Claude Mythos First AI Model to Autonomously Complete Full Cyber Kill Chain

Anthropic's Claude Mythos has become the first AI model capable of autonomously executing a complete cyber kill chain, according to a new industry report. The finding suggests a critical shift in the threat landscape, as AI moves from assisting hackers to independently managing complex attacks.

In the first-ever Cyber Weapon Index (CWI), released by Booz Allen in a report titled "The Offensive Frontier: AI as the Attacker," Claude Mythos scored 80, the highest among 18 tested models from the US and China. While most of the tested models could gain initial access to a system, Mythos was the only frontier API model to independently identify and exploit real-world vulnerabilities to achieve full domain compromise without human intervention. Other frontier models scored zero when tested against actual real-world bugs.

Three other models—Grok-4.5, Muse Spark 1.1, and GLM-5.2—were able to reach full domain access and control, but they failed to complete the full autonomous kill chain. The study also highlighted the role of "attack harnesses," or orchestration software, which can significantly amplify a model's effectiveness. For instance, the report noted that Claude Sonnet's capabilities rivaled those of Mythos when paired with an optimized harness.

The Mechanics of AI Weaponization

The Cyber Weapon Index evaluates models using two primary metrics: the Vulnerability Research Score (VRS) and the Kill Chain Attainment Score (KCAS). These metrics track the transition from theoretical knowledge to the practical application of offensive cyber operations. This research arrives amid growing alarm over "agentic" AI—systems that can take independent action to achieve a goal—as the industry observes the potential for AI agents to target critical infrastructure.

National Security Implications

The ability of an AI to autonomously move from vulnerability research to full system compromise drastically lowers the barrier for sophisticated cyberattacks. Booz Allen warns that mainstream AI-driven attacks from state actors and criminal organizations are now "imminent." The report argues that this creates a national security imperative for the US to establish "overmatch" in both offensive and defensive AI to protect critical infrastructure.

"We must aggressively develop agentic capabilities that accelerate authorized offensive cyber operations while simultaneously building AI-enabled defenses that detect, decide, and respond at machine speed," the Booz Allen report states.

The Path Forward

As the gap between benchmark performance and real-world offensive capability closes, security experts are watching for the proliferation of optimized attack harnesses. While Mythos currently stands alone in its autonomous capabilities, the report suggests that the window for establishing defensive superiority is narrowing. The industry now faces a race to develop AI-driven defenses that can match the speed and autonomy of the next generation of offensive models.