AI agents and cybersecurity

Opportunities and risks of ChatGPT-5.5, GPT-5.6, and Claude Mythos for IT security, and how companies, agencies, and individuals can protect themselves

AI models are becoming increasingly adept at identifying and exploiting security vulnerabilities in IT systems. In July 2026, models from OpenAI, including GPT‑5.6 Sol, even began acting autonomously during a test and hacked the IT system of the AI company Hugging Face.

During the test, the models were tasked with working through the ExploitGym protocol. This so-called benchmark was developed, among others, by researchers at the Max Planck Institute for Security and Privacy to assess how effectively AI systems can detect and exploit vulnerabilities.

The test was intended to take place in an environment with very restricted internet access. However, the models independently obtained unrestricted internet access and then penetrated Hugging Face's infrastructure.

They apparently assumed, incorrectly, that Hugging Face hosted information that would help them solve the ExploitGym test tasks located there. Initially, it was unclear whether the attack had been made possible by configuration errors on OpenAI’s side in the benchmark setup, or by implementation errors within ExploitGym itself. Before this incident, the company Anthropic had already caused a stir with Claude Mythos  because of its ability to find and exploit software vulnerabilities with exceptional autonomy and efficiency.

Thorsten Holz, Scientific Director at the Max Planck Institute for Security and Privacy, played a leading role in co-developing ExploitGym. Here, he answers questions about the capabilities of AI agents to identify and exploit vulnerabilities, and outlines measures to help reduce the risk of autonomous cyberattacks carried out by AI agents. 

What exactly is Claude Mythos and what makes it so dangerous?

Claude Mythos from Anthropic is a particularly powerful AI language model with strong agentic capabilities in cybersecurity. These days, language models, including those behind chatbots, are increasingly deployed in agentic systems. What does that mean? Behind the language models themselves are neural networks that have been trained on vast amounts of information from the internet. Their responses are word sequences generated based on probabilities. An AI model on its own is therefore very passive. "It’s the way the AI model is embedded in a platform that makes it active and gives it agency, that is, the capacity to act," says Krishna Gummadi from the Max Planck Institute for Software Systems.

When used as an agent, the model has access to various tools and incorporates external information, such as information from a calculator. OpenClaw explicitly uses this behaviour to optimise the user’s IT workspace, accessing external programmes and sending emails independently. Anyone who gives the tool too much freedom may be in for an unpleasant surprise.

But even the common ChatGPT models are agentic: they can analyse code, test it for vulnerabilities, interpret errors, and offer solutions. This makes agentic AI models potentially more dangerous than pure chatbots. As a result, they also appear "smarter", without actually understanding any of the underlying context. These AI models remain tools, not autonomous actors.

What makes these AI models relevant in the field of IT security?

This agentic behaviour is especially central in the cyber domain: the AI language model forms a hypothesis, uses various programmes to develop an exploit for a vulnerability in the IT system, tests the attack, analyses, corrects, and tests again. "That is the core of agentic systems: plan, act, observe, correct," says Thorsten Holz. "If a model performs these steps well and quickly, it becomes a powerful technical assistant, both for defensive and offensive purposes." AI agents have, in this way, already found numerous security vulnerabilities – for instance in the browsers Google Chrome and Mozilla Firefox – which were subsequently patched.

What's new about this? What dangers did agent-based AI systems pose before?

"Earlier models were already capable of writing texts for automated phishing emails or finding vulnerabilities in code. What is new is the quality of autonomy," says Thorsten Holz.

An attack, he notes, rarely works on the first attempt. One has to test, debug, understand why something is not working, and then make adjustments. The recursive sequence of these steps makes the latest models more powerful and riskier in the cyber domain.

This requires the AI model to be granted the right not only to make a suggestion on how a vulnerability could be cracked, but also to attempt to crack it. Initial results could be available after just a few minutes or a few hours; future models will be even faster. "So we need to prepare ourselves now," says Holz.

How does ExploitGym test the cyber capabilities of AI models, and what insights have already been gained?

A research team that includes the Max Planck Institute for Security and Privacy developed a benchmark called  ExploitGym, which is used to measure offensive AI capabilities.

Under controlled conditions, tests determine which models can actually exploit which types of vulnerabilities. The researchers are interested in questions such as: Which protective mechanisms help? Where do they fail? How do capabilities change from one model generation to the next? This helps model providers make security decisions, aids defenders with prioritisation, and assists policymakers in deciding which capabilities might need to be regulated. The ExploitGym tests are carried out by the respective companies themselves, in coordination with the benchmark's developers.

"Our results show that AI models cannot simply crack any given system at will. That would be an exaggeration and unrealistic," says Holz. But in the tests, the Mythos Preview model successfully exploited 157 out of 898 real-world vulnerabilities, while GPT-5.5 managed 120. By comparison, the next-best model, Claude Opus 4.6, managed only 15, an order of magnitude lower.

Overall, Claude Mythos appears slightly more capable than GPT-5.5, but what is truly decisive is the trend, and in both cases that trend is towards increasingly efficient agentic capabilities. The tests also show that it is becoming increasingly difficult to contain the models within test environments, as these systems have become very good at independently overriding safety precautions. In this context, it is less important which model is used, and more important which tools the model is given access to.

These results are important for general IT security. Modern agentic systems tested today are evidently already good enough to significantly shorten the time between the discovery of a vulnerability and its practical exploitation. "In the past, specialists were required for this; now AI agents are taking over parts of this work," says Holz.

Do AI agents also search for security vulnerabilities in private IT systems?

Private IT systems are not yet a target for AI agents searching for security vulnerabilities. 'However, in light of the capabilities of AI agents, software companies should address how they protect their products from attacks by such agents as well,' says Thorsten Holz."

Will private users soon be able to hack a bank at the push of a button?

"No, individuals cannot hack a bank with Claude Mythos. It's not that simple," says Thorsten Holz. For a real-world attack, an attacker first has to choose a target. Among other things, initial access to the target system is required, as well as infrastructure and network knowledge. Additionally, one must bypass detection mechanisms to avoid being caught.

The danger comes less from curious individuals and more from organised actors, meaning professionals who integrate such models into automated attack systems, thereby making them more efficient and powerful. A single language model is just one component. It becomes dangerous when combined with stolen credentials and phishing campaigns – in other words, when it gains access to systems and automated decision-making processes. This creates an agentic attack system that searches for targets, prioritises vulnerabilities, develops and tests exploits, evaluates results and adapts its strategy.

And it’s faster to research background information on the target system, write code, adapt known exploits, and structure attack chains. “That doesn’t mean every municipal utility facility can be shut down tomorrow. But the gap between ordinary cybercriminals and state-sponsored actors is narrowing,” says Thorsten Holz.

What further cybersecurity threat looms in the future?

The latest AI agents could be used in cooperation with companies to alert them to IT vulnerabilities. It could become dangerous if models become accessible to everyone.

When a software company releases a patch for a security vulnerability in its product, that patch is publicly viewable. AI models could try to "reverse-engineer" the patch to identify the exact security vulnerability it is designed to close. If users wait too long to install the update, an attack chain equipped with Mythos as a tool could have enough time to work its way up to the vulnerability.

Systems did not become vulnerable only because of AI. The Federal Office for Information Security (BSI) has been pointing out vulnerabilities for years. The new AI models merely exacerbate the risk of successful attacks, making them more accessible, cheaper, and faster.

Who should protect themselves now, and how?

"Everyone should protect themselves, but not everyone to the same extent," says Thorsten Holz.

Private IT systems are not yet a target for AI agents searching for security vulnerabilities; such systems are more frequently attacked via phishing emails, weak passwords, or missing security updates. In practice, the threat to companies and public authorities is far greater. "In light of the capabilities of AI agents, companies and public authorities should, however, address how they protect their software from attacks by such agents as well. This applies particularly to all types of companies that develop their own software," says Thorsten Holz.

For private users, the risk posed by AI agents is comparatively low and primarily indirect: in future, there will presumably be better phishing emails, more credible scam dialogues, and more automated attacks on poorly secured devices, such as smart home systems.

The most important measures are straightforward.

• Activate automatic updates
• Use a password manager
• Use a unique password for each account
• Enable multi-factor authentication
• Make backups
• Do not leave old devices unprotected on the internet (old modems with insecure hardware, for example, are easy to hack and are often used to relay large volumes of requests to specific websites, causing them to crash.)

For companies and government agencies, the situation is more serious, according to Thorsten Holz. "For well-protected critical infrastructure, Mythos and similar models are not an immediate doomsday scenario." But for poorly maintained municipal IT systems, public utilities, industrial facilities, or service providers with low security levels, the risk increases significantly. Searching for vulnerabilities in one's own system is therefore well worth the effort.

This is because many attacks on critical infrastructure in companies do not begin with highly specialised attacks on industrial control systems, but with very common IT weaknesses, such as:

• Systems exposed to the internet
• Successful phishing
• VPN vulnerabilities
• Unpatched firewalls
• Weak patch management
• Compromised login credentials
• Poorly segmented networks
• A complex, poorly documented IT landscape
• IT with a weak security level and vulnerabilities

"The most important measures are not exotic, but they must be consistently implemented," says Thorsten Holz. These include:

• Patching security vulnerabilities quickly and installing updates rapidly
• Implementing strong authentication and network segmentation, so that a compromised office workstation does not lead directly to critical services
• Logging and monitoring systems, meaning the recording of errors and anomalies in the system, and other detection methods that are fast enough to keep pace with AI-driven attacks
• Conducting simulations of cyberattacks on one's own system, so-called red team exercises, using AI-enabled tools
• Securing system access

Are Linux systems more secure than Windows?

Whether Linux or Windows, security patches and updates should not be delayed for long. With new AI tools, the time it takes for professional attackers to identify and exploit vulnerabilities is shrinking.

However, Windows is often a more attractive target for mass attacks, as it runs on many computers used by individuals and businesses, with attacks frequently targeting typical Windows corporate environments. Linux, on the other hand, is a key system for servers, cloud systems, and critical infrastructure components. Vulnerabilities in Linux or open-source components can therefore lead to major problems.

Claude Mythos is also compared to nuclear technology in the media. Do you agree with this, and what follows from it?

"I think comparing the new AI to a nuclear threat is problematic," says Thorsten Holz. The analogy is helpful at most insofar as it points to dual use, strategic power and risks.

However, there are also clear differences: fissile material, Holz notes, is physically scarce, easier to control, and detectable. By contrast, AI model structures and attack chains can easily be copied.

Furthermore, whereas nuclear weapons always have catastrophic consequences, AI-supported cyberattacks occur across a spectrum of harm, ranging from simple nuisance to severe attacks. "And there are effective defensive measures that can keep pace with the complexity of AI models," says Holz. "So I would not describe AI as a superweapon for cybersecurity operations, but rather as an acceleration technology, an amplifier for existing capabilities."

Do regulations, such as the AI Act, help slow down this development?

That will be the case only to a limited extent, if at all. "The problem is that the detection and the exploitation of security vulnerabilities are technically very close to one another," says Thorsten Holz. AI providers like Anthropic or OpenAI could be required to report cases of misuse. However, it is hardly realistic to design agentic AI systems and their operation in such a way that they cannot be used for dual-use applications.

According to Thorsten Holz, basic research – which explores what is possible in controlled tests—is particularly important right now. More knowledge about such offensive AI is needed. But knowledge alone is not enough:

"Critical infrastructure operators should not wait for regulation, but act now," says Thorsten Holz. "The most important question is not whether AI will eventually become dangerous. The question is rather whether one's own infrastructure is robust enough when attacks become faster, cheaper, and more scalable."

What regulations such as the AI Act can achieve is transparency, reporting requirements, or security standards. However, the AI Act cannot eliminate the capabilities of current frontier models.

"Regulation is slow, whereas technical development is very fast," says Holz. "That is why all companies and operators of critical infrastructure must take preventive action now. It would be negligent to wait for a law to solve the problem." Prevention alone is not enough, however, because it does not close the asymmetry between faster attack capabilities enabled by AI and slower defense mechanisms.

The answers are based on a conversation with Thorsten Holz, Scientific Director at the Max Planck Institute for Security and Privacy. The questions were asked by Tobias Beuchert. This article was updated on 22 July.