I often see security people dismiss basic extrapolation of AI trends as some kind of speculation about the future. I think this misses that preparing for future threats and forecasting attacker capabilities have long been normal practice in our field. Cryptographers have used computing trends to think decades ahead when designing defenses, while traditional cybersecurity has always planned for worst-case scenarios. AI capabilities are on track to make these challenges even harder than what we faced before, requiring much more effort to get through this era safely.

Whitfield Diffie and Martin Hellman1 were considering future computing power as early as 1977. In their paper on exhaustive attacks against the Data Encryption Standard (DES), they estimated that a machine costing about $20 million could find a key in about 12 hours on average. They then considered what would happen as computing became cheaper.2

Based on the historical decline in computing costs, they estimated that a similar machine could cost about $200,000 10 years later. They also addressed uncertainty in their estimate directly.

Thus even a factor-of-10 error would be erased in five years.2

Their point was that defenses must be designed for the attackers expected in the future, with a security margin in case the estimate is wrong. Uncertainty about when attackers become stronger is no reason to plan only for today's attackers.

They used this reasoning to argue that DES should be changed before it came into wide use, and recommended raising the key length from 56 to 128 or 256 bits.

They turned out to be right: in 1998 a machine that cost under $250,000 found a DES key in 56 hours.3 Today, a single gaming GPU that costs about $1,600 can search all DES keys in about 6 days, while a 128-bit key would take it more than 1019 years.4

In 1996, Matt Blaze, Whitfield Diffie, Ronald Rivest, Bruce Schneier (et al.) published recommendations for choosing encryption keys with 20 years of future computing advances in mind.5 They used Moore's law, which says that computing power per dollar doubles every 18 months, to estimate how much cheaper attacks would become over that period.

Moore's Law thus predicts that the keys should be approximately 14 bits longer than required to protect against an attack today.6

Number of transistors per microprocessor from 1971 to 2021 on a logarithmic scale, rising in a nearly straight line from a few thousand to tens of billions.
The number of transistors per microprocessor, on a logarithmic scale. Chart from Our World in Data (CC BY), data from Rupp (2022).

Their recommendation relied on a forecast of future capabilities, which was based on a historical computing trend, with a warning that better attack algorithms could require even more protection.

We have a very long history of using uncertain capability trends to choose defenses with enough security margin for forecast errors.

Outside cryptography, looking ahead at attacker capabilities is among the most standard recommendations in cybersecurity, long before the AI boom. NIST advises designers of security systems to expect adversaries to evolve and to take a longer-term view,7 and the whole idea of defense in depth is based on the assumption that any single layer can fail in the future.8

So, can we predict AI hacking capabilities the same way? It is harder than forecasting computing power, because progress depends on many inputs. Scaling laws describe how model quality improves as more compute and data are used for training, algorithmic improvements make the same compute produce a better model, and the amount of compute available for training keeps growing. In the last few years training compute has grown about 5 times per year9 and algorithmic improvements have made the same compute about 3 times more effective each year,10 which gives roughly 10 times more effective compute per year.

Training compute of frontier AI models from 2017 to 2026 on a logarithmic scale, rising from about 10^21 to 10^27 FLOP.
The compute used to train frontier models has grown about 5 times per year since 2017. Data from Epoch AI.

Capability evaluations show a similar pattern. METR measures the length of software tasks, in human working time, that models complete with 50% success, and this length has doubled about every 4 months since 2023.11 The latest model in its data, Claude Mythos Preview, is at about 17 hours. For much longer tasks, there is a benchmark in which models reimplement real software without seeing its source code, work that can take humans weeks, and Claude Opus 5.5 currently scores 77% on it.12

METR time horizon of frontier models from 2019 to 2026 on a logarithmic scale, rising from seconds to about 17 hours, with a dashed trend line that doubles about every four months.
METR time horizon of the best model at each date, with METR's trend since 2023.

This also transfers to hacking capabilities. UK AISI found that the length of cyber tasks models can complete has doubled about every 4.7 months since late 2024, and Claude Mythos Preview showed results above this trend.13

UK AISI cyber time horizon at 80% reliability for reasoning models from late 2024 to 2026, with Claude Mythos Preview and GPT-5.5 above the 4.7-month doubling trend.
UK AISI's cyber time horizon at 80% reliability. Source: UK AISI.

Extrapolating the METR and UK AISI trends would put tasks that take humans months within the next ~2 years. This is roughly the scale of a full red team engagement or of vulnerability research on a hardened target. At the same time, the cost of a given level of AI performance has fallen about 13 times per year since 2023,14 and the AI hardware that will be available worldwide by the end of 2027 could run about 30 to 170 million frontier agents in parallel,15 or ~2 billion agents on open-weight models.16 This means that even a basic extrapolation of current trends requires defenders to prepare for large numbers of attackers capable of performing months of professional red teaming, for open-weight models only slightly behind that level,17 and for a much lower cost of the same capability over time.18

As with Diffie and Hellman's estimate, even a factor-of-10 error in this forecast would be erased in about a year, so defenders would still have to prepare for the same attackers.19

What about the security margin? A simple extrapolation of current trends could underestimate progress, because AI is starting to automate AI research. AI systems already write most of the code inside frontier labs,20 and Anthropic reports that, as of August 2026, Claude leads 26% of its AI R&D work, up from under 1% in February.21 Models are also performing better on AI R&D benchmarks, such as post-training small models22 and optimizing inference.23 Even before full automation, improvements to AI can increasingly feed back into the process that produces the next generation and accelerate it.24 A recent report by leading AI scientists argues that automating AI R&D could compress years of progress into months,20 OpenAI has set an internal goal of a fully automated AI researcher by 2028,25 and a co-founder of Anthropic expects AI R&D with no human involvement by the end of 2028 2027.26

It is clearly harder to keep such a margin against AI than against better hardware, and there is no obvious equivalent of adding bits to a key. This is a reason to follow capability trends more closely and to study what they imply for defenses, including how to make security future-proof and whether that is possible at all.

This doesn't require a 20-year horizon, but the reasons for planning ahead apply to us too, since defenses take years to build and adopt and then need to keep working long after. It is enough to consider what the models of the next few years mean for the defenses we build today.

Some measures are clearly useful in the short term, such as building better sandboxes, avoiding software with previously unknown zero-day vulnerabilities,27 continuously red teaming your infrastructure with the strongest available models and implementing defense in depth. In the long term, it is unclear how to build defenses that keep working as AI becomes much more capable, so I think research on such defenses should be one of the highest priorities for the security industry right now.

Footnotes

  1. If you’re not familiar with these people, let’s say your browser uses a version of their algorithm right now. ↩

  2. Diffie and Hellman, Exhaustive Cryptanalysis of the NBS Data Encryption Standard, Computer, June 1977, pp. 74–75. ↩ ↩2

  3. EFF, EFF DES Cracker FAQ, 1998. In 2006 a machine called COPACOBANA did the same for under $10,000, with an average search time of less than 9 days (Kumar et al., Breaking Ciphers with COPACOBANA). ↩

  4. Hashcat v6.2.6 benchmark on an RTX 4090, mode 14000 (DES): 146.6 billion keys per second, which searches all 2^56 DES keys in about 5.7 days. The RTX 4090 launched at $1,599. At the same rate, searching all 2^128 keys would take about 7×1019 years. ↩

  5. Cryptography often needs especially long horizons, because data must stay secret for many years and migrations to new algorithms are slow. For example, the UK NCSC set 2035 as the target date for moving to post-quantum cryptography, because it expects that new standards, products that use them and their wide adoption will take about 10 years, even though a quantum computer that can break current encryption does not exist yet (NCSC, March 2025). ↩

  6. Blaze et al., Minimal Key Lengths for Symmetric Ciphers to Provide Adequate Commercial Security, January 1996, Section 5, p. 7. Lenstra and Verheul later used the same approach systematically in Selecting Cryptographic Key Sizes (2001), combining trends in computing power, memory, attacker budgets and cryptanalytic algorithms. ↩

  7. NIST, Developing Cyber-Resilient Systems, SP 800-160 Vol. 2 Rev. 1, December 2021, Appendix D. ↩

  8. NIST, Guidelines on Firewalls and Firewall Policy, SP 800-41 Rev. 1, September 2009, Section 5.1, p. 5-1. ↩

  9. Epoch AI, Trends in AI, training compute of frontier language models, 5× per year since 2020. ↩

  10. Ho et al., Algorithmic progress in language models, 2024. The compute needed for a given performance halved about every 8 months, based on language models from 2012 to 2023. ↩

  11. METR, Time Horizon 1.1, updated May 2026. The doubling time is METR's estimate for models since 2023. ↩

  12. Epoch AI and METR, MirrorCode, October 2026. The score is from Epoch's benchmark data. ↩

  13. UK AISI, How fast is autonomous AI cyber capability advancing?, May 2026. The 4.7-month estimate uses an 80% success threshold and a 2.5-million-token limit per task. ↩

  14. Emberson and Roodman, The plunging price of thought, Epoch AI, September 2026. ↩

  15. Li, How many AI agents could we run?, Epoch AI, October 2026. ↩

  16. Possibly many more with small specialized models, e.g. XekRung-1.5-27B-Preview ranks first on a cyber benchmark while being ~100 times smaller than comparable models. ↩

  17. Edwards and Emberson, Open models lag state-of-the-art closed models by 4 months, Epoch AI, May 2026. ↩

  18. Epoch AI, LLM inference prices have fallen rapidly but unequally across tasks, reports price declines of 9 to 900 times per year depending on the task. ↩

  19. A factor of 10 is about 3.3 doublings, which is about 13 months at a doubling time of 4 months (METR) and about 16 months at 4.7 months (UK AISI). ↩

  20. Chan et al., What if automating AI R&D triggers an intelligence explosion?, Cambridge Programme on AI Science & Policy, 2026. ↩ ↩2

  21. Favaro and Wright, Measuring the pace of AI development, Anthropic, September 2026. "Leads" means that the AI completes most of the task end to end from a high-level prompt. ↩

  22. Rank et al., PostTrainBench, v1.2, October 2026. ↩

  23. Yeon et al., InferenceBench, v1.0.6, September 2026. ↩

  24. Tom Cunningham, Recursive Self-Improvement, Literature Review, updated July 2026. ↩

  25. TechCrunch, October 2025, and MIT Technology Review, March 2026. ↩

  26. In Import AI 455 (May 2026), Jack Clark estimated a >60% chance by the end of 2028. Later, he wrote in Import AI 476 (October 2026) that he now expects it in 2027. ↩

  27. Benjamin Todd (@ben_j_todd), post on X, 29 September 2026. ↩