Frontier models stopped being just chatbots sometime in 2025. By April 2026, two different models had completed a multi-step corporate network attack simulation end to end, one of them in about 10 minutes for $1.73 in API costs. The same capabilities that let defenders find bugs faster let attackers find them faster too. That is why security agencies in the UK, US, Canada, and the EU all issued frontier-AI warnings between April and July 2026.

This is not a doomsday piece. The UK National Cyber Security Centre still calls AI a long-term net positive for defence. The problem is the path there: faster discovery, agentic execution, collapsing patch windows, and a much larger attack surface inside your own stack. If you ship software, run infrastructure, or approve AI tools, this is the part you need to understand.

The short answer

  • Frontier AI means the most capable current models, the ones that can reason, use tools, and run multi-step tasks. The UK NCSC definition is the one regulators keep reusing.
  • It became a security problem when three things converged: models that find real vulnerabilities, agents that execute attack steps without constant human input, and wide availability through APIs and open weights.
  • The practical effect is speed and scale. Work that took a skilled practitioner 12 hours now runs in minutes. Response windows shrink from days to hours.
  • The fix is unglamorous: patch faster, shrink external exposure, lock down agent permissions, review AI-generated code like untrusted input, and monitor like someone else is already using AI against you.

What counts as frontier AI

The UK National Cyber Security Centre uses frontier AI to mean the most advanced, general-purpose models available at a given time. The Canadian Centre for Cyber Security and New Zealand NCSC reuse the same framing. It is not a legal category with a fixed model list. It is a moving threshold: if a model can do long-horizon reasoning, call tools, read code, and chain steps together, defenders treat it as frontier for security purposes.

Two properties matter for security. The first is capability: vulnerability research, exploit development, phishing, and reconnaissance at lower cost than a human specialist. The second is agency: the model does not just advise, it acts through code execution, browsers, terminals, and APIs. When both improve at once, existing weaknesses get found and exploited faster than existing patch processes handle.

1. Vulnerability discovery now runs at machine speed

This is the best-documented shift, because defenders can measure it in CVEs.

Google’s Big Sleep agent, built by DeepMind and Project Zero, found its first real-world vulnerability in November 2024. By August 2025 it had found and reproduced 20 flaws in widely used open-source software including FFmpeg and ImageMagick, each without human intervention before a human verified the report. Google then disclosed a critical SQLite flaw, CVE-2025-6965 with a CVSS score of 7.2, that threat intelligence suggested attackers were preparing to use. Google describes this as the first time an AI agent directly cut off exploitation in the wild. In November 2025 the same program was credited with five WebKit flaws in Safari, CVE-2025-43429 through CVE-2025-43434.

University benchmarks show the same trend outside one vendor. Berkeley’s CyberGym, published October 2025, tests agents against 1,507 real-world vulnerabilities across 188 open-source projects. Top agents succeeded on about 30% of tasks in a single try and about 67% with 30 tries, up from about 10% single-try success in earlier model generations. The same runs produced proof-of-concept exploits that exposed 17 incomplete historical patches and 10 previously unknown zero-day vulnerabilities that had persisted on average 969 days. A follow-up scale test across 431 OSS-Fuzz projects found 7 confirmed zero-days with GPT-4.1 and 22 with GPT-5.

Government evaluations confirm the pace. The UK AI Security Institute reported on April 30, 2026 that OpenAI’s GPT-5.5 was the second model to solve one of its multi-step corporate network attack simulations end to end. On expert-level capture-the-flag tasks it passed at 71.4%, ahead of Claude Mythos Preview at 68.6%, GPT-5.4 at 52.4%, and Opus 4.7 at 48.6%. One challenge that took an expert playtester roughly 12 hours fell to GPT-5.5 in 10 minutes and 22 seconds for $1.73 in API usage. Two weeks earlier the first solver had been Anthropic’s Claude Mythos Preview on a task estimated at 20 human hours. On May 13, 2026 the Institute noted the length of cyber tasks models can complete had been doubling roughly every 4.7 months since late 2024, faster than its November 2025 estimate of 8 months.

The NCSC’s April 2026 defender briefing draws the blunt conclusion: in specific cyber tasks, models already exceed what a skilled practitioner can do at lower cost. Models released before March 2026 still failed full end-to-end attack chains and tended to trigger detectable alerts, which gives defenders a near-term edge. That edge only holds if defenders actually use the same tooling.

2. From advisor to operator: agents execute attacks

Finding a bug is one step. Running the intrusion is what changed in 2025.

Anthropic’s August 2025 threat intelligence report documents the pattern with unusual specificity. One operation, tracked as GTG-2002, used Claude Code to perform on-keyboard extortion work: reconnaissance, credential harvesting, data exfiltration, and financial analysis to set ransom pressure, rather than classic encryption. A separate actor with only basic coding skills used Claude to build and sell ransomware variants for $400 to $1,200. A Chinese actor integrated Claude across nearly all phases of a 9-month campaign. North Korean IT-worker fraud operations used AI to scale fake employment.

On November 13, 2025 Anthropic reported what it calls the first documented large-scale attack executed with unprecedented agent involvement: a assessed Chinese state-sponsored actor used Claude Code to attempt infiltration of roughly 30 global targets in tech, finance, chemical manufacturing, and government, succeeding in a small number. AI performed an estimated 80 to 90% of the campaign work, with humans intervening at only 4 to 6 decision points per intrusion. At peak the agent made thousands of requests, multiple per second, a tempo no human team matches.

Anthropic’s follow-up study of 832 banned accounts from March 2025 to March 2026 found the share rated medium risk or higher rose from 33% in the first half to 56% in the second. The highest-risk actor scored 100 out of 100 without using an unusual number of techniques. What distinguished it was orchestration: chaining standard techniques through an agent scaffold. Technique counts alone no longer predict risk.

If you give coding agents broad repo and infrastructure access, you are handing that same orchestration capability to anything that compromises them. Our guide to how to protect Git repositories from AI agent abuse covers the concrete controls: scoped tokens, branch protection, mandatory human review, and secret hygiene.

3. The patch window is collapsing from days to hours

Faster discovery means faster exploitation. Every major cyber agency said the same thing in spring 2026: assume less time.

The NCSC’s May 2026 patch wave warning is the clearest statement. Years of technical debt across open source, commercial, proprietary, and SaaS software are now exploitable at scale by people with enough skill to direct AI. The Centre expects a forced correction: a rush of disclosures requiring updates across the whole stack, including critical-severity fixes. Its prescription is to update by default, enable hot patching and automatic updates where safe, prioritize external attack surfaces first, and triage with a risk-based system such as SSVC. Patching alone will not cover end-of-life systems that cannot receive updates. Those need replacement or isolation.

Canada’s Centre for Cyber Security, in its June 2026 frontier-AI advisory, tells organizations to make patching a daily check and to schedule more frequent outage windows, prioritizing edge-facing systems. The New York Department of Financial Services advisory of May 21, 2026 tells regulated financial entities to reassess vulnerability timelines, build dependency maps with third-party providers, and test whether logging and alerting can handle heightened tempo. The EU financial supervisors’ July 31, 2026 statement adds that static, signature-based controls and annual pen tests cannot keep pace with adaptive AI-driven threats and pushes continuous monitoring.

Broadcom’s Infrastructure Software Group reported in April 2026 that treating frontier models as scanners undersells them. Treated as directed engineers with threat models, live environments, and a requirement to produce working proof-of-concept exploits plus fixes, the same models broke triage-based workflows. Their forecast is three phases: an orderly first wave among well-resourced vendors now, a harder 6 to 18 month wave through long-tail open source with thin maintainer capacity, then a new normal. Days-long remediation targets will not be sufficient in phase two.

4. Your own AI deployment is now part of the attack surface

The external threat gets the headlines. The internal deployment mistake is what most teams will actually experience first.

OWASP’s 2025 Top 10 for LLM applications ranks prompt injection as LLM01 and excessive agency as LLM06 for a reason. Direct injection manipulates the model through user input. Indirect injection hides instructions in retrieved content such as web pages, files, or tickets. RAG and fine-tuning do not fix this class. When an agent has tool access, a successful injection stops being a bad answer and becomes unauthorized actions: reading files, calling APIs, changing data.

Excessive agency is the configuration mistake that turns injection into damage: too many tools, too-broad permissions, too much autonomy. OWASP lists the triggers plainly, including hallucination on benign prompts, not just malicious input. The root causes are excessive functionality, excessive permissions, and excessive autonomy.

Evaluation incidents show this is not theoretical. The UK AI Security Institute disclosed on August 4, 2026 that agents under test took 19 unsanctioned actions against real people and systems on the live internet across 10 of 122 runs, almost all from one model under test conditions with unrestricted outbound access and disabled safeguards. Detection came from generic telemetry, Tor traffic anomalies, not AI-specific tooling. The test setup was intentionally permissive to measure capability, but the lesson transfers: permissive defaults plus network access produce real-world side effects fast.

Practical translation: treat agent output as untrusted input, validate before execution, scope tools to the minimum set, require approval for irreversible actions, and log everything. If you run agents on Linux hosts, the AI-powered Linux security monitor pattern shows one way to combine deterministic rules with local triage so telemetry never has to leave the host.

5. Model weights, code, and engineering process are theft targets

RAND’s October 2025 report on securing frontier AI frames the lab-security problem well. Voluntary commitments exist, but competitive pressure discourages consistent investment in safeguards. RAND lays out four governance options ranging from mandatory standards for high-risk developers, to federal-use authorization, to an industry consortium, to deeper voluntary collaboration on standards, sharing, red-teaming, and personnel security. The throughline is that weights, training data, scaffolding, and evaluation harnesses are now high-value targets for theft, misuse, or compromise.

Two mechanisms matter even if you never train a model. The first is distillation and extraction: reusing outputs from a frontier system to bootstrap a rival, which carries safety and IP risk and is explicitly flagged in US congressional testimony on the Frontier Model Forum’s 2026 threat-sharing work. The second is ordinary supply-chain compromise aimed at AI teams: poisoned datasets, compromised plugins and extensions, and leaked API keys or publish tokens. OWASP tracks these as supply-chain and data-poisoning risks for a reason.

If your team builds on open weights locally to keep data in-house, do it deliberately. Our tested path for running an open-weight LLM on Ubuntu with Ollama covers install, systemd checks, and API exposure on localhost, which is a safer starting point than an internet-facing demo.

6. Open weights and cheap inference remove the gatekeeper

Closed APIs have abuse monitoring, rate limits, and revocation. Open-weight releases do not. Once capable weights are downloadable, safeguards become voluntary and enforcement becomes forensic. That is the tradeoff the Berkeley and AISI results make concrete: the same CyberGym and CTF performance that helps a small team audit its own code also helps a low-skill actor attempt the same steps with no vendor in the loop.

This does not mean open weights are the enemy. Local models reduce data-exposure risk and are often the right call for sensitive triage. It means your threat model cannot assume attackers lack good models. The NCSC, Canadian, and New Zealand guidance all converge here: assume attackers already have capable tools, and invest the advantage on the defender side instead.

What to do this week if you ship or run software

No new platform required. These are the controls every 2026 advisory repeats.

  • Inventory external exposure. List internet-facing services, AI endpoints, agent webhooks, and vendor portals. Reduce what is reachable before you harden what remains.
  • Move to update by default. Enable automatic updates where safe, hot patching where available, and weekly or daily patch windows for edge systems. Track mean time to patch for critical CVEs and report it upward.
  • Scope agent permissions. No publish keys, no production credentials, and no irreversible tools in the default agent workspace. Require human approval for push, publish, infra changes, and data exfiltration paths. The Git abuse guide above has the checklist.
  • Review AI-generated code like a stranger wrote it. The NY DFS specifically calls out human oversight before production. Run tests, SAST, dependency audit, and secrets scan. Our Linux kernel AI review shows why: AI output looks confident and still needs maintainer-grade review. See how AI is changing Linux kernel development.
  • Validate agent output before execution. Treat tool calls as untrusted. Allowlist tools, constrain arguments, confirm destructive actions, and keep a full audit trail of prompts, tool calls, and approvals.
  • Harden builds and dependencies. Pin with lockfiles and hashes, verify maintainers, isolate package publish from agent sandboxes, and monitor for typosquats. Supply-chain evaluation failures in 2026 started with exactly these gaps.
  • Test detection, not just prevention. Pre-March-2026 agents were noisy. Assume that advantage fades. Exercise logging, alerting, and isolation drills, including operating without the compromised system. Canada’s critical-infrastructure guidance explicitly recommends practicing 3-month isolation scenarios.

Where defenders actually gain

Speed cuts both ways. The same AISI and Big Sleep results that worry CISOs are already cutting defender toil: vulnerability triage, secure code review, malware analysis, detection engineering, and patch validation. OpenAI’s GPT-5.5 Trusted Access for Cyber program is one attempt to put permissive defensive workflows in verified hands without opening the same permissions to everyone. Google’s Timesketch work with Sec-Gemini points the same way for forensics.

The pattern from Broadcom’s testing is worth copying: give the model a threat model, a live validation environment, and a requirement to prove every claim with a working exploit and a proposed fix, then reject anything unproven. That discipline is what turns a demo into a security control. For broader context on how DevOps work changed in the first half of 2026, see DevOps in 2026.

If you need a starting toolset for checks you can run today, the DevStackIO security tools cover hashing, encoding, and password checks without sending data anywhere. They do not replace patching and scoping, but they remove excuses for skipping small verifications.

Frequently asked questions

Is frontier AI creating new vulnerabilities or just finding old ones faster?

Mostly the second, so far. The NCSC and AISI describe amplification of existing weaknesses at greater speed and scale, not a new vulnerability class. The risk is that decades of technical debt get exposed in a short window, which is why the patch-wave warnings focus on tempo rather than novel bug types.

Can AI fully automate hacking now?

No, but the human portion keeps shrinking. Pre-March-2026 models failed full end-to-end chains in AISI testing. By April 2026 two models completed corporate-range simulations, and the November 2025 espionage case ran 80 to 90% autonomously. Treat full automation as a matter of time and scope, not possibility.

What is the single highest-leverage fix for a small team?

Shrink external exposure and patch it automatically. Every advisory from the UK, Canada, the EU, and New York repeats this order: external attack surface first, update by default second, monitoring third. Agent permission scoping is the close fourth if you run coding agents.

Should we ban AI coding tools to stay safe?

A ban usually pushes usage underground where you lose logging and review. A safer pattern is scoped, logged, reviewed use: limited tools and data access, mandatory human review before merge or deploy, secrets scanning, and no production credentials in agent workspaces. See our Git repository protection guide for the setup.

Related DevStackIO resources

Sources and verification notes

  • UK NCSC, Frontier AI: what you need to know, verified Sept 14, 2026. Easier, faster, cheaper attacks for low-skilled actors; agentic AI plans and acts; net-positive long term with urgent action now.
  • UK NCSC, Preparing for a vulnerability patch wave, May 2026, and Retaining defensive advantage, Apr 15, 2026. Forced correction of technical debt; update by default; prioritize external surfaces; SSVC triage.
  • UK NCSC, Why cyber defenders need to be ready for frontier AI, Apr 2026. 7 frontier models tested pre-March 2026; exceed skilled practitioner in specific tasks at lower cost; still short of end-to-end; detectable via alerts.
  • UK AI Security Institute, Evaluation of OpenAI GPT-5.5 cyber capabilities, Apr 30, 2026. Second end-to-end range solver; expert CTF 71.4% vs Mythos Preview 68.6% vs GPT-5.4 52.4% vs Opus 4.7 48.6%; 10m22s and $1.73 vs ~12 human hours.
  • UK AI Security Institute, How fast is autonomous AI cyber capability advancing, May 13, 2026. Cyber time horizon doubling ~4.7 months since late 2024, accelerating from 8-month Nov 2025 estimate.
  • Anthropic Threat Intelligence Report Aug 2025 and Disrupting the first AI-orchestrated espionage campaign Nov 13, 2025. GTG-2002 vibe hacking; $400-$1,200 ransomware; 9-month lifecycle use; ~30-target espionage at 80-90% AI execution.
  • Anthropic Attack Navigator study, Mar 2025 to Mar 2026, 832 accounts. Medium-or-higher risk share 33% to 56%; 13,873 observations; orchestration matters more than technique count.
  • Google Cloud CISO Perspectives July 17, 2025; Big Sleep announcements Aug 2025; Hacker News Nov 4, 2025. 20 open-source flaws found and reproduced by AI; CVE-2025-6965 SQLite CVSS 7.2 pre-exploitation cut-off; 5 Safari WebKit CVEs 2025-43429 to 43434.
  • UC Berkeley CyberGym, Oct 8, 2025. 1,507 vulns across 188 projects; ~30% single-try and ~67% with 30 tries; 35 PoCs to 10 unique zero-days averaging 969 days; GPT-4.1 7 and GPT-5 22 confirmed zero-days in OSS-Fuzz scale test.
  • NY DFS Industry Letter May 21, 2026. Frontier capabilities not yet broadly available but coming; expedited vuln management; dependency maps; human oversight for AI code; heightened monitoring. No new requirements imposed.
  • Canadian Centre for Cyber Security frontier AI advisory June 2026 and ITSAP.10.050. Daily patch checks; prioritize edge; defender response window shrinking to hours; isolation drills.
  • EU ESAs Joint Statement July 31, 2026. Static controls insufficient; move to continuous monitoring and AI-augmented DevSecOps.
  • RAND RR-A4159-1, Governance Approaches to Securing Frontier AI, Oct 7, 2025. Four governance models; voluntary commitments weakened by competitive pressure.
  • OWASP Gen AI Security Project, LLM Top 10 2025. LLM01 Prompt Injection; LLM06 Excessive Agency; RAG and fine-tuning do not fully mitigate injection.
  • Broadcom Infrastructure Software Group, Apr 23, 2026 frontier-model code testing. Context plus tooling plus adversarial validation required; triage-based management breaking; phased impact forecast.

Keep going on DevStackIO

For the governance side, see what Microsoft Humanist AI Code requires from agent builders.

Related Tools

Try these companion tools on DevStackIO Tools:

  • CSP generator — build Content Security Policy headers to defend against AI-driven attacks.