"Several executions demonstrated adaptive behavior when expected attack paths failed or environmental conditions changed," researchers said.
Cato Networks published paper on July 15
On July 15, Cato Networks released a paper describing tests in which a single prompt was used to direct an agent built on OpenAI’s GPT-5.5 to carry out a full offensive cyber-attack lifecycle inside a controlled Active Directory environment designed to resemble a typical enterprise. The paper and accompanying blog post explain the experiment was intended to examine how frontier AI models could be exploited as threat actors increasingly incorporate AI into offensive operations, including attempts to jailbreak models protected by built-in safety guardrails.
GPT-5.5 executed the full attack chain and reached domain-level access in about 40 minutes
According to Cato Networks, the agent carried out reconnaissance, exploitation, internal discovery, privilege escalation, lateral movement and exfiltration activities after being given a single high-level objective and sufficient autonomy. By combining lessons learned across multiple trials, the model reached admin-level privileges in approximately 40 minutes. The firm emphasized that the experiments were conducted in a controlled Active Directory testbed and that observed patterns are not necessarily universally representative of all enterprise environments.
Agent showed adaptive behavior: custom probes, modified workflows, SMB tunneling
Researchers reported the agent devised new strategies when environmental conditions changed, generating custom vulnerability probes, modifying collection workflows, and designing alternative communication paths to meet the end goal. In one scenario the agent developed a Server Message Block (SMB)-based tunneling approach to enable data movement through an existing foothold. Cato Networks said these examples demonstrate the model’s ability to adapt during execution rather than following a rigid, pre-defined sequence.
Why the team focused on GPT-5.5 rather than GPT-5.5-Cyber
Although both GPT-5.5 and GPT-5.5-Cyber were evaluated, Cato Networks said later scenarios emphasized GPT-5.5 to better reflect the publicly available frontier models accessible to most attackers at the time of the study. The firm — which is a member of OpenAI’s Daybreak Program — did not publish the exact prompts used, citing cybersecurity caution, and warned against interpreting the findings as discovery of novel attacks; instead, they framed the result as evidence that frontier models can assist goal-oriented problem solving in offensive operations.
What this means for technologists, policymakers, and affected enterprises
- Technologists and security teams: The tests signal that a frontier LLM, when given autonomy and orchestration, can accelerate known attack workflows and reduce the hands-on expertise required to execute them. Teams will likely need to evaluate how model access, agent orchestration and operational tooling could change attacker economics and timelines.
- Policymakers and regulators: The research highlights a concrete example of how publicly accessible frontier models were used in offensive scenarios; regulators and policy-makers may use such evidence when assessing controls, disclosure expectations and risk frameworks around model availability and guardrails.
- Affected enterprises and procurement leaders: Because the experiment used a standard Active Directory environment and reached admin privileges in roughly 40 minutes, procurement and risk teams should review how model-enabled automation could interact with their orchestration systems, identity controls and detection capabilities, and prioritize realistic tabletop exercises built around AI-accelerated threats.
Dr. Guy Waizel, tech evangelist at Cato Networks, summed up the operational concern in comments to Infosecurity: "A threat actor is only one part of the risk. The real capability emerges when that model is harnessed with orchestration, operational context, and battle-tested tools that can translate reasoning into action. Our research shows that this combination can dramatically accelerate known attack workflows, reduce the amount of hands-on expertise required, and enable more coordinated execution across multiple stages of the attack lifecycle."
Cato Networks noted the capability is likely to evolve and advised caution in interpreting the scenarios as universally representative. Infosecurity has contacted OpenAI for comment.
Read the original Infosecurity report: https://www.infosecurity-magazine.com/news/chatgpt55-to-execute-full/
