New Benchmark Finds Every Major AI Model Fails to Catch Silent Cyber Intrusions on Its Own

Twenty-three of the world's most capable AI models were handed compromised computer systems and asked to do what a human incident responder does every day: figure out what happened, find the intruder, and fix it. None of them could.

That's the finding of SecRespond, a benchmark published July 29, 2026 by researchers at Alibaba-NLP, according to Tech Times. It's described as the first evaluation framework built specifically around the post-compromise phase of cybersecurity, the messy part that happens after an attacker is already inside.

The setup mattered as much as the result. Researchers ran ten simulated cloud host investigations based on real-world breaches. Critically, the AI agents weren't given an alert pointing to the problem. They had to go find it themselves, the way a real intruder wouldn't announce their presence with a flashing warning light.

Across all ten scenarios and all 23 models, not one produced a complete result: full detection of the intrusion, a verified remediation plan, and a closed case. According to Tech Times, when there's no alert to chase, every frontier model tested comes up short.

Why This Gap Matters More Than It Sounds

Most existing AI security benchmarks, including CyberGym and ExploitGym, test something different: whether an AI can find a vulnerability in a clean, idealized system before an attacker does. That's a legitimate question, but it's not the question incident responders deal with.

Digital forensics and incident response, the professional discipline SecRespond is modeled on, starts from the opposite premise. The attacker is already there. The job isn't spotting a weakness in advance, it's reconstructing what already went wrong. SecRespond is the first benchmark, per Tech Times, to actually measure that skill directly, and the answer it returned across the board was no.

The timing gives the finding teeth. The AI security operations center market is projected to grow from $18.10 billion in 2026 to $47.07 billion by 2031, according to estimates from MarketsandMarkets cited by Tech Times. Companies have been buying AI-assisted incident response tools on the premise that those tools can handle autonomous investigation once something goes wrong. SecRespond is the first hard data testing that premise, and it says the premise doesn't hold yet.

AI agents reportedly do a credible job when pointed at a known alert and asked to chase it down. The failure specifically shows up in the harder, unprompted case: finding an intrusion nobody's detection system flagged in the first place. The crucial difference is that sophisticated attackers don't trip alarms. They're quiet by design. A tool that only performs well when the alarm already went off isn't solving the problem enterprises are paying for.

A Broader Pattern of AI Hitting Walls on Deep, Unstructured Reasoning

SecRespond isn't an isolated data point. A separate benchmark called Reconstruction, detailed in an arXiv preprint dated August 18, 2026 and covered by aigc.news, tested whether language models can recover the actual research idea behind a published scientific paper using only that paper's pre-publication bibliography, with the paper itself and all later citing work stripped out.

Across six scientific domains and 643 papers, seven frontier models managed Match rates of only about 3 to 15%, according to aigc.news. A multi-agent pipeline that ran cross-model review and a tournament-style selection process pushed that up to 23 to 42%, a 2.4x improvement over any single model, but still far from reliable. Today's frontier models are strong at narrow, well-defined tasks with a clear target, and weak at open-ended reconstruction where they have to infer the missing piece themselves, whether that's a hidden attacker or an unstated research hypothesis.

Regulators Are Moving on a Different Front Entirely

While benchmarks expose what AI can't reliably do yet, regulators are focused on what it can already do too well: generate convincing fake media. California's AI Transparency Act became operative August 2, 2026, the same day most of the EU AI Act's Article 50 transparency duties began applying, according to ComplexDiscovery. Generative AI providers with over 1 million monthly users now must offer a free detection tool and support visible labeling for AI-generated image, video and audio, with penalties of $5,000 per violation and each day counting as a separate violation.

Governor Gavin Newsom signed the amendment, AB 853, on October 13, 2025, deliberately shifting the operative date from January 1, 2026 to August 2, 2026 specifically to align with the EU's schedule, according to attorneys A.J. Bahou and Eric J. Stocking of Bradley Arant Boult Cummings, as reported by ComplexDiscovery. A platform-level ban on stripping provenance data from AI content doesn't take effect until January 1, 2027, with rules for capture devices following in 2028.

The two stories sit side by side but point in opposite directions. One shows AI systems still can't reliably find a hidden intruder without help. The other shows regulators racing to label AI-generated content before it fools anyone. Enterprises betting security budgets on autonomous AI defenders now have a benchmark telling them exactly where that bet is weakest, and it's the part of the job—quiet, undetected compromise—where the stakes are highest.