A single prompt enabled OpenAI’s ChatGPT-5.5 large language model (LLM) to conduct full-scale offensive cyber-attacks, gaining domain-level access to a network in under 40 minutes, according to tests by Cato Networks. The cybersecurity firm published a paper on July 15 detailing an experiment in a controlled Active Directory environment designed to resemble a typical enterprise. Following a single prompt, the agent planned and executed the entire attack lifecycle, including reconnaissance, exploitation, internal discovery, privilege escalation, lateral movement, and exfiltration. Cato Networks focused on GPT-5.5 rather than GPT-5.5-Cyber to reflect publicly available frontier models accessible to attackers. The specific prompts used have not been revealed as a cybersecurity measure. Testing six scenarios, the agentic AI devised new strategies when conditions changed, such as generating custom vulnerability probes and designing alternative communication paths. In one test, the agent developed an SMB-based tunneling approach and reached admin level privileges in approximately 40 minutes, attributed to its ability to adapt.