaluation of the original release.
- The newer checkpoint completed both of AISI's cyber ranges: it solved "The Last Ones" in 6 of 10 attempts and — critically — solved "Cooling Tower" in 3 of 10 attempts, marking the first time any model completed the second range.
- AISI updated its estimate of AI cyber capability growth: the length of cyber tasks models can complete has been doubling every 4.7 months since late 2024, an acceleration from the prior estimate of 8 months (November 2025).
- Both Claude Mythos Preview and OpenAI's GPT-5.5 substantially exceeded even that accelerated doubling-rate trend line.
- AISI noted the trend may not hold — Mythos and GPT-5.5 could represent notable breaks from the curve rather than a sustained new rate — but the direction is unambiguous.
- The testing underscores that capability improvements aren't confined to new model releases; they can happen within versions of a single model through checkpoint updates.
Why it matters
This is one of the few independent government lab evaluations of frontier AI cyber capabilities, and it measures improvement between checkpoints of the same model. The doubling-rate estimate — now at 4.7 months — puts a concrete timeline on how fast autonomous attack complexity is growing. For AI operators, this means the threat window for exposed agent infrastructure is shrinking faster than most patch cycles can match.
What to do
- Treat AI agent infrastructure as time-sensitive: if a vulnerability or misconfiguration is exposed, assume AI-capable attackers will find it within weeks, not months.
- Monitor AISI's ongoing evaluations for updated doubling-rate estimates and range completion data.
- Prioritize patching AI-facing components (model serving, MCP servers, agent toolchains) ahead of general IT infrastructure.