UK AISI Assessment Report: GPT-5.5 Cybersecurity Capabilities and Public Availability Raise Governance Concerns

UK AI Safety Institute Releases GPT-5.5 Cybersecurity Assessment Report

The UK AI Safety Institute (AISI) recently published its assessment report on OpenAI's latest model, GPT-5.5, focusing on its cybersecurity capabilities. The institute had previously completed a similar assessment of Anthropic's Claude Mythos. The report's core conclusion is that GPT-5.5's ability to discover security vulnerabilities is on par with Claude Mythos, but the critical difference is that GPT-5.5 is already publicly available, making security governance concerns significantly more pressing.

AISI Assessment Background and Methodology

AISI's Role and Mission

The UK AI Safety Institute is one of the few official organizations worldwide dedicated to safety assessments of frontier AI models. AISI was formally established following the Global AI Safety Summit (Bletchley Park Summit) hosted by the UK in 2023. Operating under the Department for Science, Innovation and Technology (DSIT), it was the world's first national-level institution specifically tasked with AI safety evaluation. Its establishment marked the transition of AI safety from academic research into the formal government governance agenda. Internationally, AISI collaborates with the US AI Safety Institute (US AISI, under NIST), Japan's AI Safety Institute, and others to form a cooperative network that promotes international coordination of frontier model evaluation standards.

Its core responsibilities include conducting systematic assessments of potentially dangerous capabilities in frontier AI models before and after release, with a focus on high-risk domains such as cybersecurity attacks and biological threats. AISI's evaluation work is typically based on voluntary cooperation agreements with AI development companies — major frontier labs including OpenAI, Anthropic, and Google DeepMind have all signed commitments to provide AISI with pre-release evaluation access. While this "pre-release assessment" mechanism currently lacks legal enforceability, it has become part of the industry's de facto standard.

Assessment Continuity: From Claude Mythos to GPT-5.5

AISI had previously completed a cybersecurity capability assessment of Anthropic's Claude Mythos model, establishing a standardized evaluation benchmark. This GPT-5.5 assessment follows the same methodological framework, ensuring that cross-model comparisons carry scientific validity. This standardized evaluation methodology typically spans multiple dimensions: having the model attempt to identify known vulnerabilities in controlled environments (such as historical vulnerabilities in the CVE database), evaluating the model's ability to generate exploit code, testing the model's reasoning coherence across multi-step attack chains, and measuring whether the model can discover previously undocumented zero-day vulnerabilities. By testing different models under identical test sets and evaluation conditions, AISI can provide comparable capability profiles.

Core Findings on GPT-5.5 Cybersecurity Capabilities

Vulnerability Discovery Capability on Par with Claude Mythos

Assessment data shows that GPT-5.5's performance in identifying and discovering security vulnerabilities is at the same level as Claude Mythos.

From a technical perspective, LLMs' ability to discover security vulnerabilities stems from several factors. First, models are exposed during training to vast amounts of open-source code, security research papers, CVE vulnerability reports, and penetration testing documentation, enabling them to internalize the ability to recognize common vulnerability patterns (such as buffer overflows, SQL injection, privilege escalation paths, etc.). Second, the powerful long-context reasoning capabilities of frontier models allow them to trace data flows and control flows in complex code, uncovering logical vulnerabilities that span functions or even modules. Third, compared to traditional static analysis tools (such as Semgrep and CodeQL), LLMs have the advantage of understanding the semantic intent of code rather than merely matching syntactic patterns, enabling them to identify novel vulnerability variants that rule engines struggle to cover. However, it should be noted that current LLMs still have limitations in vulnerability discovery, including relatively high false positive rates and limited understanding of extremely complex system architectures.

This finding reveals an important trend: the cybersecurity capabilities of today's most advanced LLMs are converging, with the gap between top-tier models from different vendors in vulnerability discovery already very narrow.

Public Availability Constitutes the Key Difference

The most significant practical difference between the two lies in availability. GPT-5.5 is already fully open to the public, whereas Claude Mythos had not yet been broadly released at the time of its assessment. In other words, GPT-5.5's cybersecurity capabilities are already accessible and callable by any user, creating fundamentally different risk considerations at the governance level.

Notably, while companies like OpenAI deploy safety alignment measures and usage policy restrictions in their models (such as refusing requests to directly generate malicious code), the security research community has repeatedly demonstrated that these safeguards can be bypassed through various "jailbreak" techniques. From prompt injection to role-play inducement to gradual guidance through multi-turn conversations, attackers have multiple means of accessing a model's underlying capabilities. This means that a model's public availability is effectively equivalent to making all of its capabilities publicly available — safety guardrails can only raise the barrier to exploitation, not fundamentally eliminate the risk.

Deeper Impact Analysis of AI Cybersecurity Capabilities

The Double-Edged Sword Effect Cannot Be Ignored

The advancement of LLM cybersecurity capabilities is a classic double-edged sword:

• Defensive value: Security researchers and enterprises can leverage these capabilities to proactively discover and patch vulnerabilities, improving overall security posture. In practice, multiple cybersecurity companies have already integrated LLMs into their products — for example, Microsoft's Security Copilot uses GPT-series models to assist security analysts with threat detection and incident response, while Google's Big Sleep project has used LLMs to successfully discover zero-day vulnerabilities in real-world software. For resource-constrained SMEs, AI-powered security tools hold the promise of significantly lowering the cost barrier for professional security audits.

• Offensive risk: Malicious actors can equally harness model capabilities to discover and exploit vulnerabilities for attacks. Historically, the technical barrier to cyberattacks has been a key factor limiting attack scale — writing high-quality exploit code typically requires years of specialized training. The proliferation of LLMs could significantly lower this threshold, enabling capabilities once exclusive to Advanced Persistent Threat (APT) groups to spread to a broader range of attackers. Multiple threat intelligence reports in 2024 have already documented cases of attackers using AI to assist in writing phishing emails, generating malicious code variants, and automating reconnaissance processes.

The Industry Value of Third-Party Assessment Mechanisms

AISI's ongoing independent assessments of frontier models provide an important reference for the entire AI industry. This type of government-backed third-party evaluation helps to:

• Establish objective awareness of model capability boundaries
• Provide data support for regulatory decision-making across countries
• Drive transparency in AI companies' disclosure of safety-relevant capabilities

The importance of this mechanism also lies in addressing the inherent limitations of AI companies' self-assessments. AI developers face obvious conflicts of interest when evaluating their own models — overemphasizing risks could affect product release timelines and market competitiveness, while downplaying risks could lead to security hazards being overlooked. Independent third-party assessments offer a relatively neutral perspective whose conclusions are more likely to earn the trust of the public and regulatory bodies.

The Tension Between Model Public Availability and Security Governance

When models with significant cybersecurity capabilities are made available to the public, balancing technological openness and innovation against security risk management becomes a core governance issue. The fact that GPT-5.5 is already publicly available means that discussions around its cybersecurity capabilities are no longer academic hypotheticals — this is a real governance challenge that demands immediate attention.

National policy approaches to this issue currently diverge significantly. The EU AI Act adopts a risk-tiered regulatory framework, imposing transparency and safety assessment obligations on "general-purpose AI models" (GPAI), with models posing systemic risks required to undergo adversarial testing and incident reporting. The US leans more toward a combination of industry self-regulation and executive orders — the Biden administration's 2023 AI executive order requires developers to report large-scale model safety test results to the government but does not impose mandatory release restrictions. The UK itself takes a "pro-innovation" stance, with AISI's evaluations currently based on voluntary cooperation rather than legal mandate.

The traditional cybersecurity principle of "Responsible Disclosure" — notifying vendors to patch vulnerabilities before public disclosure — faces fundamental challenges in the AI era. When vulnerability discovery capability itself is embedded in a publicly available general-purpose tool, the concept of "disclosure" becomes blurred: the question is no longer whether a specific vulnerability should be disclosed, but whether the general capability to discover vulnerabilities should be made public. This is an unprecedented governance dilemma.

Implications for the AI Industry and Cybersecurity Ecosystem

This assessment carries multi-layered implications for the industry:

Capability levels have reached the regulatory threshold: The cybersecurity capabilities of frontier models have reached a level warranting serious attention and continuous tracking by official institutions.

Capability convergence reflects technological fundamentals: The convergence of top-tier models from different vendors in the cybersecurity dimension suggests this is a natural consequence of model scaling and training methodology evolution, rather than any single company's unique advantage. There are deep technical reasons behind this convergence. First, Scaling Laws indicate that once model parameter counts and training data volumes reach a certain scale, model performance across various capabilities follows predictable improvement curves — different companies investing sufficient computational resources will converge at similar capability levels. Second, training data for frontier models overlaps significantly — the high-quality code repositories, security research literature, and technical documentation publicly available on the internet are finite, and companies inevitably train their models on similar data distributions. Third, the Transformer architecture has become the industry's de facto standard, with inter-company differences at the architectural level far smaller than outsiders might imagine; core innovations are concentrated more on training strategies, data ratios, and post-training alignment. These factors collectively drive the convergence of frontier models on specific capability dimensions, with cybersecurity being yet another illustration of this general pattern.

The security ecosystem faces profound transformation: As these models proliferate, the entire cybersecurity ecosystem — on both the defensive and offensive sides — will undergo fundamental changes, and the traditional attack-defense balance may be disrupted. Specifically, AI may accelerate the compression of the "vulnerability discovery-to-exploitation" time window: in the past, there was typically a buffer of days to weeks between a vulnerability being discovered and being exploited at scale, but AI-assisted automated attack chains could compress this window to hours or even less. This places unprecedented demands on the speed of patch management, incident response, and security operations.

Summary and Outlook

The UK AI Safety Institute's assessment of GPT-5.5 once again confirms the significant capabilities of frontier AI models in the cybersecurity domain. In an era of rapidly iterating AI capabilities, establishing systematic model safety assessment mechanisms and finding a dynamic balance between open innovation and security governance will be a long-term challenge faced jointly by governments and the AI industry worldwide. For cybersecurity professionals, understanding and adapting to the new AI-driven attack-defense landscape is an urgent imperative.

Looking ahead, several key trends deserve attention: First, assessment methodologies themselves need continuous evolution — as model capabilities rapidly advance, today's evaluation benchmarks may become outdated within six months. Second, the urgency of international coordination is increasing — the cross-border availability of AI models means that regulatory measures from any single country have limited effectiveness. Third, AI safety assessments may shift from voluntary cooperation to legal mandates — as model capabilities continue to climb, a governance model that relies solely on corporate goodwill may no longer be sufficient.

Key Takeaways

• The UK AI Safety Institute completed its assessment of OpenAI GPT-5.5's cybersecurity capabilities
• GPT-5.5's vulnerability discovery capability is on par with Anthropic's Claude Mythos
• The key difference between GPT-5.5 and Claude Mythos is that the former is already publicly available
• Frontier AI models' cybersecurity capabilities have reached a level warranting serious assessment by official institutions
• Balancing model public availability with security governance has become a real-world challenge