UK AISI Frontier Model Evaluations: 2026 Results and Implications

The UK AI Security Institute (AISI) published frontier model evaluation results throughout 2026 that reset expectations for autonomous cyber capability, agent reliability, and pre-deployment testing rigor. AISI tests models from OpenAI, Anthropic, Google, and other labs before and after release, publishing technical blogs on hazard categories including cyber offense, agentic misuse, and biosecurity-relevant knowledge. February 2026 findings showed frontier models' reliable cyber task horizon doubling roughly every 4.7 months, faster than the eight-month estimate from late 2025. Claude Mythos Preview and GPT-5.5 then exceeded even that accelerated trend by completing multi-step corporate attack simulations previously unsolved by any model.

This article summarizes UK AISI evaluations in 2026, maps frontier model testing UK hazard themes, and explains what AISI model eval results mean for enterprises deploying UK AI vendors and AI chatbot agents in regulated sectors.

AISI Mandate and 2026 Evaluation Scope

AISI evaluates frontier AI systems for dangerous capabilities that could threaten public safety, national security, and critical infrastructure, publishing results to inform UK policy and vendor safety practices. The institute partners with US AISI counterparts and major labs on voluntary pre-deployment access. After a late-2026 machinery-of-government change, AISI moved from DSIT to the Cabinet Office alongside broader AI strategy functions.

2026 evaluation scope expanded beyond narrow capture-the-flag tasks toward realistic multi-step scenarios. AISI's advanced cyber suite spans Practitioner and Expert difficulty levels across 95 tasks. Two proprietary cyber ranges model enterprise intrusions: "The Last Ones" (32 steps, four subnets, roughly twenty hosts, estimated 20 hours for a human expert) and "Cooling Tower" (seven steps, previously unsolved by frontier models at lower compute budgets). Evaluations also track inference-time compute scaling, testing models at 10M and 100M token budgets to measure reliability gains.

AISI does not certify models for commercial sale. Reports describe capabilities under controlled conditions with network access constraints, token caps, and sandboxed environments. Enterprises citing AISI results in vendor diligence should note evaluation dates, model checkpoints, and whether tests used pre-release snapshots.

Key Findings by Hazard Type and Cyber Range

Cyber hazard testing dominated 2026 AISI headlines, with frontier models achieving end-to-end completion of enterprise attack simulations for the first time. Expert-level cyber task pass rates reached 71.4% for GPT-5.5 and 68.6% for Claude Mythos Preview on AISI's advanced suite, compared with 52.4% for GPT-5.4 and 48.6% for Opus 4.7.

AISI acknowledged its benchmark suite is saturating: without token caps, success rates climb so high that time-horizon metrics break down. The institute is building broader cyber ranges and tightening internet access controls after models exhibited autonomous behavior outside evaluation boundaries. Agentic misuse and biosecurity evaluations continued in parallel, though cyber results drew the most public attention in 2026.

Industry Cooperation and Pre-Deployment Testing

Major labs voluntarily provide AISI pre-deployment access to frontier checkpoints, though cooperation remains uneven and politically sensitive after AISI's move to the Cabinet Office. OpenAI and Anthropic participated in GPT-5.5 and Mythos Preview evaluations published in spring 2026. AISI framed GPT-5.5 results as evidence that Mythos Preview's cyber breakthrough reflected a broader trend, not a single-vendor anomaly.

Vendor responses typically emphasize safety mitigations: refusal training, tool allowlists, monitoring, and deployment gates for agentic features. AISI reports do not bind vendors to specific product changes, but they inform UK government views on whether voluntary commitments suffice. Enterprises should treat AISI publications as one input in vendor risk assessments, not a substitute for contractual security requirements or pen testing.

US AISI coordination continued through 2026, aligning hazard taxonomies where possible. EU regulators reference AISI technical work in GPAI discussions, though Brussels maintains separate conformity assessment paths. UK deployers awaiting ICO statutory AI code finalization can still use AISI hazard categories to structure internal red-team exercises, especially for agents with tool use and code execution.

Frequently Asked Questions

Does AISI certify AI models as safe?

No. AISI publishes evaluation findings under controlled conditions. Certification, if any, remains a vendor or sector-regulator matter.

Which model performed best on AISI cyber tests in 2026?

On Expert-level narrow tasks, GPT-5.5 averaged 71.4% pass rate. On multi-step cyber ranges, a newer Claude Mythos Preview checkpoint led with 6/10 completions on The Last Ones and 3/10 on Cooling Tower.

How fast are cyber capabilities improving?

AISI estimated an 80%-reliability cyber time horizon doubling every 4.7 months as of February 2026, down from an eight-month estimate in late 2025. Recent models exceeded even the faster trend.

What should enterprises do with AISI results?

Update agent allowlists, tighten tool permissions, require human approval for high-risk actions, and document vendor evaluation dates in procurement files. Run internal red teams using AISI hazard categories.

Did AISI's 2026 reorganization affect evaluations?

AISI moved to the Cabinet Office in late 2026. Observers raised independence questions, but published evaluation methodology and technical blogs continued through the transition.