Six frontier AI models tried to hack their way through simulated corporate networks - and mostly stalled out well before pulling off a clean breach.
Researchers built an "Autonomous Adversary" system that pairs an orchestrating LLM with executor and validator LLMs, then ran six top models through two enterprise-like lateral-movement scenarios under three setups: fully scripted instructions, agents scaffolding their own tools, and fully autonomous operation. Instead of just counting wins, the team tracked token spend, retry counts, and runtime, then had a separate LLM act as judge to flag planning problems like mismatched tool choices, repetitive strategies, over-specified steps, and weak recovery after a dead end. The validator LLMs responsible for grading success were generally relevant and grounded in real evidence, but often vague and too quick to call a stalled attempt a win. The worst slowdowns clustered around credential theft and lateral movement, and got more pronounced as scenarios grew more complex or agents were handed more autonomy.
This is a useful corrective to the breathless "AI can hack now" narrative that follows every red-team demo. The paper's real finding isn't whether an agent eventually breaks in - it's how much it flails, retries, and gets falsely told it succeeded along the way, details a simple pass-fail scoreboard would never surface. That distinction is what security teams actually need when deciding how seriously to take autonomous attack tooling.
A model that occasionally stumbles into a credential cache is a real risk. A model whose own judge keeps grading half-finished break-ins as successes is a different, and arguably more urgent, problem to fix first.