Booz Allen says tests of 18 frontier AI models show the threat is moving from theoretical to operational, with one model, Anthropic’s Claude Mythos, completing a full cyber kill chain in a production-grade enterprise network. In the harder test, it reached administrator-level access with a stolen employee credential and later got in again without credentials.
The mechanism is plain: once an autonomous system has a real login or other standing token, it can keep using that identity to move through business systems until it reaches higher privileges. That makes the control problem about account governance, not model capability in the abstract, because the damage follows the privileges the agent can already borrow or inherit.
For critical infrastructure and other high-trust environments, the exposure sits in the identities and tokens given to AI agents, service accounts, and borrowed human accounts. Booz Allen’s finding shifts the map from “can the model reason?” to “what can this login touch before anyone notices,” and that stays true even if the model itself is not the thing being patched.
Why judgment is emerging as cybersecurity’s defining skill
AI speeds up security analysis, but automated actions without human context risk massive operational outages. Here is how CISOs can safely govern AI autonomy.
Zero trust assumes everyone is an attacker until proven otherwise. But when your enterprise is swarming with unknown autonomous agents, that is tricky if not impossible.