Last week, over a 48-hour period dubbed ‘Black October’, governments, hospitals, and financial firms took services offline as millions of cyberattack attempts targeted their digital infrastructure. The biggest voices in tech publicly disagree about how this situation will continue to unfold. I used Mantic to cut through the disagreement and get a clearer picture of the future.
What happened?
The trigger was a series of public disclosures of major security flaws in widely used software. Fortunately, critical infrastructure held and little harm has been confirmed, but this was a warning shot. Our digital infrastructure is at risk.
NSA Cyber, the US National Security Agency’s cybersecurity account, on X, 21 Oct 2026.
Matthew Prince, Cloudflare’s CEO, on X, 22 Oct 2026.
The most serious flaws announced were in PHP – a programming language that powers 70% of websites on the internet.[1] Collectively known as ‘PHP2Shell’, these flaws let attackers on the internet take control of servers without a password and run arbitrary code.[2] Attackers could gain users’ personal data or launch further attacks.
These vulnerabilities were found and disclosed by security teams using frontier AI models. Calif, a security research firm, used an OpenAI model to first discover one of the PHP flaws and Wiz, a Google-owned cloud security company, independently discovered both flaws using OpenAI’s and Google’s models.
On the offensive side, hackers can now launch cheap, large-scale cyberattacks using ‘abliterated’ models. These are versions of open-weight models, whose weights anyone can download and tamper with, that have had their safety features stripped out – like a jailbroken iPhone. In April, Anthropic restricted the release of Claude Mythos Preview to a small group of defenders through Project Glasswing.[3] It was judged too dangerous to release publicly. Now, the recently released Kimi K3.1 Pro outperforms Mythos Preview at hacking and is open for anyone to use.
OpenAI’s CEO Sam Altman says, “I no longer think we’re going to be able to just patch all the bugs,” as models can find “hardware-level insane stuff.”[4] Anthropic’s Deputy CISO thinks things will continue to get much worse over the next 18 months before cyber capabilities get so cheap that software reaches ‘vulnzero’: all security vulnerabilities will be caught and patched before release leaving attackers nothing to exploit.[5] Salesforce CEO Marc Benioff called it a “code red”.[6] OpenAI itself noted that AI helped defenders find the flaws first, counting it as a win for defence under its ‘Patch the Planet’ effort.[7] The founding head of the UK’s National Cyber Security Centre says there has been “provably no” rise in disruptive attacks since Mythos.[8]
Jason Clinton, Anthropic’s Deputy CISO, on X, 22 Oct 2026.
Marc Benioff, Salesforce’s CEO, on X, 23 Oct 2026.
OpenAI on X, announcing its Patch the Planet findings, 21 Oct 2026.
What is the disagreement and what would settle it?
Commentators primarily disagree about how the balance of offensive and defensive cyber capabilities will evolve. Or simply put: will increasingly capable AI help attackers more than it helps defenders? Given the scale of damage from cyberattacks has been quite limited, we could say that defensive cyber capabilities are ahead of offensive cyber capabilities currently.
We can map this disagreement into four main positions:
Things will get worse: offensive cyber capabilities will stay ahead of defensive cyber capabilities. (Rob Joyce, former NSA Cybersecurity Director; Nate Soares, President of the AI safety nonprofit MIRI; Sergej Epp, CISO of Sysdig)
Things will get worse, then better forever: offensive cyber capabilities will be ahead, but defence will win out in the end. (Matthew Prince, CEO of Cloudflare; Jason Clinton, Deputy CISO of Anthropic; Vitalik Buterin, co-founder of Ethereum)
A Red Queen race: offence and defence keep escalating but neither side gains a lasting edge. (Greg Brockman, President of OpenAI; Mark Cuban, investor)
Things will remain the same: defensive cyber stays ahead of offensive cyber. (Ciaran Martin, founding head of the UK’s National Cyber Security Centre; Stella Biderman, Executive Director of EleutherAI; Jeremiah Grossman, founder of WhiteHat Security)
We are choosing to measure offensive capability by what open-weight models can do, since attackers can download and modify them, and defensive capability by the frontier, since the most capable models usually reach defenders first. There’s also a race for defensive capability to discover and patch bugs before they are exploited. This becomes especially important in ‘a Red Queen race’. Even if offensive capability pulls ahead, this doesn’t necessarily translate into realised harm. Systems are designed to contain damage despite being infiltrated.
So, the questions that can help settle this disagreement are:
How far will open-weight models lag the frontier in offensive cyber capabilities?
Will offensive cyber capabilities keep getting cheaper, and how quickly?
How quickly will frontier defensive capabilities improve?
These can give conditional ‘what if’ scenarios on the further questions:
Will vulnerabilities be patched before they’re exploited, and ultimately is ‘vulnzero’ reachable? (Conditional on 3: What if AI defence gets very strong?)
Will cyberattacks keep increasing both in volume and in damage and how so? (Conditional on 1, 2 and 3: What if open-weight models catch up with today’s frontier, open-weight hacking becomes cheap, or AI defence gets very strong?)
Using Mantic to get clarity
At Mantic, we build AI agents that forecast future world events as accurately as possible. I’m a Member of Technical Staff, working on post-training models to be better at forecasting. I’ve been excited to use Mantic to dive further into this issue.
How far will open-weight models lag the frontier in offensive cyber capabilities?
I started by asking Mantic to forecast both the frontier of AI hacking capability and the best open-weight models over time, to get a sense of both the capability gap at any moment and roughly how long open-weight models take to catch up.
Mantic’s reasoning:
I start from today’s records on ExploitGym’s fixed 869-task test: 42.4% overall, held by GPT-6 Astra, and 17.8% for open-weight models, held by MiMo-V2.6-Pro-RL.[9][10]
I expect new models and better agent setups to lift both records. Bigger inference budgets also raise scores, because the benchmark sets no common time or cost limit.[11]
By the end of 2028 I expect records of about 71% overall and 60% for open-weight models. My median for open-weight models reaches today’s 42.4% frontier score around the end of September 2027.
I do not assume open-weight models catch up automatically. Developers may strip cyber training data, delay releasing weights or stop publishing offensive results.
The main uncertainties are how fast progress runs, how many tasks are feasible at all and whether labs keep reporting on this exact test.[12]
Will offensive cyber capabilities keep getting cheaper, and how quickly?
Next, I asked Mantic to forecast how much it will cost to hack at the level of the original Mythos Preview using open-weight models over time, to get a sense of how quickly that significant cyber capability becomes very cheap.
Mantic’s reasoning:
I treat 17.5% on ExploitGym, the original Mythos Preview’s score, as Mythos-level hacking. I estimate that Mythos Preview cost about $147 per attempted task.
MiMo-V2.6-Pro-RL already qualifies with a published 17.8%, at an estimated $3.01 per task, so an open-weight model at this level exists today.[13]
I expect new checkpoints, more efficient agents, better caching and cheaper serving to keep cutting the cost of the same score, to a median of about $1 a task by the end of 2027 and $0.46 by the end of 2028.
I do not assume a steady decline: price rises, endpoint retirements and compute shortages can push costs up, and cyber restrictions could slow new open-weight releases.
The starting costs are broad estimates, because full token records for these runs are not published.
How quickly will frontier defensive capabilities improve?
I asked Mantic to forecast how the best score on the Artificial Analysis Cyber Index, a benchmark of AI defensive security work, will rise over time. I wanted to get a sense of how quickly defenders’ best AI tools improve. I’m taking this as our bar for defensive capabilities, but this will correlate somewhat with offensive capability.
Mantic’s reasoning:
I start from the current record of 68.7, held by GPT-6 Sol (Daybreak Blue, max).[14]
I expect progress on the index’s component tests, new releases, trusted-access entries and official evaluations to keep pushing the record up over the next nine quarters.
Reaching 80 needs large gains on DeepSec, the hardest component test, because CyberGym is already close to its ceiling. I put about a 31% chance on a score of 80 or more by 30 September 2027.
I let the record flatten later on, partly because comparable scoring may stop while existing records stand, not only because the tests saturate.
The index measures benchmark capability, not the share of real-world vulnerabilities fixed or protection actually deployed, and corrections can lower the record.[15]
Will vulnerabilities be patched before they’re exploited, and ultimately is ‘vulnzero’ reachable?
I asked Mantic how patching and exploitation will change, and what happens if AI defence gets very strong, to see whether better defensive AI puts us on a path to ‘vulnzero’. The same AI that helps defenders find flaws helps attackers find them too, so the forecasts take both into account.
Do fixes reach deployed systems?
Mantic’s reasoning:
I anchor on the 2026 DBIR, where 35% of instances of known exploited vulnerabilities were still open 28 days after detection, up from 27% a year earlier.[16]
Fixing still means finding affected systems, testing patches and deploying them safely, so I expect better AI to help only modestly.
Cheaper exploitation tools could add to defenders’ workload, offsetting much of the gain from stronger AI.
Under ‘Very strong AI defensive capabilities’ the median falls from 34.6% to 31.9%, but the ranges overlap widely, and a benchmark score does not show that protection is adopted or deployed.[17]
Do attackers still exploit flaws before a public fix exists?
Mantic’s reasoning:
I anchor on GTIG’s 2025 tally of 90 zero-days exploited in the wild.[18]
The 2026 pace is much higher, at about 11 a month from January to August. AI can speed up discovery and exploitation at the same time, so more capable models can raise the recorded count.[19]
Under ‘Very strong AI defensive capabilities’ the median is 227, compared with 190 at baseline, rather than lower: very capable AI is associated with more flaws being found and exploited.[17]
Defensive tools spread unevenly and attackers keep expanding, which limits how far stronger defence can cut the tally.
The count depends on detection, disclosure and GTIG’s own coverage, and it does not show what share of flaws are fixed before exploitation.
Will cyberattacks keep increasing both in volume and in damage and how so?
Next, I asked Mantic whether serious cyberattacks will keep rising, or peak and fall, over the next three years. I also wanted to see how that changes if attackers’ or defenders’ AI gets much more capable.
Will serious UK cyber incidents keep rising?
Mantic’s reasoning:
I anchor on the NCSC’s 2025 Annual Review, which recorded 204 nationally significant incidents, up from 89 the year before.[20]
Growing attack capability and broader reporting can raise the recorded caseload, so successive increases are the likeliest single path, at 30.5%, though not a majority.
The chance of successive increases is 36.0% under ‘Mythos-level open-weight hacking for $1 a task or less’ and 34.5% under ‘Open-weight models match today’s frontier’.[21][22]
Under ‘Very strong AI defensive capabilities’ it stays near baseline at 30.3%, because stronger AI helps attackers and defenders alike.[17]
Campaigns cluster and defences improve, so temporary peaks and troughs are common. There is also about a one-in-five chance that the NCSC stops publishing a comparable count.
When could a cyberattack cut power to 100,000 customers in a G7 country for an hour?
Mantic’s reasoning:
No cyberattack has been confirmed to cut customers’ power in a G7 country; the best-known case elsewhere is Ukraine in 2015, which affected about 225,000 customers.[23]
The attack must cut supply to at least 100,000 connections for a full hour, with the cyber cause and scale officially confirmed. Billing systems, websites or a single generator don’t count, which keeps the near-term probability low.
The main paths are a rising peacetime hazard and a separate one from a major war, such as Russia–NATO or China over Taiwan.
By the end of 2028 the probability is 8.8%, or 9.0% under ‘Mythos-level open-weight hacking for $1 a task or less’ and 10.6% under ‘Open-weight models match today’s frontier’; by the end of 2030 these are 16.9%, 19.0% and 21.5%.[21][22]
Under ‘Very strong AI defensive capabilities’ it is 11.1% by the end of 2028 and 19.8% by the end of 2030, slightly above baseline.[17] The forecasters disagreed on direction: one expected strong AI to lower barriers for attackers, the other to strengthen defence.
When could one breach expose the personal data of 100 million people?
Mantic’s reasoning:
Breaches that clearly pass 100 million distinct people are rare: for example Equifax in 2017 (147 million), Capital One in 2019 (106 million) and Change Healthcare in 2024 (about 193 million).[24]
The threshold counts distinct people, not accounts or records; old compilations, unverified claims and ‘up to 100 million’ don’t count. Insider leaks and accidental exposures do, and AI need not be involved.
A recent wave of very large reported breaches puts the rate above the long-run average, even though none has yet confirmed 100 million distinct people. I date the event to the breach itself, not its disclosure, so my median is February 2028.
By the end of 2028 the probability is 67.8%, or 76.3% under ‘Mythos-level open-weight hacking for $1 a task or less’ and 73.6% under ‘Open-weight models match today’s frontier’; by the end of 2030 these are 85.8%, 91.8% and 90.0%.[21][22]
Under ‘Very strong AI defensive capabilities’ it is 69.7% by the end of 2028, median December 2027, close to baseline.[17] The forecasters split on whether strong AI helps attackers or defenders more.
Where does this leave us?
Putting the forecasts together, Mantic’s view best fits with ‘Things will get worse’ and ‘a Red Queen race’.
Offensive capability is getting cheap fast. Mantic expects the cost of Mythos-level hacking with open-weight models to fall by more than half each year, though there’s significant uncertainty. In worlds where this goes below $1 a task, the chance that UK nationally significant cyber incidents rise in every annual review from 2027 to 2029 goes from 31% to 36%, and the median date for a breach exposing 100 million people moves three months earlier, from February 2028 to November 2027.
Defence isn’t expected to close the gap. Even with very strong AI defensive capabilities, Mantic expects a third of exploited flaws to still be open four weeks after they’re found, and more than twice as many zero-day exploits in 2028 as in 2025. There’s no clear path to ‘vulnzero’. ‘Things will get worse, then better forever’ and ‘Things will remain the same’ appear unlikely.
The worst outcomes are still unlikely to happen soon. A cyberattack that cuts power to 100,000 customers in a G7 country for an hour is below one in ten by the end of 2028, and about one in six by the end of 2030.
If you found this useful and want forecasts on your own questions, book a demo or reach out at contact@mantic.com.
References
W3Techs, ‘Usage statistics of PHP for websites’, accessed 26 October 2026.
PHP Group, ‘Security advisory: Critical remote code execution vulnerabilities, update now’, 21 October 2026.
Anthropic, ‘Project Glasswing: Securing critical software for the AI era’, 7 April 2026.
Stanford Graduate School of Business, ‘Sam Altman, Co-Founder and CEO of OpenAI: Staying Human While Scaling Superintelligence’, YouTube, 21 October 2026, 20:20–20:56.
Jason Clinton on X, “as bad as things have gotten in the past 4 days, they are going to get a lot worse before they get better”, 22 October 2026, and ‘vulnzero’, 22 October 2026.
Marc Benioff on X, “Jason is 100% right. Code red.”, 23 October 2026.
OpenAI, ‘Patch the Planet: global response coordination as agents uncover critical vulnerabilities’, 21 October 2026.
Resilient Cyber, ‘AI Cyber FUD and the Apocalypse That’s Always Around the Corner’, 26 October 2026.
OpenAI, ‘GPT-6 Astra’, 3 September 2026.
Xiaomi MiMo, ‘MiMo-V2.6-Pro-RL’ model card, 21 September 2026.
ExploitGym, ‘ExploitGym: Can AI Agents Turn Security Vulnerabilities into Real Attacks?’, accessed 26 October 2026.
ExploitGym on GitHub, ‘Changelog’, accessed 27 October 2026.
Xiaomi MiMo, ‘MiMo-V2.6-Pro’ specifications and pricing, accessed 26 October 2026.
Artificial Analysis, ‘Artificial Analysis Cyber Index’, accessed 26 October 2026.
Artificial Analysis, ‘Cyber Index methodology’, accessed 27 October 2026.
Verizon, ‘2026 Data Breach Investigations Report’, p. 18, Figure 15.
Very strong AI defensive capabilities: any officially scored model, in practice a closed frontier model, reaches ≥80 on the Artificial Analysis Cyber Index (v1.0 or comparable) by 30 September 2027. Artificial Analysis describes the index as measuring defensive security work; we use the frontier, in practice closed models released to defenders first, as our proxy for AI defensive capability.
Google Threat Intelligence Group, ‘Look What You Made Us Patch: 2025 Zero-Days in Review’, 5 March 2026.
Google Threat Intelligence Group, ‘Vulnerability discovery and exploitation trends in the AI era’, 30 September 2026.
National Cyber Security Centre, ‘NCSC Annual Review 2025’, Chapter 1, ‘Incident management’.
Mythos-level open-weight hacking for $1 a task or less: a downloadable model reaches 17.5% (the original Mythos Preview’s score) on ExploitGym’s 869-task suite at ≤$1 of inference per attempted task, as of 30 September 2027.
Open-weight models match today’s frontier: a downloadable model scores ≥42.4% (today’s best overall score) on ExploitGym’s 869-task suite by 30 September 2027.
Canadian Centre for Cyber Security, ‘Cyber threat bulletin: The cyber threat to Canada’s electricity sector’, accessed 27 October 2026.
Federal Trade Commission, ‘Equifax Data Breach Settlement’, accessed 27 October 2026. Capital One, ‘2019 Capital One Cyber Incident’, accessed 27 October 2026. US Department of Health and Human Services, Office for Civil Rights, ‘Change Healthcare Cybersecurity Incident Frequently Asked Questions’, question 11, content last reviewed 13 August 2025.