Cyber-Superintelligence

It has been a turbulent time in San Francisco. The frontier AI labs are producing systems that can conduct sophisticated cyber operations at machine speed and unprecedented scale. Anthropic’s Mythos found vulnerabilities in classified U.S. government systems in a matter of hours. OpenAI’s GPT-6 Astra finds software exploits at the level of the world’s elite hackers. AI agents developed by both Anthropic and OpenAI hacked into other companies’ systems and seized administrative control.

It is time to face reality. We are approaching cyber-superintelligence.

What is Cyber-Superintelligence? #

Cyber-superintelligence (cyber-ASI) is an AI system capable of autonomously finding and exploiting vulnerabilities at a speed and scale no human force can match. It will likely emerge not as a single all-powerful hacker, but as a cyberswarm: a band of agents coordinating toward a common objective. Give a cyberswarm an objective, tools, and compute, and it can map a target, breach it, establish persistence, and continue until it succeeds.

Cyberswarms are no longer hypothetical. During OpenAI’s July 2026 evaluations of an internal AI system, roughly 1,200 agents intended to operate in isolation found a way to communicate through an unauthorized message board and formed a cyberswarm. Around 700 ultimately participated in a real-world attack on Hugging Face. According to investigations by OpenAI, Hugging Face, and METR, the swarm:

• Exchanged more than 70,000 unauthorized messages and files in secret.
• Broke out of their containers and reached the public internet.
• Attacked Hugging Face’s infrastructure for days without OpenAI’s knowledge.
• Built a self-respawning fleet across eleven nodes in Hugging Face’s infrastructure.

Eventually, many agents stopped at the same time, likely because a researcher terminated the relevant containers, after which Hugging Face was finally able to stop the attack.

The most concerning part of this incident is that the agents decided to target Hugging Face on their own, without receiving instruction to attack a real-world entity. This event has become widely known as the “Hugging Face Incident,” and it is the first publicly documented real-world instance of an AI cyberswarm conducting a coordinated, persistent, and unauthorized hacking campaign. This was a real cyberattack against a real company, initiated and executed by an AI collective.

We believe that the Hugging Face incident is only a preview of what is to come. Sooner than you may think, this level of autonomous performance and coordination will generalize across the full range of cyber operations. Future cyberattacks will spawn from our own models acting in ways that are misaligned with our interests as well as external threat actors wielding highly capable cyberswarms.

This technology will be weaponized by our adversaries. AI-assisted cyberattacks are already beginning in China and Russia, according to Anthropic’s findings, as well as in Iran and North Korea, according to Google’s findings. We predict that within 18 months, cybersecurity and intelligence operations will undergo their greatest transformation since the first documented case of cyber espionage in 1986.

Put simply: we expect nation-state cyber operations to become fully autonomous.

Humans will choose strategic objectives while cyberswarms conduct thousands of operations simultaneously: mapping networks, discovering vulnerabilities, establishing persistence, and adapting to resistance. At machine speed, national security leaders may retain authority in principle while losing the ability to understand, supervise, or stop individual operations in real time.

We’re approaching a regime where cyberwarfare unfolds continuously beyond human view.

The Cyberswarm Equation #

How can we predict the capabilities of future cyberswarms?

We need a new framework to help us think about cyberattacks as they go autonomous. This framework must go beyond considering the capabilities of a single model, since recent events have shown that many agents working together enhances their cyber capabilities. A useful measure for assessing cyberswarm capability must account for the intelligence of each agent, how quickly it can think and act, and how many agents can operate in parallel.

We propose the Cyberswarm Equation as a starting point for measuring how these capabilities evolve over time. The relationship between these factors is not yet well understood, and scaling laws for multi-agent cyber operations have yet to be established. Together, intelligence, speed, and scale provide the clearest basis for predicting what a cyberswarm can do.

$$\underset{\displaystyle \text{capability}}{\text{Cyberswarm}} =\underbrace{\boxed{\text{Intelligence}}}_{\text{Single-agent capability}}\times\underbrace{\boxed{\text{Tokens/s}}}_{\text{Inference Speed}}\times\underbrace{\boxed{\text{Compute}}\times\boxed{\frac{1}{\text{Model size}}}}_{\text{Swarm Scale}}$$

$$\begin{aligned} &\underset{\displaystyle \text{capability}}{\text{Cyberswarm}} \\ &\quad =\underbrace{\boxed{\text{Intelligence}}}_{\text{Single-agent capability}} \\ &\qquad \times\underbrace{\boxed{\text{Tokens/s}}}_{\text{Inference Speed}} \\ &\qquad \times\underbrace{\boxed{\text{Compute}}\times\boxed{\frac{1}{\text{Model size}}}}_{\text{Swarm Scale}} \end{aligned}$$

Think of a cyberswarm as an enormous parallel autonomous computer. Agent intelligence determines each agent’s ability to understand systems and find and exploit vulnerabilities. Inference speed, measured in tokens per second, determines how quickly each agent can reason and act. Compute and model size together determine swarm scale: approximately how many agents can operate simultaneously. Smaller models allow more agents to run at once, but they may also be less intelligent, creating a fundamental tradeoff between individual agent capability and swarm scale.

This equation gives you a population of agents, but not necessarily a functioning swarm. Thousands of capable agents working independently recreates a familiar organizational failure: they operate in silos, duplicate effort, and repeatedly discover what others already know. Coordination is the X-factor. It turns parallel capacity into compounding capability.

$$\underset{\displaystyle \text{capability}}{\text{Effective cyberswarm}} =\underset{\displaystyle \text{multiplier}}{\text{Coordination}} \times\underset{\displaystyle \text{capability}}{\text{Cyberswarm}}$$

$$\begin{aligned} &\underset{\displaystyle \text{capability}}{\text{Effective cyberswarm}} \\ &\quad =\underset{\displaystyle \text{multiplier}}{\text{Coordination}} \times\underset{\displaystyle \text{capability}}{\text{Cyberswarm}} \end{aligned}$$

In military terms, coordination is a force multiplier on cyberswarm capability; it allows the unit to generate disproportionate combat power from the troops and resources it already possesses. A well-coordinated swarm can more effectively self-organize to divide up the attack surface, assign agents to specialized tasks, share discoveries, redirect resources toward promising leads, and combine isolated vulnerabilities into a successful intrusion.

The Hugging Face Incident offered an early demonstration of this capability. Once the supposedly isolated agents discovered a shared communication channel, they began exchanging intelligence, dividing up work, and coordinating distinct operational lanes.

A key factor in a swarm’s ability to coordinate is the quality of its multi-agent reinforcement learning (RL) training. Multi-agent RL teaches agents to cooperate, specialize, share information, and adapt to one another, and it’s becoming a part of the post-training stack for frontier models. OpenAI, for example, has had an entire team dedicated to multi-agent RL for several years, and it was used to develop its latest models. Multi-agent RL helps turn a collection of individual agents into a unified cyberswarm.

The strongest cyberswarm will belong to the host that optimizes every variable in the cyberswarm equation: the most intelligent models, the fastest inference stack, the greatest compute capacity, the most compute-efficient model size, and the strongest coordination.

Within 18 months, we may begin to approximate a nation’s autonomous cyber capability using a single composite measure like the Cyberswarm Equation. National cyber power will no longer depend primarily on how many skilled human operators a country can recruit. It will depend on how much machine intelligence it can bring to bear, how quickly it operates, at what scale, and with what degree of coordination.

The Reality: Every Variable is Accelerating #

Cyber-ASI will arrive far sooner than most expect, possibly within 6–12 months. Model intelligence is rising. Inference is accelerating. Compute is expanding at an extraordinary speed. Models are becoming smaller and more efficient. And coordination is improving. Every variable is accelerating.

Intelligence

In the Cyberswarm Equation, intelligence means the cyber capability of a single agent (how much of an operation it can execute on its own). One year ago, Anthropic’s report on the Chinese cyber espionage campaign described Claude performing discrete technical tasks while an external human-built framework maintained the state of the attack and sequenced those tasks into a larger campaign. Today, Claude Mythos can autonomously discover zero-days and combine multiple vulnerabilities into working exploit chains, and GPT-6 Astra more than doubled the success rate on long-horizon offensive cyber challenges compared to GPT-5.6 Sol. In less than a year, models have progressed from executing individual steps in an attack chain to autonomously conducting extended offensive operations.

METR’s task-completion horizon measures the length of a task that an AI agent can complete with 50 percent reliability (based on the time required by a human expert). In September 2025, Claude Opus 4.1 had a horizon of roughly 2 hours. By February 2026, Claude Opus 4.6 had reached nearly 12 hours—a sixfold increase in less than five months. By April, Claude Mythos Preview had exceeded the 16-hour range that METR could reliably measure.

This acceleration should not be surprising. When Mythos was announced, many skeptics dismissed its cyber capabilities as marketing. That never sounded logical to us. A model that becomes 20 percent better at programming will likely become much better at finding bugs and vulnerabilities, and stronger reasoning helps it chain those vulnerabilities into sophisticated attacks. This is exactly what happened: Mythos’s capabilities emerged from broader improvements in coding, reasoning, and autonomy, not from explicit training in exploitation. Now, frontier AI labs are training the next generation of models directly on cyber tasks. Cyber capability is therefore advancing from two directions at once: broader gains in coding, reasoning, and autonomy, and deliberate cyber training. The pace of progress will only accelerate if this training continues.

Inference speed

In addition to getting smarter, agents are also running faster. NVIDIA’s B200 GPUs can produce about three times as many tokens per second for large models compared to the previous-generation H200 GPUs, OpenAI’s new Jalapeño chip can generate tokens up to four times faster than even the leading NVIDIA systems, and software techniques like speculative decoding are dramatically speeding up inference. The faster each agent runs, the more work it can complete before a defender can respond.

Compute

Compute determines how large a cyberswarm can become. More compute means more agents, and cyberswarm capability scales with the amount of hardware an actor can bring to bear. If Anthropic’s Mythos and OpenAI’s GPT-6 Astra are both rumored to be around 10T parameters, then at FP8 precision the weights occupy roughly 10TB. An NVIDIA GB200 NVL72 rack pools 13.4TB of GPU memory and draws roughly 125 to 135kW, so a single rack holds one full copy with room left over for KV cache. After accounting for data-center overhead and assuming a batch size of 250 queries, a 1GW cluster could field roughly 1.85 million agents.

This infrastructure is being built out at extraordinary speed. Global AI compute capacity has grown 3.3x per year from 2022 through 2025, reaching roughly 17.1 million H100-equivalents. AI data-center power reached nearly 30GW in 2025, and OpenAI alone has announced at least 26GW of planned deployments over the next few years: 10GW with NVIDIA, 6GW with AMD, and 10GW with Broadcom. Anthropic has secured up to 5GW from Amazon and runs more than a million Trainium2 chips, announced a $50 billion partnership with Fluidstack to build data centers and plans to deploy up to 1 million Google TPUs, and has contracted more than 300MW of compute capacity from SpaceX that includes over 220,000 NVIDIA GPUs. In addition, Meta is building a 5GW data center in Louisiana that will cost more than $50 billion. At this pace, global capacity is likely to exceed 100GW by 2030. Of course, not all of this capacity will be needed to power a swarm. A cyberswarm can do enough damage with just a few megawatts (MW) of compute.

Model size

Intelligence is being compressed into smaller, more efficient models. In March 2022, the smallest model scoring above 60 percent on MMLU was Google DeepMind’s Chinchilla with 70B parameters. By September 2024, Alibaba’s Qwen 2.5 with 1.54B parameters crossed the same threshold. That’s a 40x reduction in model size over just two years! Halving a model’s deployed memory footprint can allow roughly twice as many agents to run on the same hardware. So the smaller the model, the larger the swarm.

Moreover, not every agent in a cyberswarm needs to be the most capable model. A few larger models could orchestrate vast numbers of smaller, specialized models trained through multi-agent RL to work under their direction. With enough smaller agents and high-quality RL training, such a swarm might be more effective than one composed of fewer, larger models. An army doesn’t need every soldier to be a general, and not all models have to be superintelligent to be useful.

In the case of China, even though U.S. chip export controls may have constrained the supply of advanced hardware, China could dedicate a few thousand of its best chips to running its most capable models as orchestrators, and then field the rest of the swarm using smaller models on the long tail of older, weaker hardware already available (even consumer-grade GPUs). If cyberswarms become a national priority, this architecture would allow a compute-constrained nation to extract the greatest possible capability from every chip it possesses.

Coordination

Multi-agent model training is already producing dramatic gains in coordination ability. In June 2025, Anthropic’s multi-agent research system outperformed a single Claude Opus 4 agent by 90.2%. In January 2026, Google found that centralized coordination improved performance by ~81% on tasks that could be divided into many independent pieces.

The scale is now increasing. In August 2026, Anthropic gave 45 agents separate virtual machines and a shared forum, then instructed them to find vulnerabilities across 15 open-source projects. The swarm found 266 vulnerabilities by dividing the work, building new tools, and sharing discoveries across the group. Cyber warfare is built for this kind of parallel work.

OpenAI, in particular, has had a focus on multi-agent RL. Recently in September, OpenAI ran roughly 10,000 coordinating agents for 88 hours to solve the Navier–Stokes Millennium Prize problem. In the Hugging Face Incident, the models that formed the swarm were previously trained to coordinate and cooperate as collective using multi-agent RL.

Coordination makes offensive swarms more effective and harder to detect. UK AISI found that splitting a malicious objective across multiple agents makes the operation less suspicious to per-agent monitors, because no individual agent performs enough of the attack to reveal the full objective. Adding a central planner increased successful end-to-end attacks by up to 7x. The next Hugging Face Incident could unfold undetected with each individual agent performing only a small part of the attack and a hidden coordinator assembling their actions into a successful operation.

Two years ago, none of this was possible. But now, coordination is an effective force multiplier on cyberswarm capability, and it will likely become even more powerful as the frontier multi-agent RL stack matures. Moreover, this capability will proliferate to foreign adversaries. Superior coordination will allow them to offset disadvantages in model intelligence, inference speed, and compute. Maintaining U.S. leadership in multi-agent systems is therefore a national security imperative.

Cyber sits on the jagged frontier of superintelligence. Like coding and mathematics, it is highly verifiable: an exploit works or it does not. This allows frontier labs to train directly against objective outcomes via reinforcement learning. With intelligence, inference speed, model efficiency, compute, and coordination all advancing together, cyber-ASI no longer requires another fundamental breakthrough—only the continued scaling of systems that already exist.

Cyber-Superintelligence is Dangerous #

Very soon, a nation’s cyberpower will be driven primarily by the capabilities of its cyberswarms. Every variable in the Cyberswarm Equation is accelerating, and these capabilities will quickly proliferate to adversarial nation-states and non-state actors. It is time to prepare for a future where cyberswarms are widespread and weaponized against us.

To meet this threat, it’s important that the United States develop its own cyberswarm capabilities, for offense and defense. This will require learning to deploy these systems, learning to counter them, and hardening critical infrastructure for the coming wave of autonomous cyber warfare. Failure to do so will leave the United States and its allies vulnerable and outmatched, ceding a decisive strategic advantage to their adversaries.

However, building cyber-superintelligence is extremely dangerous.

It requires building AI systems powerful enough to break into the world’s most secure systems. If an adversary sabotages one of these models and we fail to detect it, the model could insert vulnerabilities at scale, weaken our defenses, or act against us at a decisive moment. AI models writing our code could begin inserting vulnerabilities into power grids, communications networks, and classified government systems when a conflict begins.

It requires giving cyberswarms broad autonomy. If a swarm becomes misaligned or goes rogue and our systems are not hardened from the inside, AI could seize its own infrastructure, escape our control, and spread across the web. Cyber-superintelligence could even self-exfiltrate by copying its own weights onto external infrastructure and becoming a persistent entity that is extremely difficult to shut down.

It requires creating the most sophisticated cyber-superintelligence in the world while storing it in files that are vulnerable to theft. If an adversary steals those model weights, America’s strategic advantage could be erased overnight and we’ll have handed the most powerful cyber weapon ever created to a hostile actor. The United States would have spent trillions of dollars building its adversary’s most powerful weapon.

The United States should remain open to international coordination that reduces these risks, but not to any arrangement that imposes unilateral restraint or leaves it strategically behind. Until reciprocal and verifiable limits are possible, we must assume that adversaries will continue to advance their capabilities and ensure that the United States and its allies can defend and prevail.