An assessment by a British government-affiliated research institute found that OpenAI's GPT-5.5 showed advanced cyberattack capabilities in a controlled research environment.

CoinPost, a blockchain media outlet, reported on Friday that the AI Safety Institute (AISI), part of Britain's Department for Science, Technology and Innovation, warned of GPT-5.5's strong ability to carry out cyberattacks in a report released on April 30.

AISI evaluated GPT-5.5 in 2 ways. In the first CTF approach, it measured vulnerability discovery and the ability to run attack code. On the highest-difficulty set of tasks, GPT-5.5 had an average success rate of 71.4 percent. That was higher than Mythos' 68.6 percent. It solved a reverse-engineering task in 10 minutes 22 seconds. AISI explained that a human security expert could spend about 12 hours on the same task.

The second assessment took place in a cyber range that simulates real network environments and defenses. In a 32-stage simulation dubbed "The Last Ones," modeled on corporate intrusion paths, GPT-5.5 achieved full autonomous success twice in 10 attempts. The simulation was presented as a task that takes about 20 hours when carried out manually by an expert. But in a "Cooling Tower" simulation targeting industrial control systems, no AI model broke through.

AISI noted that models with advanced attack capabilities are emerging in succession from different AI developers. If advances in logical reasoning and autonomy are leading to improvements in cyber techniques, it said similar capability gains could appear across multiple models in the near term.

The assessment reflects results from a controlled research environment and does not directly link to the performance of a public-release GPT-5.5. Safety guardrails are applied to public models. Still, a red-team test run for about 6 hours found a method to neutralise the guardrails. It also elicited dangerous responses from all prepared malicious prompts. OpenAI later applied a patch, but final safety verification was not completed due to a configuration issue in the deployment environment.

In Britain, 43 percent of companies suffered cyberattack damage over the past year. The British government is moving to strengthen defenses by injecting an additional 90 million pounds in funding to respond to new threats.