AI capabilities in cyber tasks doubling every 4.7 months

Recent assessments from the UK AI Safety Institute (AISI) and METR indicate that the scope of cyber tasks AI models can solve with an 80% success rate is doubling approximately every 4.7 months. This metric refers to the complexity of tasks, measured by the time it would take a human expert to complete them, rather than the speed of the AI's execution or the frequency of attacks.

While these findings suggest an acceleration in model capabilities, experts caution against equating benchmark progress directly with real-world cyberattack frequency. For instance, a Verizon report noted that the median time for organizations to resolve known vulnerabilities increased from 32 days to 43 days between 2024 and 2025, while the percentage of organizations fully resolving vulnerabilities dropped from 38% to 26%.

Evidence of AI involvement in cyber incidents has been documented. Security firm GreyNoise recorded hundreds of AI agents being used in attacks against Papercut servers, affecting 395 organizations across 48 countries. Additionally, Binance reported that an October security incident involving approximately $6.34 billion in digital assets involved attackers utilizing internal AI tools to gain access to wallet infrastructure.