OpenAI on Thursday unveiled GPT-5.5-Cyber, a specialized version of its latest AI model designed to find and patch vulnerabilities in critical systems. The model is rolling out in a limited preview to vetted cybersecurity teams, the company said in a blog post. It arrives just two weeks after Anthropic's Claude Mythos Preview sent shockwaves through the security community by demonstrating capabilities no AI had ever shown before.

The UK AI Security Institute has already tested both models. The results are striking. In a standardized 32-step simulated corporate cyberattack, Mythos completed the full attack chain 3 out of 10 times. GPT-5.5-Cyber managed it 2 out of 10. Before Mythos launched in April, no AI model had ever completed that test at all.

That sentence is worth sitting with. In less than a month, we went from "no AI can do this" to two competing models that can independently execute a multi-stage corporate breach. The cyber arms race between OpenAI and Anthropic is no longer theoretical.

Two Approaches, Same Dangerous Capability

The two companies are taking fundamentally different approaches to distributing these models. OpenAI is rolling out GPT-5.5-Cyber as a "more permissive" version of its latest model, trained to handle security-related tasks like vulnerability identification, patch validation, and malware analysis that the standard GPT-5.5's safety guardrails would otherwise block. It is available through a limited preview to vetted teams.

Anthropic took a different path with Mythos. It launched Project Glasswing, a cybersecurity initiative that restricts access to a select group of companies. CEO Dario Amodei personally met with senior Trump administration officials to discuss the model's capabilities. The Federal Reserve chairman and Treasury Secretary held meetings with major bank CEOs specifically about Mythos. Vice President JD Vance and Treasury Secretary Scott Bessent convened a call with leading tech CEOs ahead of the model's release.

This is not normal product distribution. When the Federal Reserve is briefing bank CEOs about an AI model, the threat assessment has moved beyond hypothetical.

The Capacity Problem Is the Real Story

Bloomberg reported this week that Anthropic's decision to limit Mythos access was not purely a safety play. The company simply does not have enough compute to serve it at scale. Amodei disclosed at Code with Claude on Wednesday that Anthropic saw 80x year-over-year revenue and usage growth in Q1. The company planned for 10x at most. Infrastructure is overwhelmed.

That capacity crunch creates an opening for OpenAI. GPT-5.5-Cyber may not match Mythos on the UK benchmark (2/10 vs 3/10), but if OpenAI can actually serve it to more teams, the practical impact could be larger. In cybersecurity, availability matters as much as capability.

What to Watch

The immediate question is whether these models end up strengthening defenders or creating new attack vectors. OpenAI says GPT-5.5-Cyber is designed for defensive use. Anthropic says the same about Mythos. But both companies just demonstrated that AI can independently execute multi-stage cyberattacks, and the capabilities will only improve from here.

The UK AI Security Institute benchmark went from impossible to routine in 30 days. Both models will be tested again in Q3. If the completion rate climbs above 50%, the conversation shifts from "can AI do this" to "how do we stop AI from doing this when humans ask it to." That is a very different conversation, and one neither company seems fully prepared for.

First reported by Politico and CNBC. UK AI Security Institute benchmark data reported by Axios.