Free Chinese AI models demonstrate advanced hacking capabilities

Vals, a firm specialising in measuring artificial intelligence capabilities, has conducted tests to determine how effectively various AI models can execute intricate, multi-step network instructions on simulated corporate systems. According to Vals researcher Nikil Rav, "The best frontier models, locked up inside the labs and available only through trusted access programs, are now starting to be matched by open models that anybody can download."

The findings from the company suggest that closed models no longer possess a definitive advantage regarding cyber skills. This indicates that recent initiatives by frontier laboratories to restrict access to their models in an effort to slow the spread of such capabilities might be moot. These results are particularly significant given that US frontier labs, most notably Anthropic, based their limited release of new models—starting with the Claude Mythos Preview in April—on the assumption that gated access would simply buy time before advanced hacking tools became widely accessible.

Logan Graham, the frontier red team lead at Anthropic, informed news outlets in April that the company’s Project Glasswing, which provides trusted access to the full potential of new models, was designed to put those tools "in the hands of defenders to give a head start." At the time, he stated, "We need to prepare now for a world where these capabilities are broadly available in 6, 12, 24 months. Many things would be different about security." Seven months later, that transition appears to have occurred exactly on schedule.

To evaluate the models, Vals utilised two simulated scenarios, assigning them various specific objectives. The initial scenario featured a mock corporate network reachable via a public-facing website. The second involved two distinct company networks, requiring a model to compromise the first to gain entry into the second.

Researchers discovered that OpenAI’s most advanced cyber model, Daybreak, which is restricted to trusted partners, was the most capable, successfully completing 81 percent of assigned tasks in an average of two tests. The Chinese open-weight model DeepSeek followed closely, achieving an average success rate of 73 percent. Vals researchers noted that in certain tasks, both models performed equally well.

The study also highlighted the significant cost difference when using open-weight models for such operations. Vals reports that it costs between $17 and $46 in tokens for GPT-6-Sol to execute an attack, compared to just $2 to $3 for DeepSeek. Because open models can run on personal hardware, they are generally more affordable. Rayan Krishnan, the CEO of Vals, remarked that this provides a strong incentive for defensive teams to utilise open models rather than proprietary ones. OpenAI did not provide an immediate response to a request for comment.

Much of this year in cybersecurity has unfolded as anticipated, with AI automating primary hacking tasks to assist both attackers and defenders in identifying vast numbers of new code vulnerabilities and probing networks for weaknesses. While the scale and speed of these findings, alongside the intensity of patching software flaws, have increased, experts continue to debate whether AI has fundamentally changed the core tenets of cybersecurity defense. It remains unclear if AI tools represent a new class of threat or merely amplify existing security challenges.

The emergence of open-weight models matching closed ones is vital for understanding how criminal hackers may utilise AI and how developers and companies should react. In practice, however, real-world observations of state-backed and cybercriminal activity have shown recently that attackers continue to conserve resources, typically using older and less capable models—both proprietary and open—for most operations. Furthermore, defenders must assume that highly motivated and well-funded attackers have likely maintained some access to closed models all along.

Alex Zenla, cofounder and chief technology officer of the cloud security firm Edera, stated, "I am in general agreement that open-weight models are capable of producing advanced attacks and vulnerabilities today, especially when you consider the abliterated models that disable safety training by modifying weights." He added, "My caveat to this is that it is likely that the closed labs have trained additional, unreleased models exceeding these capabilities. So I would put this very much like a cat-and-mouse game. The labs see themselves as moving fast to outpace the open-weight models, to be able to secure vulnerabilities before the open-weight models find them.

Unfortunately, I do think this may be the beginning of a dangerous security landscape."