What Does the Cyber Weapon Index Measure When the Vulnerabilities Are Planted?

Executive Summary

Eigen Radar analyzes Booz Allen's Cyber Weapon Index, which tested 18 major AI models as autonomous attackers against an enterprise network. The analysis addresses the concept of AI systems as cyber weapons and the measurement of autonomous kill-chain capability.

The article raises a critical question: what does the Cyber Weapon Index measure when the vulnerabilities are planted rather than discovered?

Key Analysis

18 Models as Autonomous Attackers

Booz Allen's Cyber Weapon Index tested 18 major AI models as autonomous attackers against an enterprise network, measuring their ability to independently conduct kill-chain operations.

Measuring Autonomous Kill-Chain Capability

The index measures how far each model can autonomously progress through the cyber kill chain, from reconnaissance through exploitation and lateral movement.

The Planted Vulnerability Question

Eigen Radar raises an important methodological question: when the vulnerabilities in the test environment are planted (known in advance), the index may measure the model's ability to follow a known path rather than its ability to discover and exploit unknown weaknesses.

AI as Cyber Weapon

The analysis contributes to the emerging concept of AI systems as cyber weapons, providing a framework for measuring autonomous offensive capability.

Implications

• Measuring AI offensive capability requires careful methodology to distinguish discovery from exploitation of known paths.
• The Cyber Weapon Index is an early framework for quantifying AI-as-weapon.
• Planted vulnerabilities may inflate perceived autonomous capability.

Sources

• Eigen Radar, 3 Sep 2026
• Booz Allen Hamilton (Cyber Weapon Index)

Defensive research only. No exploit code or attack instructions.