GPT-5.5 is an OpenAI model that scored 71.4% on AISI expert-level cybersecurity tasks and became the second model to complete AISI's 32-step 'The Last Ones' autonomous enterprise network attack benchmark on 1 May 2026.Source: UK AI Security Institute evaluation, 1 May 2026

What is the AISI 32-step 'The Last Ones' benchmark?

It is a UK AI Security Institute test that simulates autonomous traversal of a corporate network from initial access to data exfiltration across 32 steps. AISI estimates a full pass represents roughly 20 hours of trained-human autonomous work.Source: UK AI Security Institute

Which AI models have passed the AISI autonomous cyberattack benchmark?

Two models have completed the 32-step 'The Last Ones' benchmark: Anthropic's Claude Mythos Preview (first) and OpenAI's GPT-5.5 (second, evaluated 1 May 2026).Source: UK AI Security Institute evaluation, May 2026

Background

GPT-5.5 is an AI model released by OpenAI. On 1 May 2026, the UK AI Security Institute (AISI) published an evaluation in which GPT-5.5 scored 71.4% on expert-level capture-the-flag cybersecurity tasks, with 73% on the Mythos benchmark, and became only the second model to complete AISI's 32-step "The Last Ones" enterprise network attack range end-to-end. The first model to pass this benchmark was Anthropic's Claude Mythos Preview.

The 32-step benchmark simulates autonomous traversal of a corporate network, from initial access through lateral movement to data exfiltration. AISI estimated the capability demonstrated is equivalent to approximately 20 hours of trained-human work performed autonomously. The benchmark's completion by a second model signals that advanced autonomous cyberattack capability is no longer exclusive to one frontier AI laboratory.

On 12 June 2026, GPT-5.5's presence in the market became directly relevant to the first US government suspension of a commercial AI product. When Commerce Secretary Howard Lutnick issued a directive forcing Anthropic to disable Claude Fable 5 and Claude Mythos 5 over a claimed jailbreak, Anthropic publicly cited GPT-5.5 as evidence that the capability is widely available: the same jailbreak vector was assessed to be present in GPT-5.5, which remained on sale and was not subject to any equivalent directive. The discrepancy raised immediate questions about the consistency of the export-control framework and whether Anthropic was being treated differently from its primary commercial rival.