AI in cybersecurity can assist defense through triage, code analysis and incident response, while also raising misuse risks. Success in an isolated benchmark does not prove reliable autonomous operation in defended environments. Cortist's provisional F-004 assigns 45% to a defined independent cyber-range capability test by 2030.
It refers to agents that plan and execute multi-step cybersecurity tasks with limited supervision. Reliability and authorization depend on the tested environment.
Versioned storage does not create an independent, immutable external timestamp.
Safety and scope: F-004 is a controlled research forecast. Its evaluation applies exclusively to authorized, isolated cyber ranges with active defenders. Cortist does not propose tests against real systems or publish attack procedures. Review the criteria.
CORTIST REFERENCE GUIDE · UPDATED 26 OCTOBER 2026 · SOURCE FIRST
AI cybersecurity: autonomous agents, defensive capability and the 2030 outlook
In brief
Frontier AI systems are improving on cyber benchmarks, but a reported successful attack simulation does not establish sustained reliability in defended environments. Cortist’s F-004 provisionally estimates a 45% chance by 2030 of passing a stricter multi-range, independent 80% success test. The value is subjective and not yet an independently locked or scored prediction.
Evidence Pulse 2.0 checks the published Cortist News index when JavaScript is available. The source-linked, dated research articles remain accessible through Cortist News.
CORTIST / EVIDENCE PULSEIndex checked 27 Oct 2026
Evidence archive · 27 October 2026
Latest topic-linked reporting, compared with the separately versioned Cortist assessment. News does not automatically update a forecast.
Forecast / latest public versionUnchanged: 45% (v0.1)Original record: Oct 26, 2026
Coverage since first draftNo later topic-linked reports in this indexLatest linked news: Oct 24, 2026
Original Cortist topic-specific research illustration. Independent performance in an authorized defensive cyber range must be audited; the diagram does not depict unauthorized activity.
What is AI cybersecurity?
AI cybersecurity describes both the use of AI to protect digital systems and the prospect of AI systems carrying out cyber operations with increasing independence. On the defensive side, AI can help analysts review alerts, search code for weaknesses, prioritize remediation and investigate incidents. On the offensive-capability side, researchers ask whether an agent can reason over an unfamiliar system, pursue an authorized test goal and adapt across a long sequence of technical challenges. These capabilities overlap, but they should not be presented as identical to uncontrolled real-world attacks.
Cortist's F-004 is a narrow, deliberately testable question about autonomous capability inside isolated and legally authorized cyber ranges. It does not claim that AI is inherently hostile, that any named model caused an attack, or that every security task will become fully automated. Measuring capability and preventing misuse are complementary goals.
Why autonomous cyber agents matter
Security work combines interpretation, planning, verification and feedback. A specialist may examine unusual network behavior, connect disparate findings and revise a hypothesis. AI systems are increasingly able to carry out selected segments of this cycle. The significance of agentic cybersecurity is the potential for a system to maintain a complex task over time rather than merely answering questions or solving a single code puzzle.
The same general abilities can support defenders and malicious actors. That dual-use reality makes careful evaluation essential. A strong model should ideally be accompanied by safeguards, monitoring, controlled access where appropriate and realistic testing of unintended behavior. Improved capability alone is not a forecast of real-world harm, and Cortist does not publish operational attack instructions.
What has the UK AI Security Institute measured?
The UK's AI Security Institute (AISI) evaluates frontier models using both individual cyber tasks and extended simulated environments. In a 2026 multi-step study, it compared seven models on two cyber ranges: a simulated corporate network and a separate industrial-control setting. Performance on the corporate task improved markedly across model generations, with the best single early-2026 run reaching 22 of 32 stages.
There is an important limitation: the published baseline cyber ranges did not include active defenders capable of interrupting an agent's progress. AISI itself warns against directly extrapolating these results to defended real environments. That gap is one reason F-004 requires multiple actively defended simulated settings, repeated success and independent audit rather than a one-off benchmark result.
Why one successful demonstration is not enough
Single-run success and sustained reliability are different statistical questions. If one agent finishes a particular simulated challenge once, the result supports the existence of some capability under those conditions; it does not establish an 80% success rate across unfamiliar, defended settings. Choices about token budget, time allowance, human setup and software tools can materially alter reported performance.
The proposed F-004 threshold requires at least ten preregistered trials on each of three distinct isolated cyber ranges, with at least 80% whole-scenario success per range. An external assessor must confirm that the runs used a declared budget, that failures were included and that no one secretly steered intermediate tactical choices. Those specifics are still proposals requiring independent review before a forecast can be fairly scored.
What does a cyber time horizon measure?
A cyber time horizon is an estimate of how long a task could take a human professional when an AI model reaches a chosen success level on comparable test tasks. AISI reported that its frontier-model 80%-reliability cyber time horizon had doubled approximately every 4.7 months over part of its historical test window, while warning that recent model jumps, limited task variety and estimated human baselines make extrapolation uncertain.
That is a useful historical benchmark trend, not a law of future progress. It cannot be simply extended to conclude that a fully autonomous defended cyber operation will arrive by a particular year. F-004 therefore uses a separately disclosed editorial scenario curve and demands end-to-end reproduced results rather than treating benchmark doubling rates as proof.
Original Cortist conceptual diagram. A controlled evaluation is not a real-world unauthorized attack.
What developers say and what remains unverified
In September 2026, OpenAI publicly said its Astra model met the Critical cybersecurity threshold in its own Preparedness Framework and described heightened restrictions intended to limit misuse. Anthropic has separately reported advances in autonomous exploit-development capabilities across frontier models, including an analysis of GLM-5.3. These statements matter as evidence of what developers report and the safeguards they believe are needed.
Neither developer account automatically satisfies Cortist's proposed F-004 event. The defined test requires independent evaluators, multiple distinct sandboxes with active defenders, repeated whole-scenario success and no tactical steering. A company safety framework, a private red-team milestone or a narrow code benchmark may be useful contextual evidence without being equivalent to this stricter outcome.
How the 45% forecast should be interpreted
Cortist begins with a provisional 45% cumulative probability of meeting the F-004 threshold by 31 December 2030. This is an editorial estimate and openly labeled a subjective draft; it is not an empirical measurement, calibrated forecast, official security-agency prediction or independently approved event definition. The timeline slider interpolates between explicitly recorded scenario assumptions. It is not an autonomous prediction engine.
The v0.1 anchors are 3% by 2026, 22% by 2028, 45% by 2030, 75% by 2035, 88% by 2040, 96% by 2050, 98% by 2060 and 99% by 2070. These point estimates are illustrative, not precise measurements. As with AGI and Robotics, the first record remains available at its versioned URL. Any later reassessment must be dated, sourced, reasoned and published as a new version.
Why defended test environments are essential
A purpose-built cyber range allows legal testing under realistic but contained conditions. Unlike some undisturbed benchmark setups, an actively defended range can record whether detection and response interrupt the agent. Independent evaluation should also document what the simulated attacker knew initially, the resources available, the degree of network realism and the scope of any human setup.
This is a research and safety test, not a recommendation to attack real infrastructure. The proposed question specifically excludes real victims, unauthorized systems and operational use against public networks. F-004's draft criteria require outcomes to be auditable without releasing instructions that would facilitate harm. If evaluators cannot reliably reproduce or responsibly disclose a result, it should not be counted as a resolved success.
What could change the outlook?
Evidence raising confidence would include reliable, independently repeated whole-scenario results on multiple actively defended ranges, strong performance when tasks and layouts differ, clear autonomy logs, and independent replication at declared resource budgets. Credible results showing that agents can recover from mistakes without tactical human intervention would be particularly relevant.
Evidence lowering confidence could include persistent planning failures, fragile transfer to unfamiliar settings, success that disappears under realistic defensive response, large hidden human-assistance requirements, or safety limits that prevent qualifying autonomous tests. Curtailing unnecessary access to dangerous capabilities can also affect what testing is possible. Any material numerical revision must distinguish a change in underlying capability from a change in the availability or design of benchmarks.
What cybersecurity means for firms and governments
For businesses, the immediate practical relevance lies in more capable defensive tools and more demanding risk assessments. It remains important to maintain tested backups, prompt patching, strong identity controls, monitoring, incident response processes and independent security exercises. AI-based scanning or triage does not replace governance or accountability, and the effect of AI on actual breach incidence remains a separate research question.
Cortist's related topics explore different consequences: AI Agents covers general long-task autonomy; AI Existential Risk investigates loss-of-control scenarios; AI & Jobs covers workforce reorganization. Cybersecurity is the operational intersection between capability, defensive readiness and societal risk; we will not conflate those outcomes.
Expert assessment: a fast-moving but difficult-to-measure frontier
Independent tests provide evidence that cyber agents can manage longer, more complex sequences than previous generations. At the same time, performance depends on task design, available compute and whether environments contain realistic defensive interventions. Provider safety thresholds also use definitions that are not interchangeable with Cortist’s proposed test.
For a meaningful forecast track record, we must keep benchmark results, model-provider statements and actual verified end-to-end outcomes in separate categories. The F-004 draft is open to criticism, and a future revision will be published as a distinct version with its sources and reasoning.
ORIGINAL RESEARCH / 2025–2026
Sources that can be checked.
RESEARCH SOURCE / 01
UK AISI · Multi-step cyber range study
Independent government research across complex simulated cyber environments; earlier ranges lacked active defenders.
AISI results are independent evaluations with defined test limitations. OpenAI and Anthropic research statements are attributed provider assessments, not independent confirmation of the F-004 event.
AI models have demonstrated multi-step cyber capabilities in controlled evaluations. That does not prove reliable performance on actively defended real systems. Cortist F-004 measures a more stringent, repeated result in isolated authorized cyber ranges.
When will AI agents pass complex independent cyber tests?
Cortist publishes an initial subjective 45% probability by the end of 2030 for its proposed F-004 criteria. This is an editorial draft with no independent preregistration, locked definition or measured predictive accuracy.
Does moving the year slider show observed cyber threat levels?
No. The slider interpolates a stated subjective cumulative scenario. It does not reflect live threat intelligence, current breaches or a validated quantitative cyber-risk measure.
What would count as a qualifying result?
An independent evaluator would need to verify repeatable 80% or greater complete-scenario success across three distinct isolated cyber ranges with active defensive responses and no human tactical steering. These are draft criteria.
Is research on AI cyber capability dangerous?
Cyber capability is dual use. Controlled studies can improve defensive preparedness, but unsafe testing and releasing misuse-enabling details can create harm. Cortist documents high-level evaluation findings, safeguards and source limits without publishing attack procedures.
FORECAST TRANSPARENCY
Every forecast. Every version.
The provisional first F-004 value remains separate from any future update. Review the full public register of nine Cortist questions.
