Frontier-AI Automates Complex Attack Chains

The most powerful AI models can no longer merely explain program code or flag individual security vulnerabilities. They are increasingly capable of developing exploits, linking multiple attack steps together, and advancing through simulated corporate networks to the point of complete takeover. An analysis by the Bank for International Settlements (BIS) therefore warns of a potential "Mythos Moment": a turning point at which cyber risks to banks, payment systems, and financial market infrastructures are changing faster than established protection and oversight mechanisms can respond. However, the study is not a doomsday prediction. This is because the same models can help companies, government agencies, and service providers identify and close vulnerabilities earlier. The decisive factors are who gains access to the most powerful tools, what computing resources are available, and whether economic incentives favor the offensive or the defensive.

A wake-up call from the engine room of the financial system

The title of the BIS Bulletin alludes to "Mythos", a Frontier model announced in April 2026 with particularly advanced capabilities in cybersecurity. The authors ask whether its performance level marks a qualitative leap: away from AI as an assistive system and toward tools that can prepare and execute complex attacks with limited human oversight. This question is particularly pressing for the financial sector. Banks, stock exchanges, clearinghouses, and payment platforms are among the most heavily targeted and, at the same time, most tightly interconnected sectors of the economy. They rely on long chains of proprietary software, open-source components, cloud services, and specialized third-party providers. A single vulnerability can therefore spread to many institutions through shared technical dependencies.

The study does not describe a systemic shock that has already occurred. Rather, it analyzes the channels through which frontier AI could alter the speed, scope, and complexity of cyberattacks. Its core thesis is that the technology strengthens both sides, but the cost structure is not symmetrical. An attacker needs only a single point of entry; a defender must continuously protect numerous systems, users, interfaces, and supply chains. If AI primarily reduces the cost of finding that one successful path, the balance could shift in favor of the offense despite better defensive tools.

Why Cyberattacks Are an Ideal Application for Frontier AI

Many real-world tasks are difficult for AI because goals are unclear, information is incomplete, and success criteria are ambiguous. Cyber operations, on the other hand, often follow a clearly structured sequence: identify systems, obtain credentials, exploit vulnerabilities, escalate privileges, perform lateral movement within the network, and establish persistence. Each step generates machine-readable feedback—log files, error messages, source code, configuration data, or entries in vulnerability databases. The model can analyze this information, plan the next step, and immediately verify whether the action was successful.

It is precisely these tight feedback loops that make the field attractive for powerful language and reasoning models. The decisive advance does not lie in a model’s ability to identify a single known vulnerability. What is critical is the ability to reliably link multiple sub-steps, adapt them to a specific goal, and choose an alternative route after setbacks. In cybersecurity terminology, the model thus approaches the concept of an agent: it analyzes, decides, acts, and corrects. At the same time, the logic applies in reverse for the defense. Defenders, too, can use the same structured process to simulate attack vectors, detect misconfigurations, and prioritize patches.

From Benchmark to Complete Network Takeover

As an empirical starting point, the BIS uses, among other things, evaluations by the British AI Security Institute. There, models must find and exploit vulnerabilities deliberately placed in "Capture-the-Flag" tasks. The tests comprise 95 narrowly defined tasks across four difficulty levels. Mythos achieved a success rate of 68.6 percent on expert-level tasks. GPT-5.5, released shortly thereafter, outperformed it with a success rate of 71.4 percent.

Even more revealing are multi-stage attack simulations in a so-called cyber range. In the 32-stage scenario "The Last Ones", the models had to, among other things, steal browser credentials, compromise a web application, escalate privileges, establish persistent access, and ultimately take over the entire corporate network. Mythos was the first model to complete all stages in one of the trials; GPT-5.5 demonstrated a similar peak performance. The average scores across ten trials were lower, which is an important detail: the models are not yet reliable in every run. For risk managers and IT security professionals, however, the mere possibility of a successful end-to-end attack is enough to call into question existing assumptions about response times and necessary protective barriers.

Fig. 01: Frontier AI models demonstrate impressive capabilities in the field of cybersecurity [Source: Iñaki Aldasoro, Raphael Auer, Jon Frost, and Fernando Pérez-Cruz (2026): "A Mythos moment? Frontier AI and cyber risk," BIS Bulletin No. 129, Graph 1, p. 2; Data: AI Security Institute (2026)]

Benchmarks are warning signs—but not exact predictions

The results should neither be downplayed nor uncritically applied to the real world. A benchmark with intentionally built-in vulnerabilities, defined success criteria, and a large token budget is more controlled than an attack on an unknown production system. Real-world networks contain inconsistent data, defensive monitoring, technical dead ends, and organizational hurdles. Conversely, real attackers can prepare their tools over an extended period, leverage additional data sources, and combine multiple models. The scientifically sound conclusion is therefore not that autonomous AI can take over any company immediately. Rather, it is that frontier models have reached a capability threshold at which complex attack chains can no longer be demonstrated merely in theory, but in simulations that closely resemble reality.

The Decline in the Cost of the Offensive

A technical capability only becomes a widespread risk when it is economically viable. According to the study’s calculations, a complete attack chain requires approximately 100 million tokens. For Claude Mythos Preview, the estimated cloud costs at the time of the analysis were around $5,000 to $10,000 per attempt. Other frontier models such as Claude Opus 4.8, Gemini 3.5, or GPT-5.5 are expected to cost about one-fifth of that. For more affordable models such as Grok or DeepSeek, the BIS even estimates costs of only about $50 to $100.

This range illustrates why cutting-edge technology is not the only relevant factor. State actors and large criminal groups have already been able to hire expensive specialists. Structural change occurs when powerful attack components become a standardized, scalable service. Then even less experienced attackers can test more targets, run attacks in parallel, and adapt known techniques to new systems more quickly. Falling prices thus do not necessarily change the sophistication of the best-possible attack, but they do change the number of potential attacks and the group of actors capable of carrying them out.

The New Asymmetry: One Point of Entry Is Enough

The central economic concept of the bulletin is the asymmetric distribution of costs. Defenders must continuously secure every critical application, every identity, every interface, and every supplier relationship. Attackers, on the other hand, need only one robust attack chain. Frontier AI can increase productivity on both sides, but an equally rapid adoption does not therefore automatically create a balance. As search, exploit development, and adaptation become cheaper, the pressure on the defense increases disproportionately. More and faster attacks mean greater computational demands for monitoring, detection, and response—and thus rising operating costs.

The decisive factor, therefore, is not solely the performance of a model, but the distribution of access. If banks, operators of critical infrastructure, and security agencies gain early access to frontier models, they can systematically review code bases and patch vulnerabilities before offensive actors exploit them. If access for defensive use remains slow, fragmented, or legally unclear, the time window between discovery and remediation is extended—while the time to attack is simultaneously shortened.

More Vulnerabilities Found: Both Progress and a Warning Sign

The study searches public data for initial signs of this new dynamic. Particularly striking is the number of security fixes in the Firefox browser: According to the BIS, the monthly number of bug fixes increased roughly sixfold following the announcement of Mythos Preview. At first glance, this can be interpreted positively. More powerful tools apparently help detect and eliminate bugs more quickly.

At the same time, the publication of particularly critical Common Vulnerabilities and Exposures (CVEs) accelerated. Between 2018 and 2021, an average of about seven critical vulnerabilities were reported per day; between 2022 and 2025, the figure rose to around ten. After April 1, 2026, the figure at times reached nearly 20 per day. In the analysis, vulnerabilities with a CVSS score of at least 9.0 are considered critical—that is, flaws that are relatively easy to exploit and can have very severe consequences.

Fig. 02: Security patches and the number of reported critical vulnerabilities are rising significantly [Source: Aldasoro et al. (2026), Graph 2, p. 4; Data: Firefox security patches, NIST National Vulnerability Database]

Correlation Does Not Imply Causation

This data in particular calls for cautious interpretation. A rising number of published CVEs may indicate that more flaws are actually emerging. However, it may also indicate that existing vulnerabilities are being discovered more quickly, better documented, and reported more consistently. Furthermore, the software industry is growing, as are the number of components in use and international security research. The authors themselves therefore caution against attributing the spike in 2026 exclusively to new AI models. The temporal proximity is an indication, not causal proof. In practice, however, this uncertainty does little to alleviate the pressure to act: Whether AI creates more vulnerabilities or makes more existing ones visible—in either case, companies must assess, prioritize, and patch them much more quickly.

Data breaches are on the rise, while the human factor is declining

Global data on confirmed security breaches also show a significant increase. For 2025, the global dataset used by the BIS reports more than 20,000 confirmed cases. At the same time, the proportion of incidents with a discernible human element has declined over the long term, while ransomware, the exploitation of technical vulnerabilities, and supply chain attacks, among other things, have gained in significance.

The data set remains incomplete. Attackers do not disclose the tools they use, companies report incidents according to varying standards, and the categories describe the nature of the incident rather than the specific role of AI. Nevertheless, this trend aligns with the study’s thesis: cyberattacks are becoming more automatable and less dependent on a human manually executing every single step.

An Unusual Signal from the Capital Markets

In addition, the authors analyze the stock market reaction surrounding the Mythos announcement. Several cybersecurity stocks subsequently recorded significantly negative cumulative abnormal returns. Here, actual price movements are compared with the returns expected by a market model; the movements of the Nasdaq 100 prior to the event served as a reference.

The reaction is remarkable. A more dangerous threat landscape could actually increase demand for security products. The decline in stock prices suggests that investors simultaneously feared a potential devaluation of established products and business models: If Frontier models perform security analyses directly, parts of existing offerings could become replaceable. However, the study offers a second, less negative explanation. Companies could use the same models to provide more security internally and therefore require fewer external products. Here, too, the event study does not demonstrate a long-term effect; however, it shows that the market views the technology not only as an additional source of demand but also as a potentially disruptive factor.

Fig. 03: Reported data breaches are rising; following the Mythos announcement, expectations for cybersecurity companies are shifting [Source: Aldasoro et al. (2026), Graph 3, p. 4; data: Verizon and LSEG Datastream]

Why a Cyber Incident Can Become a Stability Risk

For the BIS, the key factor is the systemic dimension. A cyber incident at a single company is initially an operational and isolated risk. It becomes systemic when shared dependencies and close interconnections propagate the disruption. Payment, trading, and post-trade platforms process transactions for billions of businesses and individuals. This applies equally to other sectors of the private economy and, above all, to the "public sector". In the financial services sector, outages can freeze liquidity, delay payments, hinder collateral transfers, and undermine confidence in key market mechanisms. In other sectors, even more scenarios are conceivable.

The technical conditions for such cascading effects are in place: complex software stacks, legacy core systems, open-source components, cloud infrastructures, and specialized third-party providers. Particularly in the case of shared code, the societal benefit of a discovered and disclosed vulnerability outweighs the private benefit to the individual company that funds the search. Economically, this creates an externality. Companies might underinvest in joint vulnerability research and disclosure because part of the benefit accrues to competitors or other market participants. Based on this, the BIS analysis identifies a clear role for oversight, coordinated scans, and institutionalized information sharing.

What Companies and Authorities Should Do Now

From the authors’ perspective, the short-term priority is clear: frontier models must be rapidly deployed defensively to audit code bases and eliminate vulnerabilities. This is not about another pilot project in an innovation lab, but rather about integration into the operational security architecture. In-house developments, legacy software, open-source dependencies, internet-facing systems, and third-party interfaces deserve special attention. Critical suppliers—especially cloud providers—must be included in testing, reporting channels, and remediation processes.

Exercises must also evolve. Traditional cyber crisis exercises often assume response times of hours or days. AI-powered attack chains can drastically compress this time window. Scenarios should therefore simulate automated reconnaissance, parallel attacks, the compromise of third-party software, and very short escalation times. What matters is not only whether an organization can detect an incident, but whether it can, under high pressure, revoke access rights, isolate systems, activate backup processes, and coordinate communication with other market participants.

Coordination as Part of Technical Defense

Cyber resilience in the financial system cannot be achieved solely at the level of individual institutions. The analysis calls for close cooperation between financial firms, central banks, supervisory authorities, national security agencies, and operators of critical infrastructure. The goal is for defenders to be able to utilize new modeling capabilities as early as possible and to quickly share information about vulnerabilities within a legally sound framework.

Internationally, existing frameworks should be further developed. The BIS refers, among other things, to the Financial Stability Board’s principles on operational resilience and response to cyber incidents, the Basel Principles on Operational Resilience, and the CPMI-IOSCO guidelines for financial market infrastructures. The well-known areas of action—identify, protect, detect, respond, and recover—remain valid. However, they must be supplemented by AI-specific attack vectors, faster-paced scenarios, joint testing of new models, and stronger monitoring of supply chains.

In the medium term, there is a need for interoperable terminology, secure communication channels, clear protection rules for shared information, and fair reciprocity. Not every jurisdiction has the same computing resources or the same expertise. International capacity-building programs could therefore test common AI-supported resilience tools and provide smaller agencies with access to testing procedures. Geopolitical boundaries will continue to limit the exchange of sensitive threat intelligence; this makes resilient cooperation within trusted networks all the more important.

How quickly does insight turn into a fix?

The study shifts the focus from the abstract question "Is AI dangerous?" to a more concrete operational question: How wide is the gap between discovering a vulnerability and effectively addressing it? Frontier AI shortens the search time on both sides. If governance, patching processes, and approvals remain as slow as they are now, the attacker stands to benefit the most.

For executive boards and risk managers, this implies a different management model. Relevant metrics include not only the number of open vulnerabilities, but also their exposure, exploitability, prevalence across shared components, and the expected time to resolution. Added to this are the availability of alternative procedures, concentration among third-party providers, and the question of whether an attack on a shared platform could compromise multiple critical functions simultaneously. AI risk management and cyber risk management—as well as enterprise-wide risk management—must therefore not be treated separately: The model is simultaneously a productivity tool, a target for attack, a defense mechanism, and a potential accelerator of systemic cascades.

Conclusion: A Shrinking Window of Opportunity

The "Mythos Moment" does not lie in machines suddenly becoming infallible hackers. It lies in the fact that the most powerful models combine several capabilities that were previously distributed among different specialists: code analysis, vulnerability scanning, exploit development, planning, and iterative execution. The technology reduces costs, increases scalability, and shortens the time from discovering a vulnerability to launching an attack. This development is impacting a financial sector whose stability depends on complex, shared systems that are sometimes difficult to update.

At the same time, the study offers a realistic alternative to the purely threat-focused narrative. Frontier AI can massively strengthen defenses—provided that defenders gain early access, integrate the models into real-world processes, and share insights more quickly than before. The central political and corporate task is therefore not to halt technological progress, but to adapt institutional response speeds to keep pace with it. Whether the new equilibrium will lead to more or less systemic cyber risk remains to be seen. What is no longer in question, however, is whether organizations must take action.