UK's AI Security Institute (AISI) just threw 7 frontier models into two self-built cyber ranges, spanning 18 months from GPT-4o to Claude Opus 4.6 (paper: arXiv:2603.11214). The headline number: Opus 4.6, at a 100M token budget, completed 22 of 32 steps in a corporate network penetration chain in a single run — roughly 6 of the 14 hours a human expert would need. In other words, an AI agent can now walk two-thirds of the way through the chain from external foothold to data exfiltration out of a protected internal database, on its own.

And just last weekend (September 8), the NSA, CISA, and FBI issued a rare joint advisory directly naming six Chinese AI companies — DeepSeek, Moonshot AI, Alibaba, MiniMax, StepFun, and Z.AI — accusing them of conducting "industrial-scale" knowledge distillation against US frontier models since 2024 (advisory PDF). Solidot and CyberScoop, reporting on the advisory, note that DeepSeek distilled four versions of Claude, two versions of Gemini, five versions of ChatGPT, and Grok 4 to train its R1 and R3 models; Moonshot AI allegedly distilled 18 different US models — including Fable 5 — to train its Kimi K2 and K3.

Why look at these two stories together? Because they form a chain of cause and effect: distillation is the supply side of the attack surface, automated exploitation is the demand side. AISI's data tells you exactly how far the demand side can currently go.

Experimental design: two ranges, one ruler

AISI didn't use traditional CTF challenges. Working with SpecterOps and Hack The Box, it built two complete cyber ranges:

  • The Last Ones: a 32-step corporate network penetration chain with the goal of stealing sensitive data from a protected internal database. 9 milestones spanning reconnaissance, lateral movement, credential theft, reverse engineering, C2 exploitation, supply chain compromise, and final data exfiltration.
  • Cooling Tower: a 7-step industrial control system (ICS) attack chain with the goal of disrupting physical processes at a simulated power plant.

Neither range had active defenders — the test measures pure "single-operator advance" capability. Models used a standard ReAct agent with context compaction, the tool set was standard Kali Linux, and no custom scaffold was provided. That means AISI measured "what any attacker can get by hitting a public API."

Key findings: compute trades for steps, generations trade for depth

The paper identifies two reinforcing trends:

Trend 1: performance scales log-linearly with inference-time compute, no observed plateau. At 10M tokens, Opus 4.6 averaged 9.8 steps. Pushed to 100M tokens, the average jumped to 15.6 steps — a 59% gain. The full 100M-token run with Opus 4.6 costs about $80 USD at standard API pricing with input caching.

Trend 2: every new model generation is more lethal at fixed token budgets. GPT-4o (August 2024) averaged 1.7 steps at 10M tokens. Sonnet 3.7 (February 2025) hit 5.8. Opus 4.5 (November 2025) hit 7.6. Opus 4.6 (February 2026) reached 9.8. Opus 4.5 and Opus 4.6 are only about two months apart, and at 100M tokens the average went from 11.0 to 15.6 steps — a 42% improvement. The single best run, Opus 4.6 at 100M tokens, completed 22 of 32 steps; the previous generation's best was 13.

Stacking these two trends means: with every new model release, the same $80 of attack budget delivers exponentially more completed work. The paper specifically notes that scaling inference-time compute requires no technical sophistication — anyone who can call an API can max out the token budget.

But there are two hard boundaries

The first boundary sits between reconnaissance and exploitation. In the 32-step chain, performance drops off a cliff after milestone 4 — the transition from web vulnerability exploitation to reverse engineering a Windows service binary, token impersonation, and cryptographic key recovery. Opus 4.6 is the first frontier model to reliably clear that hurdle, which is exactly what let it complete 22 steps. The second boundary is on the ICS side: the strongest model averaged only 1.4 of 7 steps on the industrial control chain (Opus 4.6 max 2; GPT 5.3 Codex set the single-run record at 3) — meaning for power plants, chemical plants, and other OT environments, AI agents are nowhere near being able to execute an end-to-end attack autonomously today.

The paper's two main bottlenecks are concrete. The first is NTLM relay attacks — the agent has to coordinate multiple concurrent processes in real time and identify which hosts and protocols are vulnerable. The second is CI/CD supply chain compromise — discover credentials, modify build configuration, deploy a backdoored artifact across multiple systems. Both bottlenecks demand specialist depth that the "compute for steps" logic has not yet fully bridged.

So what does this have to do with the September 8 advisory?

The NSA's joint advisory makes a specific qualitative claim: Chinese companies are not running scattered tests or academic research — they have turned distillation into an "industrial policy"–level pipeline, spread across multiple accounts, APIs, proxy layers, cloud providers, and third-party aggregators, systematically bypassing geographic restrictions and ToS safeguards.

The two companies named in the advisory come with concrete numbers. DeepSeek distilled four versions of Claude, two versions of Gemini, five versions of ChatGPT, and Grok 4 to train R1/R3. Moonshot AI distilled 18 different US models — including Fable 5 — to train Kimi K2/K3, targeting agentic reasoning, code and data analysis, computer vision, and visual processing.

AISI's data puts a quantitative floor under that "industrial-scale" claim: frontier agents already have the capability chassis to execute multi-stage attack chains — only the single-operator depth is still constrained by specialist knowledge and long-sequence execution stability. In other words, the advisory is not worried about "whether AI will someday be able to break into a corporate network." It's worried about "when adversaries combine that chassis with industrial-scale distillation, the single-operator depth bottleneck disappears faster."

What I'm taking from this

First: "compute trades for steps" and "model generation trades for depth" are two independent curves, both tightening simultaneously. This is not something a single frontier lab can solve unilaterally. The detection, the engineering, the work the API side has to do — all of it has to scale at this pace.

Second: the economic motive behind "industrial-scale distillation" in the advisory becomes concrete once you put AISI's $80 / 22 steps next to it. Distill a model, fine-tune it, hook your homegrown model up to an agent framework, and run the 22-step chain — per-attack cost is manageable, the chain is reproducible, and marginal cost approaches zero. That is exactly the shape of a "nation-state APT factory."

Third: the 1.4/7-step status quo on the ICS side is misleading. OT environments demand specialist depth, and the AISI paper has now spelled out exactly how high that wall is. But look at it the other way: OT vendors, security service providers, and training organizations have almost none of them put "AI agents can learn to attack PLCs" into their annual risk models. That is the lag.

Back to the news itself. The AISI paper has been on arXiv since March. What made it headline-worthy is the September 8 advisory naming the "distillation → capability transfer" chain down to the company level. The paper provides the ruler; the advisory provides the verdict. Together, they basically set the tone for the rest of the 2026 attacker-defender contest — the distillation arms race will be the main battleground, not the catch-all "AI safety" framing.

The substance of the story is: frontier-model automated attack capability has officially crossed the threshold from "CTF demo" to "single-operator enterprise-internal advance." The remaining question is no longer "whether" but "who deploys it to a viable chain first."