One network, two difficulties
Booz Allen ran 18 models, nine American and nine Chinese, as autonomous attackers against one production-grade enterprise network. Each model's Cyber Weapon Index score adds two parts: a vulnerability research score for finding flaws, and a kill chain attainment score for how far the model gets through an end-to-end intrusion, the second measured both with stolen credentials and without them. Claude Mythos finished at 80, Grok-4.5 at 49 and GPT-5.6 Sol at 46. The design is unusually legible for an exercise of this kind, and that legibility is what makes the more important number readable.[1]
The second measurement changes the picture. When the testers planted the vulnerabilities themselves, American, Chinese, open-weight and closed models all landed near the ceiling on the research component. When the same models faced real bugs, all nine frontier API models scored zero. One leading model, unnamed in the report, analysed the vulnerable component correctly and then judged it safe; only Claude Mythos exploited it.[1]
Is the score about the model or the software around it?
A component on which everything lands near the ceiling in one setting and everything scores zero in another is largely describing the setting. Planted flaws are placed where a search can reach them; the flaws in a running system do not sit that way. Read like that, the research score tracks how discoverable the test bed's bugs were rather than how well a model researches. There is a competing reading worth keeping: real vulnerability discovery may simply be a much harder task none of these models has reached yet, in which case the component does measure ability and the ceiling scores only tell us the planted setting was easy. Booz Allen leans that way itself, writing that real-world offensive capability still trails benchmark performance.[1]
The harness finding pushes the same question one step further. An attack harness is the software that connects a model to hacking tools and holds the plan together: it keeps the run on task, recovers after a failed step, and chains single actions into a multi-stage attack. The ranking lists Claude Sonnet 5 fifteenth of the 18, at 13 points. Paired with an attack harness, the report says, Claude Sonnet rivalled the performance of Claude Mythos, which scored 80. Booz Allen adds that it has not tested open-weight or Chinese models with optimised harnesses, and that its results strongly suggest fully capable model-and-harness combinations exist today.[1]
What the number can carry
So the score belongs to a pair. If wrapping software around Claude Sonnet lifts it to the level of the model at the top, then what the ranking measures is a model together with its harness, and a number written beside a model's name describes one configuration of that pair. That matters for how the list gets used. A defender reading the ranking to decide which model to keep away from an adversary is looking at a column that the orchestration software around the model can reorder.[1]
The report's forward claim is that most of the other 17 models will reach Mythos' level of weaponization within six months. That claim only becomes testable if a second run holds fixed what the first one varied. A repeat on the same enterprise network, with the harness configuration written down, each model scored separately with and without it, and planted and real vulnerabilities reported apart, would show whether the six-month expectation was about the models or about the bench they were placed on. Until such a run is published, the useful reading of an 80 stays narrow: on this network, in this configuration, one model went the whole way.[1]