AISI shows how fast AI cyber capabilities are growing

What this is about

The UK AI Security Institute has published its Frontier AI Trends Report, offering a sober benchmark for an uncomfortable question: how quickly are AI systems getting better at security-critical tasks? The answer is not reassuring, but it is not panic either. Capabilities are rising in measurable ways, while safeguards are improving but remain incomplete.

On July 17, 2026, media coverage sharpened the security angle again because Chinese open models are moving closer to leading US systems. For Cyber Ivy, the core issue is not the country race. The more important point is that cyber capabilities, open model weights, and agent scaffolds combine into a practical risk for companies, public agencies, and developer teams.

What the AISI trends report actually does

The report brings together two years of AISI testing on frontier systems. It examines cyber tasks, chemistry and biology tasks, autonomy, possible loss-of-control precursors, safeguards, and societal effects. In cyber, AISI tests whether models can find vulnerabilities, solve tasks in a cyber range, or become materially more capable when given better tools and prompts.

One of the most important numbers: the best models now complete apprentice-level cyber tasks 50 percent of the time on average. In early 2024, AISI says the figure was just above 10 percent. The institute also reports that in 2025 it tested the first model able to complete expert-level tasks that would typically require more than ten years of human experience.

Why it matters

Cyber risk does not begin only when a model can compromise an entire corporate network by itself. It is enough if it makes individual steps cheaper, faster, and more accessible: reconnaissance, code analysis, exploit ideas, phishing variants, or understanding unfamiliar toolchains. Those intermediate steps matter for defenders.

The report also shows that scaffolding changes performance. When a model receives better tools, more suitable system prompts, and a richer interactive environment, its effectiveness increases. AISI observed a gain of nearly ten percentage points on a cyber development set through an improved agent scaffold. In other words, risk depends not only on the model name, but also on how someone wraps and deploys the model.

AISI also says the gap between proprietary and open models is shrinking. External data suggests a gap of four to eight months. That is positive for research and competition, but difficult for misuse prevention. Open weights cannot be recalled after release, can be modified locally, and can be used outside monitored environments.

In plain language

Imagine a workshop. In the past, a trained specialist was needed to operate a complicated machine. Now a very capable assistant stands beside it, explaining steps, handing over tools, and finding mistakes faster. The machine does not build an entire product alone, but far more people can perform dangerous intermediate steps.

A practical example

A mid-sized software vendor runs 180 internal repositories and receives 600 dependency alerts per month. Previously, one security engineer examined 80 of them closely and roughly prioritized the rest. An attacker with an open model and a simple agent scaffold can analyze the same public packages, sort proof-of-concept ideas, and propose 15 likely attack paths within two hours.

That does not mean all 15 work. But if only two are realistic, the defensive workload changes. The company needs better prioritization, faster patching, stricter secret scanning in repositories, and clear rules for which internal data may enter AI coding tools.

Scope and limits

First, AISI tests are not forecasts for every real-world attack. Cyber ranges and benchmarks measure important capabilities, but real networks, human mistakes, and operational context are more complicated.

Second, a stronger open model does not automatically mean more harm. The same models can improve defense, code review, and research. Risk comes from the combination of capability, access, instruction, and motive.

Third, safeguards are not useless. AISI sees progress, including much higher effort for certain jailbreaks. At the same time, the institute found vulnerabilities in every system it tested. Defense cannot rely on model rules alone.

SEO & GEO keywords

AI Security Institute, AISI Frontier AI Trends Report, AI cyber risk, open AI models, open weights, cyber range, AI agents, jailbreaks, frontier models, model safety, vulnerability analysis, AI governance