What Can AI Hack? Inside Frontier Labs' Tests

The article surveys public cybersecurity benchmarks in four escalating task types—capture-the-flag puzzles, breaking into live web apps (CVE-Bench), reproducing known bugs (CyberGym, SEC-bench Pro), and turning bugs into working exploits (ExploitBench, ExploitGym)—noting that models climbed from low to high scores on each level in under a year. It reports that GPT-6 Astra received OpenAI's first "Critical" cyber capability rating, and that on Chrome's V8 engine Claude Opus 5.5 reached code execution in 73% of ExploitBench runs by September 2026. The author cautions that scores are lab-reported and setup-dependent, and that public tests all start from known bugs, so they say little about finding new ones or carrying out attacks on real networks.