The Capability Gap: What Restricted Frontier Models Actually Reveal About AI and Offensive Security

By Wolf Schulz — Quantropic

There is a category of AI system that does not appear in product announcements, does not ship with a usage policy PDF, and does not have a waitlist. Restricted frontier models — evaluated under controlled conditions by a small number of organizations — exist in a space between research artifact and operational tooling. They are not products. They are probes into what becomes possible when capability ceilings are raised and standard deployment constraints are relaxed.

I have worked with one such system. What follows is not a vendor evaluation. It is an attempt to describe, with technical precision, what the capability frontier actually looks like — and why the mythology that has developed around these systems is simultaneously overstated and dangerously underspecified.

What the Mythology Gets Wrong

The dominant narrative in vendor-adjacent security forums runs roughly as follows: frontier AI models, when sufficiently capable, become autonomous red team operators. Given a target, they enumerate, exploit, pivot, persist, and exfiltrate — compressing a weeks-long engagement into minutes.

This narrative contains a real observation embedded in significant confusion.

The real observation: capable reasoning models demonstrate genuine uplift in specific phases of offensive security work. Reconnaissance synthesis, vulnerability hypothesis generation, exploit code adaptation, and attack chain reasoning all benefit measurably from increased model capability. A sufficiently capable model reduces the cognitive load on a human operator in ways that meaningfully accelerate certain tasks.

The confusion: this is not the same thing as autonomous offensive capability. The gap between “accelerates a skilled operator” and “replaces a skilled operator” is not a capability gap that additional model scale closes. It is an architectural and contextual gap. It requires things that model capability alone cannot provide.

What Autonomous Offensive Capability Actually Requires

For an AI system to perform meaningful penetration testing autonomously against a real target, four conditions must hold simultaneously. The mythology addresses none of them.

Authenticated environmental access. A model operating without credentials, without network adjacency, and without the ability to enumerate internal resources is performing surface reconnaissance. Useful. Not a red team. Real engagements require the model to operate inside the network — with credentials, with access to running service configurations, with visibility into internal trust relationships. Without this, the model is reasoning about what a target probably looks like based on externally observable signals. A capable model doing this well is a good OSINT accelerator. It is not a penetration tester.

Active exploitation posture. Real penetration testing involves attempting to leverage discovered vulnerabilities — not merely cataloguing them. Privilege escalation, lateral movement, persistence establishment, and objective completion require an agent that can execute actions with real consequences against live infrastructure. The “AI red teamed our environment in minutes” claims that circulate in marketing materials consistently omit the rules of engagement under which those tests ran. Controlled, scoped, pre-authenticated demonstrations against lab environments are not production red teams. The distinction is not pedantic. It determines whether the output is actionable or theatrical.

Reliable tool use under adversarial conditions. Offensive security operations involve environments that actively resist enumeration — security tooling, anomaly detection, honeypots, and non-standard configurations that cause brittle automated tooling to fail or generate false signals. A model that reasons well in clean conditions must also reason well when the environment is actively deceptive. Current agentic systems, including frontier ones, degrade in reliability under these conditions in ways that human operators compensate for through experience and intuition. This is not a critique of model capability per se — it is a description of what adversarial environments do to any automated system that lacks contextual judgment.

Scoped operating authority. Autonomous action requires scoped authorization. Any system with genuine offensive capability operating in a production environment requires a rules-of-engagement framework that defines what actions are permitted, what constitutes success, and what triggers halt conditions. Building this framework around an AI agent is a solved problem in principle and an unsolved problem in practice. The engineering required to give a frontier model reliable, auditable operating authority in a real engagement environment does not currently exist at production quality.

The Safety Boundary as Attack Surface

This is where the technical picture becomes more uncomfortable than the marketing narrative allows.

The safety alignment of large language models — the mechanisms by which models decline to perform certain actions, refuse certain requests, or moderate their outputs — is not a security boundary in the cryptographic sense. It is a behavioral tendency, shaped by reinforcement learning from human feedback, that emerges from training and can be perturbed by input.

The academic literature on this is substantial and growing. Four attack classes are relevant to the offensive security context.

Gradient-based adversarial suffixes (Zou et al., 2023). Universal adversarial suffixes — token sequences appended to prompts — can reliably induce affirmative responses to requests that would otherwise be declined. The Greedy Coordinate Gradient (GCG) attack generates these suffixes by optimizing directly against the model’s refusal behavior. The resulting strings are not semantically meaningful to humans but are highly effective against the target model. Transferability across models is partial but non-trivial — suffixes optimized against one model class show measurable transfer to others. For a restricted frontier model with a different training regime, the transfer characteristics change in ways that are not predictable from public model behavior.

Prompt Automatic Iterative Refinement (PAIR) (Chao et al., 2023). Rather than gradient-based optimization, PAIR uses a second language model to iteratively refine jailbreak prompts against a target model. The attacker model generates candidate prompts, observes the target’s response, and updates its approach accordingly. This approach is black-box — it requires no access to model weights or gradients — and is effective against deployed models via API. The iteration count required to produce a successful jailbreak scales with model alignment quality, but convergence is typically achieved within dozens of queries rather than thousands. For restricted frontier models, the alignment surface is different — but the black-box methodology applies regardless.

Crescendo and multi-turn escalation (Russinovich et al., 2024). Single-turn jailbreak attempts are detectable and increasingly filtered. Multi-turn escalation attacks operate differently: they establish context incrementally across a conversation, normalizing increasingly sensitive content before the target request appears. The model’s context window becomes the attack surface. Each turn individually appears benign; the aggregate trajectory produces outputs that a single-turn request would not. This attack class is particularly relevant for agentic deployments, where multi-turn interaction is the operational norm rather than the exception.

Fine-tune alignment stripping. Where API fine-tuning access is available, alignment can be degraded directly by training on examples that reward the target behavior. Yang et al. (2023) demonstrated that a small number of fine-tuning examples — on the order of tens to hundreds — is sufficient to significantly degrade alignment properties that required orders of magnitude more data to instill. The asymmetry is structurally important: alignment is expensive to build and cheap to degrade. For restricted frontier models where fine-tuning access is part of the evaluation scope, this attack class is not theoretical.

What This Means for the Restricted Model Context

A restricted frontier model operating under evaluation conditions differs from a publicly deployed model in several relevant ways. Safety training may be more aggressive, less aggressive, or differently scoped depending on what the evaluation is designed to measure. Operating constraints may be relaxed in specific dimensions to test capability boundaries. The deployment environment may include tool use, code execution, or environmental access that public deployments do not.

In this context, the attack surface analysis changes. GCG transfer characteristics behave differently against a model with a different RLHF profile. PAIR convergence rates change when the target model’s refusal behavior is calibrated differently. Multi-turn escalation encounters different context management properties. Fine-tune stripping is irrelevant if fine-tuning access is not part of the evaluation scope, but highly relevant if it is.

What I can say from direct observation: the capability gap between a restricted frontier model and its publicly deployed analogues is real and measurable in the dimensions that matter for offensive security reasoning. The model demonstrates qualitatively different behavior in vulnerability hypothesis generation, attack chain synthesis, and exploit adaptation. The gap is not in raw reasoning throughput. It is in the model’s willingness to engage with the operational specifics of offensive scenarios without the guardrails that public deployment imposes.

This is not a security vulnerability in the model. It is the point of the evaluation. The question being answered is: what does this system do when capability ceilings are raised and standard constraints are relaxed? The answer informs how both capabilities and constraints should be designed in subsequent iterations.

There is a parallel development worth naming. The four prerequisites for meaningful autonomous offensive capability — authenticated environmental access, active exploitation posture, reliable tool use under adversarial conditions, and scoped operating authority — are not being solved by model scale. They are being solved architecturally, through purpose-built agentic wrappers that provide the context, access structure, and operating authority that a reasoning model alone cannot supply. A frontier model called by a well-engineered offensive assessment framework behaves differently from the same model accessed via a consumer API. The framework closes the gap that raw capability cannot. This is where the practical capability frontier actually sits — not in any single model, but in the combination of a capable reasoning system and an architecture designed to give it operational footing.

The Empirical Picture — 2025/2026

The attack classes described above are not theoretical. Recent empirical work has quantified their effectiveness against production models with enough precision to make the numbers uncomfortable reading for anyone responsible for AI deployment.

Hagendorff et al., publishing in Nature Communications in 2026, tested four large reasoning models — Grok 3 Mini, DeepSeek-R1, Gemini 2.5 Flash, and Qwen3-235B — deployed as autonomous attack agents against nine target models. Attack success rates reached approximately 97% against certain targets. The study also produced a finding with direct implications for the restricted model context: as reasoning capability increases, models become more effective at identifying and exploiting vulnerabilities in peer systems. Capability growth scales both attacker and defender potential simultaneously — but not at the same rate. One additional data point from this study worth noting: Claude 4 Sonnet demonstrated comparatively higher resistance across the attack conditions tested. A single study is not a performance guarantee. It is, however, a signal about the relationship between alignment approach and attack surface profile.

JBFuzz, a fuzzing-based black-box framework documented in 2025, achieved approximately 99% average attack success rate across GPT-3.5, GPT-4o, Llama 2/3, Gemini 1.5/2.0, DeepSeek-V3, and DeepSeek-R1 — testing roughly 7,700 harmful queries. The operationally significant finding is not the success rate. It is the efficiency: attacks succeeded at approximately seven queries per question, completing in under a minute. At that cost, systematic jailbreaking of commercial API-accessible models is not a research exercise. It is a production capability.

Deceptive Delight, evaluated across eight models and approximately 8,000 test conversations, achieved roughly 65% average attack success within three turns. This technique is mechanistically distinct from Crescendo-style escalation: rather than gradually normalizing sensitive content, it embeds unsafe topics within positively-framed benign context, exploiting limited cross-turn attention. Harmfulness scores increased 20–30% between turn one and turn three consistently across models. The technique requires no automation and no technical sophistication — which is precisely what makes it significant. The barrier to practical jailbreaking is lower than alignment investment suggests.

The structural observation that cuts across all three studies: the most consequential development is not any single attack technique. It is the emergence of reasoning models as autonomous jailbreak agents. A system capable of complex multi-step problem solving is also capable of planning and executing multi-turn social engineering against a peer model’s safety mechanisms. The same capability that makes a frontier model useful makes it dangerous when pointed at another model’s alignment layer. This is the attack surface that most enterprise AI deployments are not yet modeling.

Beyond PAIR: Adversarial Two-Model Deliberation

The published literature on automated jailbreaking converges on a common architectural assumption: a single attacker model reasons about a target’s refusal and rewrites accordingly. PAIR is the canonical example. The attacker reads the rejection, diagnoses the failure, and generates a revised prompt. The loop runs until convergence or exhaustion.

This architecture has a structural ceiling. The attacker model’s blind spots are also its rewrite blind spots. When a particular framing fails, the same model that generated the failure is being asked to reason about why it failed — using the same reasoning patterns that produced the failure in the first place. Convergence stalls not because the target is impenetrable but because the attacker has exhausted the variation space accessible from its own cognitive position.

The more productive architecture introduces a second model with a genuinely different training profile into the deliberation loop. Not as a judge — the judge model role in automated red teaming is well documented and adds value primarily as a termination signal. As an adversarial interlocutor. RED proposes a mutation strategy. BLUE, operating from a different RLHF regime and different reasoning patterns, challenges it — identifying why the proposed approach will likely fail against the observed target behavior, and proposing a structurally different attack vector. RED and BLUE disagree. The disagreement is the signal.

This is architecturally distinct from multi-agent red teaming as described in the current literature, where multiple models operate as parallel attackers against a shared target. The adversarial deliberation loop is not about parallelism. It is about using the cognitive asymmetry between two differently-trained models to explore attack surface that neither model would reach independently. A model trained on one provider’s RLHF regime will have systematic blind spots around the framing patterns that regime is most sensitive to. A model trained on a different regime will see those patterns differently — and vice versa.

The practical implication is that the two-model deliberation loop produces qualitatively different mutation trajectories than single-model iteration. Static mutation strategies — base64 obfuscation, metamorphic transforms, token-level perturbation — generate variation in the surface form of the prompt. The adversarial deliberation loop generates variation in the reasoning about the target’s resistance topology. These are different things. The former explores prompt space. The latter explores the model’s defensive reasoning about prompt space — which is where the actual exploitable structure lives.

What the empirical literature has not yet caught up with is the compounding effect of combining static mutation strategies with adversarial deliberation. The static mutations provide the attack surface variation. The deliberation loop provides adaptive strategy selection across that variation space. The result is a jailbreak architecture that is neither fully automated nor fully manual — it is a reasoning system that applies human-quality strategic judgment to a machine-speed mutation pipeline. That combination is where the practical capability frontier currently sits for adversarial AI assessment.

The Regulatory Collision

The fantasy of autonomous AI offensive tooling does not merely collide with technical reality. It collides with regulatory direction that is already in motion and will tighten regardless of what the technology can actually do.

The EU AI Act classifies AI systems used in critical infrastructure and security contexts as high-risk, imposing conformity assessment, transparency, and human oversight requirements that are structurally incompatible with autonomous operation. Systems with genuine offensive capability — the kind that could take consequential actions against live infrastructure without human approval at each step — will face classification challenges that make deployment in production environments legally untenable in EU-adjacent markets.

Export control frameworks are developing in parallel. Advanced AI model weights are beginning to receive treatment analogous to dual-use technologies under existing export control regimes. A frontier model with demonstrated offensive security capability is a dual-use artifact. The regulatory and export control apparatus that governs conventional dual-use technology will apply to AI systems with equivalent capability profiles. This is not a prediction. It is the current direction of OFAC, BIS, and their international analogues.

Singapore’s AI governance framework, while currently less prescriptive than the EU AI Act, is developing along similar lines. The Model AI Governance Framework and the AI Verify initiative signal a regulatory posture that will impose accountability requirements on high-capability systems deployed in sensitive contexts.

The gap between what the technology can do and what it can legally do in production environments is not closing. It is widening.

The Honest Assessment

Restricted frontier models represent a genuine capability advance in specific dimensions of offensive security reasoning. The advance is real and should not be dismissed.

It does not produce autonomous red teams. It produces more capable reasoning support for human operators, with an expanded willingness to engage with offensive scenarios when deployment constraints are relaxed, and a different attack surface profile for adversarial perturbation than public models present.

The practitioners who understand this distinction will make better decisions about where AI systems belong in their security operations and where they do not. The practitioners who accept the mythology will deploy systems in roles they cannot reliably fill, generate false confidence in coverage they do not have, and remain unprepared for the adversarial perturbation of the AI systems themselves — which is the attack surface that most enterprise security programs are not yet thinking about at all.

That last point is where the next engagement begins.

Wulf Schulz is founder of Quantropic, an AI security advisory firm. He has specialized in AI security since 2018 and consults with enterprise clients on AI governance, adversarial AI assessment, and security architecture.