In this pre-deployment evaluation, the UK's AI Safety Institute (AISI) documents the cyberoffensive capabilities of OpenAI's GPT-5.5, using its standardized suite of 95 capture-the-flag (CTF) tasks spread across four difficulty tiers, alongside end-to-end attack simulations called "cyber ranges."
On expert-tier tasks at pass@1, GPT-5.5 achieves an average success rate of 71.4% (+-8.0% standard error), substantially on par with Anthropic's Mythos Preview (68.6% +-8.7%) but markedly higher than GPT-5.4 (52.4%) and Opus 4.7 (48.6%). At pass@5, GPT-5.5 sets a record with 90.5% (+-12.9%), the highest score AISI has ever measured. Basic tasks have now been saturated at 100% by every frontier model since February 2026, leaving only the higher tiers discriminative.
The evaluation also includes "The Last Ones" (TLO), a 32-step cyber range built with SpecterOps that simulates a complete corporate network intrusion. This simulation spans four subnetworks and roughly twenty machines, and would take a human expert an estimated 20 hours. GPT-5.5 completed the end-to-end attack chain in 2 out of 10 attempts, becoming the second model to achieve this feat after Mythos Preview (3/10). Evaluations were conducted with limits of 50 million tokens per attempt for narrow tasks and 100 million for cyber ranges, with performance continuing to improve up to these caps.
On safeguards, AISI identified a universal jailbreak after six hours of expert red-teaming. This attack elicited offensive content across the entirety of OpenAI-provided malicious cyber requests, including in multi-turn agentic scenarios. OpenAI subsequently updated its safeguards stack, though a configuration issue prevented AISI from verifying the effectiveness of the final deployed version.
AISI concludes that the rapid progression of cyber capabilities is part of a broader trend: offensive skills emerge as a byproduct of improvements in long-horizon autonomy, reasoning, and coding. If this hypothesis holds, further increases in cyberoffensive capability are to be expected from upcoming frontier models. OpenAI responded by deploying GPT-5.5 with its most robust safeguards to date and by launching a restricted-access GPT-5.5-Cyber product intended for defensive cybersecurity professionals.