GPT-5.5 Matches Mythos in Cybersecurity Performance

OpenAI's GPT-5.5, released publicly last week, performs at a similar level to Anthropic's Mythos Preview model in cybersecurity tasks, according to new research from the UK’s AI Security Institute (AISI) [2]. Anthropic had previously restricted Mythos Preview's release to "critical industry partners" due to its advanced cybersecurity capabilities [2, 3].

The AISI tested both models on 95 Capture the Flag challenges, including reverse engineering and web exploitation [2]. On "Expert" level tasks, GPT-5.5 passed an average of 71.4 percent, slightly outperforming Mythos Preview's 68.6 percent [2]. In one instance, GPT-5.5 built a disassembler to decode a Rust binary in 10 minutes and 22 seconds without human help, costing $1.73 in API calls [2]. Both models also showed progress on "The Last Ones" (TLO), an AISI simulation of a 32-step data extraction attack, with GPT-5.5 succeeding in 3 of 10 attempts and Mythos Preview in 2 of 10 [2]. No previous model had ever succeeded at TLO [2]. However, neither model could solve the more difficult "Cooling Tower" simulation, which tests disruption of power plant control software [2].

OpenAI launched GPT-5.5 on April 24, 2026, making it available to Plus, Pro, Business, and Enterprise users in ChatGPT and Codex [1]. The company describes GPT-5.5 as its "smartest and most intuitive" model to date, excelling in coding, debugging, data analysis, and using various software tools [1]. It is designed for "agentic programming," allowing users to give it complex tasks and trust it to plan, use tools, and verify its work [1]. OpenAI also released GPT-5.5-Cyber as part of its Daybreak cyber initiative, indicating a focus on models for both defensive and potentially adversarial security applications [3].

These new models are not just faster at finding known vulnerabilities; they are "demonstrably better" at discovering previously unknown attack surfaces than initial estimates suggested [3]. OpenAI states that GPT-5.5 is its most powerful agentic programming model, achieving 82.7% accuracy on Terminal-Bench 2.0, which tests complex command-line workflows, and 58.6% on SWE-Bench Pro for solving real GitHub issues [1]. Engineers who tested GPT-5.5 noted its strong ability to understand system architecture, predict testing needs, and complete complex refactoring tasks with minimal corrections [1]. The emergence of these highly capable AI models signals a shift in the calculus for cybersecurity, with implications for both defense and potential exploitation [3].