Hello, Cyber Builders 🖖
Last year, AI in cybersecurity advanced quickly. GPT-5 was the first model to show practical cybersecurity skills, analyzing and acting on real use cases. Claude 4.5 followed soon after.
With GPT-6 now released, it is time to review what has changed since then. I’ve built a timeline from 2023 to 2026 of all model releases with their cybersecurity capabilities.
What matters most? I reviewed all the releases and their statements on cybersecurity. The timeline with details and links is at the end of this post. Here are the main points from my analysis.
First, the release pace has accelerated. Labs now push out new models every three to four months instead of six to nine.
Each new release improves the market. Every frontier model outperforms its competitors. It seems like labs expect to be outdone, knowing they will soon release something better themselves.
Second, no single lab has a decisive lead in AI and cybersecurity.
Some labs, as marketing fluff, claim that their model is so powerful that it should be withheld from release, and that they need to share it selectively—only with a few sets of actors, etc. I’ve covered this quite a lot, especially in this article for Mythos, but I strongly believe it’s not true.
Most labs use training data from Scale AI or Mercor. These companies build datasets and provide reinforcement learning environments, so labs end up with similar capabilities. Some invest in their own data, but the difference is minor. Similar training techniques, increasingly available datasets, and evaluation environments make capability advantages harder to sustain.
This is why Chinese providers now match the level of the Mythos release from March 2026. This trend is likely to continue.
Do not assume any one actor has more capacity than the others.
Third, many startups are trying to use AI for cybersecurity. Most begin with penetration testing, repeating a pattern we have seen before. This area attracts newcomers because it is well documented and easy to understand for those outside the field.
This is the most common use case because it is well documented and easy to explain. The typical method is to connect an AI to tools, use a Kali Linux setup, and test if it can perform penetration testing. Benchmarks like Cyber Gym use this approach, and AIs perform well here.
However, if your company only calls the model, it has no real value. It is just a thin wrapper around an AI model.
Note that even though we have compelling evidence that models have become good at the parts of cybersecurity we can benchmark, we know much less about messy production SOC, AppSec, IAM, incident response, architecture, etc… there are still a lot to explore for Cyber Builders!
AI model progress is now measured by how well models reason, explore, and fit into real workflows, not just by size.
Aikido’s latest benchmark used 11.7B tokens to test 10 models against 32 new vulnerabilities. Open-weight models like DeepSeek, Qwen, Kimi, and GLM now compete directly with, and sometimes outperform, public closed frontier models in cybersecurity reasoning.
The main point is that repeated, efficient model runs can provide better coverage than a single expensive frontier model. The frontier still matters, but the old hierarchy is fading quickly.
More on this in the latest post:
Where is this heading? What can we expect next? These are not easy questions, but we can make some predictions.
Model commoditization will continue. AI labs will keep integrating what was previously handled outside the model. For example, Cloud Code reduced their system prompt by 70 percent because US models now understand context better. This behavior is now built into the model weights.
Soon, even smaller models will have the equivalent of a junior cybersecurity expert built into their weights.
Model sizes are likely to shrink, making local deployment on laptops, servers, and customer appliances much more practical. That matters because it can ease concerns about confidentiality and trust. A lot of the cyber community wants the capability, but does not want to send data offsite or absorb high cloud costs.
If model capabilities continue to converge, the model itself will no longer be the moat. Everyone will have access to a strong cyber expert, either via an API or by running it locally.
The real value will move to the layers around the model: proprietary data and context, deep integration into security workflows, the ability to tell when the model is right or wrong, and the systems needed to act safely.
Calling a model will be easy. Building something that understands a company’s environment, learns from outcomes, measures its own performance, and earns trust to take action will be much harder. For Cyber Builders, that is the opportunity.
If you run a cybersecurity program, do not wait or hope for things to settle. Organizations that treat security as an engineering discipline—measuring, automating, validating, and improving—will be ready. Mythos does not change the fundamentals; it only increases the cost of ignoring them.
If you are a startup or a cybersecurity vendor, do not build your moat around access to the smartest cybersecurity model. Assume everyone will have it. Models will get better, cheaper, smaller, and more interchangeable.
Build the company around what matters when every team has the equivalent of a cybersecurity expert: context, data, workflows, evaluation, trust, and the ability to act. AI is not eliminating the opportunity to build in cybersecurity. It is shifting where the leverage is. For cyber builders, that is the signal to pay attention to now.
Tell me in the comments what you think.
Laurent 💚
I’ve asked ChatGPT to help me build this timeline.
Frontier labs mostly ask: can this model make attackers more capable?
Cyber sits next to bio, persuasion, autonomy, and other dangerous capabilities. The reassuring result is that models cannot yet perform sophisticated attacks.
GPT-5 and Claude 4 make significant progress, but something else is happening: open models are starting to catch up.
DeepSeek V3.1 becomes the strongest DeepSeek model tested by the U.S. CAISI. It still substantially trails GPT-5 on cyber, particularly exploitation, but the direction is clear. (NIST)
CAISI evaluation of DeepSeek — NIST
Moonshot releases Kimi K2 Thinking, an open-weight reasoning/agent model capable of executing hundreds of sequential tool calls.
CAISI subsequently evaluates it and finds that it is the most capable Chinese model it has tested, with meaningful cyber improvements over DeepSeek V3.1: 50.5% versus 36.7% on CVE-Bench. It still trails GPT-5 and Opus 4 on agentic cyber tasks. (NIST)
Kimi K2 Thinking — Moonshot AI
CAISI Kimi K2 evaluation — NIST
GPT-5.3-Codex becomes the first OpenAI model treated as High capability in cybersecurity.
The framing changes with it: restrict malicious use while making advanced capabilities accessible to defenders.
GPT‑5.3‑Codex System Card — OpenAI
Anthropic’s Project Glasswing gives selected defenders access to Claude Mythos, an especially capable cyber model.
The underlying idea is important: If AI will eventually discover and exploit vulnerabilities, give that capability to defenders first.
Z.ai releases GLM-5.2.
CAISI calls it probably the most capable open-weight model available at the time of release. And unlike API-only frontier models, its weights are available. (NIST)
CAISI assessment of GLM‑5.2 — NIST
Moonshot releases Kimi K3, a 2.8-trillion-parameter open-weight model.
The joint UK AISI / U.S. CAISI cyber evaluation finds K3 clearly ahead of GLM-5.2: 32% vs. 24% in their exploit-development evaluation, and 17 vs. 11 steps in a 32-step simulated enterprise attack.
In a single run, K3 autonomously covers the entire attack range.
It remains significantly behind the strongest proprietary cyber models—but this is now an open model autonomously compromising a simulated enterprise network. (NIST)
Kimi K3 — Moonshot AI
UK AISI / CAISI Kimi K3 cyber evaluation — NIST
GPT-5.6 reaches OpenAI’s High cyber capability threshold.
Then OpenAI warns that Astra may reach Critical capability.
Then it launches GPT-5.6-Cyber and expands Daybreak around a very different message from 2023: get frontier capability into defenders’ hands before attackers operationalize it at scale.
GPT‑5.6 August update — OpenAI
Critical cyber capabilities — OpenAI
Expanding Daybreak — OpenAI
This is perhaps the most interesting addition.
Independent testing by Aikido takes 32 fresh vulnerabilities, gives models three attempts, and burns 11.7 billion tokens in the process.
DeepSeek V4 Pro finds 28 of the 32 vulnerabilities across three runs—the best result in the test.
Three DeepSeek Pro runs cost about $295 and outperform the tested Opus 5, Grok 4.6 and GPT-5.6 Sol configurations.
That changes the economic argument too: frontier vulnerability research is becoming cheap and widely accessible. (Aikido)
11.7B-token cyber model benchmark — Aikido
Z.ai then releases GLM-5.3.
And its own description contains perhaps my favorite sentence for your post:
“As we scaled post-training, cyber capability developed faster than we expected.”
GLM-5.3 uses the same base model as GLM-5.2. The improvement comes from post-training.
Yet it more than doubles GLM-5.2 on exploitation benchmarks and reaches state-of-the-art performance on CyberGym according to Z.ai’s evaluations. (Hugging Face)
Independent Aikido testing also puts GLM-5.3 and the latest DeepSeek models in what it calls the frontier tier for vulnerability discovery. (Aikido)
GLM‑5.3 model card — Z.ai
Independent cyber benchmark — Aikido
OpenAI concludes that Astra meets its Critical cybersecurity capability threshold.
We have gone from models solving cyber puzzles to frontier systems capable of discovering previously unknown vulnerabilities and constructing working exploit chains.
