Booz Allen warns against judging AI cyber capability by the model alone. Its Cyber Weapon Index, introduced on September 2, finds that additional orchestration software can substantially change measured attack performance.
The company initially tested 18 models in a controlled network, measuring vulnerability research and attack execution. Scores relied on network and system logs rather than the models' own descriptions.
According to the report, Claude Sonnet with extra tool and workflow software rivalled Claude Mythos. A later addendum also identifies GPT-6 Astra as completing a full attack chain in the test.
These authorized laboratory tests do not establish a general success rate against outside production systems. Independent replication is not established, and exact repetition counts are missing. Booz Allen also sells defensive products. Its forecasts remain the company's assessments.