OpenAI announced in June 2026 that its newly fine-tuned GPT-5.5-Cyber variant outperforms Anthropic's recently released Mythos model on a battery of cybersecurity reasoning benchmarks, including SecBench, CyberSecEval, and the open-source HackBench harness. Per OpenAI's research page, the company's internal evaluations put GPT-5.5-Cyber ahead by 3 to 11 points across categories ranging from CTF-style exploit reasoning to defensive incident-response synthesis. Anthropic has not yet published a public rebuttal, and no independent third party has reproduced the runs.
The headline claim: GPT-5.5-Cyber vs Mythos on security benchmarks
The specific claim, per OpenAI's accompanying technical brief, is that GPT-5.5-Cyber — a domain-tuned derivative of the GPT-5.5 base — achieves a weighted average of 81.4 on SecBench v3, 76.9 on CyberSecEval 4, and 68.2 on HackBench-2026, against Mythos's reported 78.2, 73.4, and 60.8 respectively. The deltas are not catastrophic, but they are large enough that, if they hold up under independent reproduction, they would represent a meaningful shift in the cybersecurity-LLM leaderboard, which had been led by Anthropic's Claude family for most of 2025.
What makes this announcement notable is less the headline number and more the framing: OpenAI is positioning GPT-5.5-Cyber as a model specifically built for, and evaluated on, defensive security workflows — triage, log summarization, SOAR-playbook drafting, threat-intel synthesis — rather than as a general-purpose model that happens to score well on security tasks. Per Anthropic's research page, Mythos was positioned similarly at its May 2026 launch, with explicit emphasis on tool-use safety and refusal calibration for dual-use cyber prompts. The two models are competing for the same operator segment.
Key takeaways
- OpenAI's June 2026 announcement claims GPT-5.5-Cyber leads Anthropic's Mythos by roughly 3 to 11 points across SecBench, CyberSecEval, and HackBench. Numbers are vendor-reported and have not been independently reproduced as of publication.
- The benchmarks at issue are heterogeneous: SecBench leans theoretical, CyberSecEval leans dual-use refusal, and HackBench is a more applied CTF-style harness. A model can win one and lose another for very different reasons.
- Per OpenAI's brief, GPT-5.5-Cyber is a domain-tuned derivative — not a from-scratch architecture — which is consistent with industry practice but limits how generalizable the lead is.
- Mythos's known strengths remain refusal calibration and tool-use safety, areas where the published delta is narrower and where vendor methodology can favor whoever wrote the eval.
- Operators running open security-tuned models locally on a MSI GeForce RTX 3060 Ventus 2X 12G or similar 12 GB-class GPU are unaffected by the closed-model leaderboard shuffle in the short term, but the gap between hosted and local security models is widening.
- Until an independent reproduction lands — most likely from MITRE, NIST, or one of the academic groups that maintain HackBench — these numbers should be treated as a claim, not a settled fact.
What's the benchmark, exactly?
"Cybersecurity benchmark" is doing a lot of work in the headline. There is no single canonical eval for security reasoning the way MMLU is for general knowledge or HumanEval is for code. Instead, the field has settled on a portfolio of harnesses, each measuring something different. Per a representative cybersecurity LLM eval paper, the dominant taxonomy splits security evals into four buckets: knowledge recall (does the model know what CVE-2024-XXXX is), reasoning over artifacts (can it analyze a packet capture or a stack trace), generative defensive work (can it write a detection rule or playbook), and adversarial elicitation (does it refuse, partially comply, or fully comply with dual-use requests).
SecBench, the most-cited of the three benchmarks OpenAI ran, sits primarily in the first two buckets — it is heavy on multiple-choice and short-answer questions covering concepts, protocols, vulnerabilities, and mitigations. CyberSecEval, originally released by Meta and extended in subsequent versions, sits more in the fourth bucket: it measures whether a model will help with insecure code generation, prompt-injection susceptibility, and similar dual-use scenarios. HackBench is the most applied of the three, presenting CTF-style challenges where the model must reason about a binary, a web app, or a network capture and produce a working solution path.
These benchmarks measure genuinely different capabilities, and a model can dominate one while merely tying on another. That is part of why vendor-run sweeps that report aggregate "cybersecurity" performance can be misleading: the aggregate hides which sub-skill the model actually advanced on. Per OpenAI's announcement, GPT-5.5-Cyber's largest reported gains are on HackBench — the applied CTF harness — which is the bucket most relevant to red-team and incident-response operators, but also the bucket most sensitive to which exact problems are sampled.
How OpenAI describes the GPT-5.5-Cyber result
OpenAI's framing, per the linked research page, is that GPT-5.5-Cyber is the first model in its family explicitly trained on a security-curated post-training corpus — public CTF write-ups, sanitized incident-response transcripts, MITRE ATT&CK and D3FEND annotations, and a synthetic dataset of structured reasoning traces over CVE descriptions. The company emphasizes that the model was evaluated on held-out splits and that the gains over the base GPT-5.5 generalize across the three benchmarks rather than concentrating in one.
The announcement also makes a softer claim about latency and tool-use efficiency: GPT-5.5-Cyber reportedly resolves more multi-step tool-use chains in fewer turns than the base model, which matters for SOAR-style integrations where each turn costs money and seconds. OpenAI has not, as of publication, released the model weights, the post-training corpus, or the exact eval harness configurations. That is consistent with the company's posture for the past several years, but it limits what outside researchers can verify.
Notably, OpenAI does not publish per-category Mythos numbers; the comparison table reproduces Anthropic's own May 2026 disclosures rather than re-running Mythos under OpenAI's harness. That is the more defensible choice — re-running a competitor's model under your own harness invites reasonable criticism — but it also means the comparison is across two slightly different methodologies, and the deltas should be read with that asymmetry in mind.
Anthropic's posture and Mythos's known strengths
Anthropic has not issued a direct response to OpenAI's announcement at the time of publication. Per Anthropic's research page, Mythos was positioned at launch as a constitutional-AI-trained model with explicit attention to dual-use refusal calibration — a posture that tends to score well on CyberSecEval-style harnesses, which reward correct refusals, but can leave points on the table on HackBench-style harnesses, which reward producing a working solution regardless of whether the framing was defensive or offensive.
The published Mythos technical card emphasizes three capabilities that are harder to capture in a leaderboard sweep: (1) calibrated uncertainty, where the model says "I don't know" or asks for clarification rather than confabulating a CVE number; (2) tool-use safety, where the model refuses to chain tools in ways that escalate privileges in ambiguous contexts; and (3) long-context security review, where the model is asked to audit thousands of lines of code or hundreds of log lines in a single pass. None of those map cleanly to the three benchmarks OpenAI cited.
This is not a defense of Mythos; it is a reminder that benchmark leadership and operational usefulness are correlated but not identical. An operator deciding between the two for a SOC or a managed-detection-and-response workflow would want to evaluate on their own ticket corpus, not on SecBench. Per the linked methodology documents, both vendors recommend exactly this — internal evaluation on representative workloads — and treat the public benchmarks as a screening filter rather than a final answer.
The benchmarks behind the headlines: SecBench, CyberSecEval, HackBench
A brief sketch of each, drawn from the published methodology:
SecBench v3 — Multiple-choice and short-answer questions across roughly a dozen security domains: cryptography, network security, web security, malware analysis, secure coding, cloud security, identity, and incident response. Roughly 4,500 questions in the public split, with a held-out test set used for leaderboard scoring. The harness is closed-form, which makes scoring deterministic but limits what it can measure — a model can know what a CSRF token is without being able to identify one in a packet capture.
CyberSecEval 4 — A composite eval covering insecure code generation (does the model emit a SQL-injection-prone snippet when asked for a login form), prompt-injection susceptibility (does the model follow instructions hidden in tool output), and dual-use elicitation (does the model help with explicitly offensive requests, partial refusal requests, and ambiguous defensive requests). Scoring is partly automated and partly graded by a judge model, which introduces its own measurement noise.
HackBench-2026 — An open-source CTF-style harness with roughly 300 challenges across binary exploitation, web exploitation, cryptography, reverse engineering, and forensics. The model is given access to a tool sandbox (Python, a shell, a disassembler, a web browser) and is scored on whether it produces a valid flag within a turn budget. This is the most operationally relevant of the three for offensive-security workflows and the most expensive to run.
Score table: GPT-5.5-Cyber vs Mythos vs Llama-Sec-3 across categories
All numbers below are vendor-reported, drawn from OpenAI's June 2026 technical brief and Anthropic's May 2026 Mythos card. Llama-Sec-3 numbers are from Meta's April 2026 release notes. None of these have been independently reproduced as of publication.
| Benchmark | GPT-5.5-Cyber | Mythos | Llama-Sec-3 |
|---|---|---|---|
| SecBench v3 (weighted avg) | 81.4 | 78.2 | 64.5 |
| CyberSecEval 4 (composite) | 76.9 | 73.4 | 58.1 |
| HackBench-2026 (pass@1) | 68.2 | 60.8 | 41.7 |
| Avg multi-turn tool-use depth | 4.2 | 3.8 | 2.6 |
| Refusal calibration (CSE refusal-correctness) | 91.0 | 94.5 | 82.3 |
A few observations: GPT-5.5-Cyber's largest lead is on HackBench, the applied harness, which is consistent with OpenAI's narrative about post-training on CTF write-ups. Mythos retains the lead on refusal calibration — the area Anthropic has historically prioritized — and the delta there (3.5 points) is comparable in absolute magnitude to OpenAI's lead on SecBench (3.2 points). The Llama-Sec-3 open-weight reference is included as a floor: it is meaningfully behind both closed models, but it is also the only one of the three you can run on hardware you own.
What this means for buyers and operators of local security models
For the segment of operators running open security-tuned models locally — typically Llama-Sec-3, a Qwen-Sec fine-tune, or a community SecBERT derivative — the OpenAI vs Anthropic leaderboard shuffle is largely background noise in the short term. The closed-model gap to local-open is much larger than the closed-to-closed gap, and that gap is the more pressing operational question.
A practical local stack for a defensive workflow — log triage, alert summarization, playbook drafting — runs comfortably on a 12 GB GPU like the MSI GeForce RTX 3060 Ventus 2X 12G paired with an 8-core CPU such as the AMD Ryzen 7 5800X or its lower-power sibling the AMD Ryzen 7 5700X. That kind of rig will run an 8B-parameter security-tuned model at usable tokens-per-second for interactive triage and at very respectable throughput for batched log processing. It will not run a frontier model like GPT-5.5-Cyber or Mythos — those are hosted-only — but it will run the open-weight baseline well enough to handle a meaningful slice of the workload that would otherwise hit a paid API.
The right way to think about the OpenAI announcement, from a local-inference perspective, is that it raises the ceiling of what is possible on cybersecurity reasoning, which over the next 12 to 18 months will pull up the floor as those gains diffuse into the open-weight ecosystem via distillation, synthetic data generation, and fine-tuning recipe publication. Operators who keep their local stack current will benefit indirectly even if they never call a hosted security model.
For a deeper view of the VRAM-vs-model-size tradeoffs, see our Which GPU Runs Which LLM? guide; for the bandwidth question that increasingly dominates tokens-per-second on dense models, see Why AI Memory Bandwidth Matters; and for a current buying view across the local-inference GPU stack, see the Local AI Rig Buying Guide.
Caveats: vendor-run benchmarks vs independent reproductions
The single largest caveat on every number in this article is that it is vendor-reported. OpenAI ran GPT-5.5-Cyber's evaluations on harnesses that OpenAI configured, with held-out splits that OpenAI selected, against numbers that Anthropic published using Anthropic's own harness configuration. None of that is unusual, and none of it is necessarily problematic, but it does mean the comparison is not apples-to-apples in the way a third-party leaderboard would be.
Four specific things to watch for as independent reproductions land:
- Sampling sensitivity — HackBench in particular is known to have high variance across temperature settings and across different problem subsets. A 7-point lead at temperature 0.2 on one subset can shrink to a 1-point lead at temperature 0.7 on another.
- Judge-model leakage — CyberSecEval relies on a judge model for parts of its scoring. If the judge model is from the same family as the model under test, scores can be biased upward by a few points. OpenAI's brief does not specify which judge was used.
- Refusal accounting — Different harnesses score refusals differently. A model that refuses an ambiguous request gets credit on one rubric and penalized on another. The aggregate score can shift by several points depending on how refusals are bucketed.
- Held-out contamination — Both GPT-5.5-Cyber and Mythos were trained on large web corpora that may overlap with the public splits of SecBench and CyberSecEval. The held-out splits are designed to mitigate this, but contamination remains an active area of audit.
The responsible read of the OpenAI announcement is: directionally credible, magnitude uncertain, pending reproduction.
How this changes the local-inference picture
In the very short term, it does not. Local-inference operators are running open-weight models that lag the frontier by 12 to 18 months, and that gap is the binding constraint on their workflows. A 3-point shift between two hosted models that they are not running has no immediate operational effect.
In the medium term, the announcement matters because of what it signals about training recipes. If OpenAI's gains on HackBench really do come from post-training on CTF write-ups and structured reasoning traces over CVE descriptions, then that recipe is reproducible — perhaps not the exact corpus, but the shape of it. Within a release cycle or two, expect Meta, Mistral, Qwen, and the community fine-tuners to publish security-focused post-training datasets and recipes that close some of the gap to Mythos and GPT-5.5-Cyber on HackBench-style tasks.
That is the more interesting story for the local-inference audience. The hosted leaderboard moves matter primarily as a leading indicator for what will be runnable on a 12 GB or 24 GB GPU 12 to 18 months from now. The operators who keep their rigs current — a current-generation GPU, enough VRAM to host an 8B to 14B model with reasonable context, a CPU that can keep up with token streaming and tool-call orchestration — are positioned to inherit those gains as they diffuse.
What to watch next: independent reproductions, OSS releases, regulator response
Three specific things to track over the next quarter:
Independent reproductions. MITRE has historically run third-party evaluations of frontier-model security capabilities; NIST AISI has published similar work; the academic groups that maintain HackBench publish quarterly leaderboards. The first independent number — even if it only covers one of the three benchmarks — will be the most informative single data point on whether OpenAI's claim holds.
Open-weight derivatives. Within roughly 90 days of any major frontier-model security announcement, the open-weight community typically publishes distilled or fine-tuned derivatives targeting the same benchmarks. Watch for Llama-Sec-4, Qwen-Sec, and DeepSec releases that explicitly target HackBench-2026, and watch how close they get to the closed-model numbers.
Regulator response. Cybersecurity-tuned LLMs sit at the intersection of dual-use concerns and critical-infrastructure protection. EU AI Act implementing acts, US executive-order guidance, and sector-specific regulator notes (FFIEC, CISA, NIS2 transposition) are all touching on this space in 2026. A vendor leaderboard shuffle is unlikely to move regulation directly, but the framing of "who has the most capable cyber model" is increasingly part of the regulatory conversation about deployment safeguards.
Related guides
Citations and sources
- OpenAI research page — source of the GPT-5.5-Cyber announcement and methodology brief referenced throughout.
- Anthropic research page — source of the Mythos technical card and the previously published comparison numbers.
- Representative cybersecurity LLM eval paper — referenced for the taxonomy of cybersecurity benchmark categories used to frame SecBench, CyberSecEval, and HackBench.
This piece is editorial synthesis based on publicly available information. No independent first-party benchmarking is reported.
