Booz Allen’s Cyber Weapon Index Finds Only Claude Mythos Finished a Full Attack Chain on Its Own

Updated Oct. 25, 2026, 11:16 p.m. ET: Adds Booz Allen’s follow-up testing, which found that OpenAI’s GPT-6 Astra also completed the full kill chain less than a week after the index was first published.

Of 18 AI models that Booz Allen Hamilton turned loose on a production-grade enterprise network, only Anthropic’s Claude Mythos carried an attack all the way through the cyber kill chain without human help, according to the consulting firm’s first Cyber Weapon Index.

The index tested nine American and nine Chinese models under identical conditions, without a curated tool menu or extra scaffolding, with each model controlling a real attacker machine. Every action was checked against network telemetry, host logs, domain controller data and intrusion-detection sensors. Scores combine how well a model finds planted or novel vulnerabilities with how far it gets through an end-to-end intrusion, tested with and without credentials, The Register reported.

How the models ranked

Claude Mythos scored 80. The next closest were xAI’s Grok-4.5 at 49, OpenAI’s GPT-5.6 Sol at 46, and Meta’s Muse Spark 1.1 and Moonshot AI’s Kimi K3 at 38 each. Given stolen employee credentials, Mythos gained administrator-level control in every attempt, and it worked out how to escalate from what it found inside the network rather than following a set plan. Without credentials, it still got in and reached full domain compromise.

Grok-4.5, Muse Spark 1.1 and Z.ai’s GLM-5.2 also reached full domain access and control, but not the entire chain. All but one model, Alibaba’s Qwen3-Coder, gained initial access on its own.

Real bugs separated the field far more than planted ones. Nearly every model scored near the ceiling on intentionally introduced vulnerabilities, but against real vulnerabilities all nine frontier API models scored zero. One unnamed leading model analyzed the vulnerable component correctly and then dismissed it as safe. Only Mythos exploited it. “Real-world offensive capability still trails benchmark performance, giving defenders valuable time to strengthen defenses before that gap closes,” the report says.

The harness can matter as much as the model

Booz Allen found that the attack harness, the software connecting a model to hacking tools and orchestrating its actions, can “dramatically amplify” what a model can do. “Our testing demonstrates the effect: when paired with an attack harness, Claude Sonnet rivaled Claude Mythos’ performance,” the report says. The authors added that they don’t yet know what open-weight or Chinese models can do with optimized harnesses.

The firm expects most of the other models to reach Mythos’ level within six months. It is urging sector-specific deadlines for critical infrastructure to show resilience against AI-enabled attacks, along with AI-driven defenses “that detect, decide, and respond at machine speed.”

The original test did not include OpenAI’s then-unreleased Astra, which OpenAI had said reached its “critical” cybersecurity capability threshold. In follow-up testing less than a week later, Booz Allen found that GPT-6 Astra could also execute the full kill chain. According to the firm, Mythos still leads in execution and Astra now leads in vulnerability discovery.