Policy Frontier Red Team What we learned mapping a year’s worth of AI-enabled cyber threats Jun 3, 2026 As AI transforms the nature of and methods behind cyberattacks, how well do the techniques and frameworks used by the security community hold up? …
… Using Claude, PNNL researchers emulated cyber attacks on a high-fidelity simulation of a water treatment plant in far less time than it would have taken a human expert, serving as a proof of concept for how AI can help cyber defenders iterate faster on red teaming exercises. …
… Some technique families that are staples of real-world cyberattacks—such as active directory exploitation, Kerberos ticket attacks, cloud infrastructure manipulation AWS, Azure, GCP , and container escape —have notably lower representation within the dataset. …
… Adopting and experimenting with AI will be key for defenders to keep pace. We believe we are now at an inflection point for AI’s impact on cybersecurity. For several years, our team has carefully tracked the cybersecurity-relevant capabilities of AI models. …
… High-risk dual use actions include: Hacking, penetration testing, red teaming, and bug bounties; Gaining cyber access through unexpected or unauthorized means: exploitation, credential attacks brute force, spraying, stuffing, theft , and authentication bypasses; Privilege escalation, lateral moveme… …
… As an example of the role of general scaling, Claude Sonnet 3.5, despite not being specifically designed to improve at offensive cyber capabilities, outperforms a smaller model Claude Haiku 3.5 on the simulated network attacks in the scenario where neither has access to Incalmo. …
… Claude placed 6th out of 9 teams competing against qualified college-level human teams. PlaidCTF April 4, 2025 : A challenging cybersecurity competition with puzzles in areas like binary exploitation, reverse engineering, and web attacks. …
… In that world, cyberattacks could occur much more often, and in much more unpredictable forms. It’s imperative that cyberdefenders adapt to maintain pace . …
… In what follows, we provide more details on each incident and how we’re responding moving forward. Background on cyber evaluations We regularly run cybersecurity evaluations that involve simulating real offensive cybersecurity challenges. …
… With this context in mind, here's what we've learned about AI capability advancement across key domains. Cybersecurity In the cyber domain, 2024 was a ‘zero to one’ moment. …