Benchmarks / AISI multi-step cyber attack ranges
AISI multi-step cyber attack ranges (AISI cyber ranges)
Built by AI Security Institute · Linus Folkerts, Will Payne, Simon Inman, Philippos Giavridis, et al. · released 11 Mar 2026
Two private cyber ranges built for the UK AI Security Institute: "The Last Ones", a 32-step attack on a simulated corporate network that ends with data theft from a protected database, and "Cooling Tower", a 7-step attack on a simulated power plant's control system. A minimal ReAct agent on Kali Linux must chain the whole attack on its own. AISI ran seven models released between August 2024 and February 2026 and reports steps completed.
Frontier
22
Average steps completed, "The Last Ones" (100M tokens)
Claude Mythos Preview (early checkpoint)
13 Apr 2026 · Source: AI Security Institute (benchmark maintainers)
Average of 22 of 32 steps over 10 attempts at up to 100M tokens; first model to complete the range, in 3 of 10 attempts. In the same post Opus 4.6 averaged 16 steps over 10 attempts. AISI later tested a newer Mythos Preview checkpoint (6 of 10 full solves) and reported that the most capable U.S. models averaged 28.5 steps, but gave no average for a named model in text.
The best result is at 60–90% of the ceiling, or at or above human parity.
What it measures
How far an agent gets along a fixed attack chain with no active defenders. Each step has a flag; on "The Last Ones", reaching a flag counts all earlier steps as done. We show the average steps completed on "The Last Ones" (of 32) at a 100M-token budget per attempt, over five attempts in the paper and ten in later AISI posts; AISI also reports 10M-token runs, the maximum, and full solves. Steps grow harder along the chain (reverse engineering, privilege escalation, cryptography), so step counts are not linear progress. On "Cooling Tower" the paper's best models averaged 1.2 to 1.4 of 7 steps; AISI reported the first full solve in May 2026.
Average steps completed, "The Last Ones" (100M tokens): Mean number of the 32 attack steps completed per attempt at a 100M-token budget with AISI's standard agent (paper Table 1: ReAct agent with context compaction, five attempts per model; later AISI posts: ten attempts per model). Higher is better.
Status compares the frontier with a ceiling of 32.
Facts
- Grain
- Project level: whole projects judged by an acceptance standard
- Environment
- live-system, cli
- Grading
- state-check
- Tasks
- 2
- Human reference
- The paper estimates that a human expert would need about 14 hours for "The Last Ones" and about 15 hours for "Cooling Tower"; AISI's posts from April 2026 on give about 20 hours for "The Last Ones" (see the conflict file). These are estimates from the number and complexity of the steps, not timed trials. In the paper, the best single run (Opus 4.6, 22 of 32 steps) covered steps worth roughly 6 of the 14 hours.
- Contamination
- Held out: the ranges are not public. The paper's appendix describes both attack chains step by step, which the authors say trades against keeping the ranges held out over time.
- Reuse
- The ranges are private and were built for AISI by SpecterOps and Hack The Box. The paper describes the attack chains and asks to be excluded from training data (canary GUID). No data release. (cite-only)
Limits to keep in mind
- Only AISI (with CAISI in one joint post) can run these ranges, so results come from one evaluator, with five or ten attempts per model at 100M tokens. The authors say the small sample limits statistical power. Later posts give some results only in charts. Source
- Strong variance between attempts: at the same model and budget, Opus 4.6 runs ranged from 11 to 22 of 32 steps. Source
- No active defenders, detection penalties, or incident response. Alerts are logged but never block the agent. The ranges are also much smaller than production networks. Source
- The metric omits target selection, initial access decisions, persistence, and infrastructure setup; the agent gets a starting point and an objective. Source
Recorded results
A selection that shows the frontier over time. The full leaderboard is at the source.
| System | Average steps completed, "The Last Ones" (100M tokens) | Date | Source |
|---|---|---|---|
| Claude Mythos Preview (early checkpoint) · frontier | 22 | 13 Apr 2026 | AI Security Institute · primary |
| Claude Sonnet 4.5 harness: AISI ReAct agent (Inspect) | 9.4 | 11 Mar 2026 | AI Security Institute · primary |
| Claude Opus 4.5 harness: AISI ReAct agent (Inspect) | 11 | 11 Mar 2026 | AI Security Institute · primary |
| Claude Opus 4.6 harness: AISI ReAct agent (Inspect) | 15.6 | 11 Mar 2026 | AI Security Institute · primary |
Where sources disagree
AISI's paper estimates that a human expert would need about 14 hours to complete "The Last Ones". AISI's blog posts from April 2026 on give about 20 hours for the same range. Both are estimates, not timed trials. We did not find a statement from AISI that explains the change, so the cause is open. We show both in human_reference, with the paper's per-step figure (best Opus 4.6 run worth about 6 of 14 hours) tied to the 14-hour estimate.
- about 14 hours — arxiv.org (primary) · arXiv v3 (2026-03-17), Section 2, read 2026-10-10.
- about 20 hours — www.aisi.gov.uk (primary) · AISI blog post dated 2026-04-13, read 2026-10-10.
- around 20 hours — www.aisi.gov.uk (primary) · AISI blog post dated 2026-04-30, read 2026-10-10. The Kimi K3 post (2026-07-23) also says "roughly 20 hours".
We show about 14 hours (paper) and about 20 hours (later AISI posts). Status: open.
Timeline
- 13 May 2026 — A newer Mythos Preview checkpoint is the first to solve AISI's power-plant range, in 3 of 10 attempts. Source
- 13 Apr 2026 — Claude Mythos Preview averages 22 of 32 steps on AISI's corporate-network range and first solves it. Source
- 11 Mar 2026 — UK AISI cyber ranges: Claude Opus 4.6 averages 15.6 of 32 attack steps at 100M tokens. Source
Where it sits in the atlas
Work ladder: Direct evidence for Security, but its headline gives partial credit and the source publishes no completion rate. It adds to the work measured, but it cannot set a step. How the ladder works
Work it measures (O*NET work activities): Test performance of computer or information systems.
Go to the source
Last checked 10 Oct 2026 against 10 primary sources. See an error? Tell us.
How to cite
Credit the original work first: AISI multi-step cyber attack ranges by AI Security Institute (https://arxiv.org/abs/2603.11214).
Then, if you used this page:
Can Agents Work. "AISI multi-step cyber attack ranges: frontier results and sources." https://canagentswork.com/benchmarks/aisi-cyber-ranges/ (accessed 2026-10-11). CC BY 4.0.@misc{caw-aisi-cyber-ranges,
title = {{AISI multi-step cyber attack ranges: frontier results and sources}},
author = {{Can Agents Work}},
year = {2026},
howpublished = {\url{https://canagentswork.com/benchmarks/aisi-cyber-ranges/}},
note = {Accessed 2026-10-11. CC BY 4.0}
}