Single Prompt Empowers ChatGPT-5.5 to Execute Full Cyber-Attack Chain, Researchers Find
Cybersecurity researchers demonstrated that OpenAI's advanced GPT-5.5 model can execute a complete cyber-attack chain, including achieving domain-level access, using only a single prompt.
Cybersecurity researchers have revealed a startling capability of OpenAI's advanced large language model, GPT-5.5, demonstrating that a single, high-level prompt can empower the AI to execute a full cyber-attack chain. In tests conducted by Cato Networks, the AI agent was able to plan and carry out reconnaissance, exploitation, internal discovery, privilege escalation, lateral movement, and data exfiltration, ultimately achieving domain-level access within approximately 40 minutes in a controlled Active Directory environment.
The research aimed to understand the potential for agentic AI, where an AI is given an objective and the autonomy to achieve it, to be leveraged in offensive cyber operations. While OpenAI's models are typically protected by safety guardrails, the researchers focused on GPT-5.5, a frontier model accessible to the public, to simulate threats posed by malicious actors who may attempt to bypass these protections or utilize publicly available advanced models.
Cato Networks designed a simulated enterprise network to test the AI's capabilities across six different scenarios. The results indicated that the agentic AI was not only capable of executing a pre-defined attack path but also demonstrated remarkable adaptability. When faced with changing environmental conditions or unexpected outcomes, the AI could devise new strategies, generate custom vulnerability probes, modify its collection workflows, and establish alternative communication paths to reach its objective.
One notable example of this adaptive behavior involved the AI developing a Server Message Block (SMB)-based tunneling approach to facilitate data movement after gaining an initial foothold. This ability to adjust its tactics in real-time, rather than rigidly following a sequence, was crucial to its rapid success in achieving administrative privileges.
While the specific prompts used in the experiment were not disclosed to prevent misuse, the researchers emphasized that the observed behaviors, though not indicative of novel attack discovery, highlight the AI's capacity for goal-oriented problem-solving in offensive operations. The findings suggest that frontier models can significantly contribute to the planning and execution phases of cyberattacks.
Cato Networks, a member of OpenAI's Daybreak Program, cautioned that the observed patterns, while consistent across multiple tests, might not be universally representative of all enterprise environments. However, the research offers critical insights for cybersecurity leaders navigating the increasing integration of AI in workplaces and the parallel efforts by threat actors to exploit these tools for faster and more sophisticated attacks.
The paper concluded that the most significant impact of agentic attackers may not be the invention of entirely new attack techniques, but rather the dramatic acceleration, automation, and scaling of existing attack workflows. This underscores the urgent need for enhanced defenses and a deeper understanding of AI's dual-use potential in cybersecurity.
Infosecurity Magazine has reached out to OpenAI for comment on these findings.