UK AISI Assessment Report: GPT-5.5 Cybersecurity Capabilities on Par with Claude Mythos

UK AISI Publishes GPT-5.5 Cybersecurity Capability Assessment Report

The UK AI Safety Institute (AISI) recently published its assessment report on OpenAI's latest model, GPT-5.5, focusing on its cybersecurity capabilities. The institution had previously conducted a similar assessment of Anthropic's Claude Mythos. The results show that GPT-5.5's ability to discover security vulnerabilities is comparable to Claude Mythos, but with one critical distinction — GPT-5.5 is already publicly available.

This assessment has sparked in-depth industry discussion about the role of AI models in cybersecurity offense and defense, while also providing important reference points for AI safety governance.

Assessment Background and Methodology

The Role and Mission of the UK AI Safety Institute

The UK AI Safety Institute is one of the most important institutions in the global AI safety landscape. Its core responsibilities include conducting systematic safety assessments of frontier AI models. The institution was originally announced during the UK AI Safety Summit in 2023, evolving from the UK government's Frontier AI Taskforce. In early 2024, AISI underwent organizational restructuring, transitioning from an internal team under the Department for Science, Innovation and Technology (DSIT) to an assessment body with greater independence. AISI's core mission is to evaluate frontier AI models before and after release across multiple risk dimensions, including biosecurity, cybersecurity, autonomy, and persuasion. Globally, AISI collaborates with the US AI Safety Institute (US AISI, under NIST) and similar institutions in other countries, collectively advancing international standards for AI safety assessment.

In the cybersecurity capabilities dimension, AISI focuses on whether AI models can be used to discover and exploit security vulnerabilities in software systems. "Cybersecurity capabilities" is a multi-layered concept encompassing everything from identifying potential flaws in code, understanding attack surfaces of complex system architectures, to generating executable exploit code. Assessments typically design task scenarios across multiple difficulty levels, from simple known vulnerability pattern recognition (such as common vulnerability types like buffer overflows and SQL injection) to complex attack chain construction requiring multi-step reasoning (i.e., the ability to chain multiple low-severity vulnerabilities into high-severity attack paths). AISI's evaluation framework also examines model performance in zero-day vulnerability discovery scenarios — vulnerabilities that have not yet been publicly disclosed or patched — which is considered the key indicator for measuring the upper bound of AI cybersecurity capabilities.

Evolution from Claude Mythos to GPT-5.5 Assessment

AISI had previously conducted a cybersecurity capability assessment of Anthropic's Claude Mythos preview. Expanding the assessment scope to include OpenAI's GPT-5.5 reflects the institution's strategy of comprehensive coverage across major LLM vendors. Through cross-vendor horizontal comparisons, AISI can more accurately map the current capability boundaries of AI in the cybersecurity domain.

Notably, such cross-vendor horizontal assessments face numerous methodological challenges. Different models have distinct architectural designs, training data compositions, alignment strategies, and safety guardrail implementations, meaning assessments must design sufficiently general task benchmarks to ensure fair comparisons. AISI's evaluation methods typically include: standardized CTF (Capture The Flag) style challenges, real-world vulnerability reproduction tasks, and simulated penetration testing scenarios. These tasks are designed with reference to the actual workflows of professional security researchers, providing a relatively objective reflection of a model's true capability level when assisting with or independently completing security research tasks.

Core Findings: GPT-5.5 Vulnerability Discovery Capability Assessment Results

On Par with Claude Mythos

The assessment results indicate that GPT-5.5's performance in discovering security vulnerabilities is on par with Claude Mythos. This suggests that current top-tier large language models are converging in their cybersecurity task capabilities — flagship models from different vendors demonstrate similar capability ceilings in this specific domain.

From a technical perspective, LLM capabilities in cybersecurity tasks manifest at several levels: first, code comprehension and auditing ability — whether the model can accurately identify security flaws in source code or binary programs; second, exploit reasoning ability — whether the model can design effective attack strategies based on discovered vulnerabilities; and third, the breadth and depth of security knowledge, including understanding of historical vulnerability patterns in the CVE (Common Vulnerabilities and Exposures) database and the ability to guide usage of various security tools. Current top-tier models already exceed the performance level of junior security practitioners in these dimensions, but still lag behind top-tier human security researchers when facing novel vulnerability discovery tasks requiring deep creative thinking.

This finding carries dual implications:

• Positive side: AI-assisted security research has reached a certain level of maturity and can effectively support security team operations. Specifically, AI models can dramatically accelerate code audit processes, automate fuzzing test case generation, and assist in analyzing complex attack surfaces, helping defenders discover and patch vulnerabilities before attackers do.
• Risk side: The potential security risk is not unique to any single vendor but is a challenge the entire industry must face collectively. When multiple publicly available models possess similar security research capabilities, strategies attempting to control risk by restricting a single model become ineffective.

The Key Difference Lies in Public Availability

The most significant difference between the two models is not in capability itself, but in accessibility. GPT-5.5 is currently available to the public as a general-purpose product, while Claude Mythos was still in preview at the time of assessment. This means GPT-5.5's cybersecurity capabilities can already be utilized by any user, with practical implications for both the defensive and offensive sides of security.

In AI safety research, a model's deployment strategy is considered one of the key variables in risk management. The product of a model's "dangerous capabilities" and its "accessibility" constitutes the actual risk level. Specifically, restricted access (such as providing API access only to vetted research institutions, setting usage quotas, and implementing strict usage monitoring) can significantly reduce misuse risk, even if the model itself possesses strong attack-assistance capabilities. Conversely, when a model is fully publicly available, even if its capability level is comparable to a restricted model, the actual risk is significantly amplified due to the dramatic increase in the number of potential abusers. OpenAI's decision to publicly release GPT-5.5 implies that its internal safety assessment concluded the model's cybersecurity capabilities have not exceeded the "unacceptable risk" threshold, but AISI's independent assessment provides an external validation perspective on this judgment.

Industry Impact of AI Cybersecurity Capabilities

New Challenges for AI Safety Governance

When AI models with significant cybersecurity capabilities are made publicly available, safety governance faces new challenges. Defenders can leverage these models to accelerate vulnerability discovery and patching workflows, but attackers may equally use these tools to lower the barrier to entry for attacks. How to strike a balance between openness and security is a question that all AI vendors and regulators must continuously address.

The core of this challenge lies in the inherent nature of AI models as "dual-use technology." Dual-use technology refers to technology that can be used for both legitimate purposes and harmful purposes — a concept originally derived from export control frameworks in the nuclear and biotechnology fields. In the AI context, a model that can help security engineers discover code vulnerabilities can equally be used by malicious actors to find attack targets. Current governance frameworks primarily rely on several mechanisms to manage this risk: model-level safety alignment (using techniques like RLHF to make models refuse obviously malicious requests), usage-level monitoring and auditing (detecting anomalous usage patterns), and policy-level legal deterrence (clarifying the legal consequences of using AI tools for cyberattacks). However, the effectiveness of these mechanisms is still being continuously validated, particularly against attackers with a certain level of technical capability, where model-level safety guardrails can often be bypassed through jailbreaking techniques.

Driving Standardization of AI Safety Assessment

AISI's systematic evaluation of models from multiple vendors is driving AI safety assessment toward standardization. This independent third-party assessment mechanism helps establish industry benchmarks and provides data support for governments formulating AI regulatory policies.

Currently, the main challenges facing AI safety assessment standardization include: the timeliness of evaluation benchmarks (as offensive and defensive techniques evolve, assessment tasks need continuous updates), the comparability of evaluation results (methodological differences between evaluation institutions may lead to inconsistent conclusions), and the completeness of evaluation coverage (the long-tail distribution of model capabilities means standardized tests may miss risks in certain specific scenarios). Nevertheless, AISI's practices are setting important precedents for the industry — by publicly releasing assessment reports, they not only increase transparency in the AI development process but also provide methodological templates for regulators in other countries. The conformity assessment requirements for high-risk AI systems in the EU AI Act, as well as the red-teaming requirements proposed in the U.S. White House Executive Order on AI safety, both align with AISI's assessment practices.

Capability Convergence Among Frontier Models

The similar performance of GPT-5.5 and Claude Mythos in cybersecurity capabilities suggests that capability gaps between top-tier LLMs on specific tasks are narrowing. This convergence phenomenon has deep technical roots: current mainstream LLMs share high similarity at the architectural level (all based on Transformer architecture variants), training methodology (the pre-training + instruction fine-tuning + RLHF paradigm has become the industry standard), and training data sources (publicly available internet data constitutes the bulk of each model's training corpus). Once models reach a certain scale, performance on specific tasks depends more on the coverage of relevant knowledge in training data than on subtle architectural differences. For cybersecurity specifically, publicly available security research papers, vulnerability reports, CTF writeups, security tool documentation, and similar materials constitute a limited but high-quality training corpus pool, and each model's learning outcomes from this data tend to converge.

Future competition will likely focus more on:

• Safety guardrail design and effectiveness — how to effectively prevent malicious use while preserving the model's security research assistance capabilities
• Usage policy optimization and compliance — including tiered access controls, use case restrictions, and alignment with regulatory requirements
• Depth of integration with security toolchains — whether models can form effective synergies with existing SAST/DAST tools, vulnerability management platforms, threat intelligence systems, and similar infrastructure

Rather than pure raw capability competition. This means AI vendors' differentiated competition in the cybersecurity domain will shift from "whose model is stronger" to "whose security ecosystem is more comprehensive."

Summary

The UK AI Safety Institute's assessment of GPT-5.5 provides an important observation window: the most advanced large language models today already possess noteworthy cybersecurity capabilities, and these capabilities are reaching ordinary users through publicly available products. Against the backdrop of rapidly iterating AI capabilities, establishing continuous, systematic safety assessment mechanisms is more important than ever.

From a broader perspective, this assessment also reflects that AI safety governance is transitioning from theoretical discussion to an evidence-driven phase. Independent assessment institutions provide policymakers with evidence-based decision support through quantitative testing of specific models, while also offering the public more concrete and tangible reference points for understanding AI risks. As more frontier models undergo similar assessments, we will be able to more clearly track the evolutionary trajectory of AI cybersecurity capabilities and dynamically adjust governance strategies accordingly.

Key Takeaways

• The UK AI Safety Institute completed a systematic cybersecurity capability assessment of OpenAI's GPT-5.5
• GPT-5.5's vulnerability discovery capability is comparable to Anthropic's Claude Mythos
• The key difference is that GPT-5.5 is publicly available, while Claude Mythos remains in preview
• Top-tier LLMs are converging in cybersecurity task capabilities; the industry must collectively address security challenges
• Systematic assessments by independent third-party institutions are driving AI safety evaluation toward standardization