Open-weight AI models nearly match closed labs at hacking

Open-weight AI models have nearly caught up to the best closed models at breaking into computer networks, according to new testing from Vals, a company that measures AI capabilities. The firm put a range of models through multi-step hacking tasks on mock corporate networks to see how far the gap had narrowed. It has narrowed a lot.

In the tests, OpenAI's top cyber model, Daybreak — available only to trusted partners — came first, completing 81 percent of its assigned tasks on average across two runs, according to Vals. Chinese open-weight model DeepSeek was close behind at 73 percent, and on some tasks the two scored identically. The price gap is even starker: Vals says an attack costs roughly $17 to $46 in tokens with GPT-6-Sol, versus just $2 to $3 with DeepSeek, since open models can run on your own hardware.

That price tag matters for both sides. Vals CEO Rayan Krishnan says the cost advantage gives defenders a strong reason to reach for open models instead of proprietary ones. OpenAI did not immediately respond to a request for comment, WIRED reported.

The timing lands right where Anthropic predicted. The company began gating new models with Claude Mythos Preview in April, betting that restricted access would only buy time before advanced hacking skills spread widely. Logan Graham, who leads Anthropic's frontier red team, told WIRED then that its Project Glasswing trusted-access program aimed to get the tools into defenders' hands for a head start — and warned the industry needed to prepare for broad availability in 6, 12 or 24 months. Seven months on, per Vals, that world has essentially arrived.

Nikil Rav, a researcher at Vals, says the frontier models locked inside labs and handed out only through trusted programs are now being matched by models anyone can download. That undercuts the premise behind the labs' careful release strategies, since gated access no longer looks like it buys much distance.

Not everyone is declaring a new era just yet. Real-world tracking of criminal and state-backed hacking has shown attackers mostly sticking with older, cheaper models and conserving resources, and defenders have to assume well-funded groups already had some closed-model access. Alex Zenla, cofounder and CTO of cloud security firm Edera, tells WIRED he agrees open-weight models can produce advanced attacks today, especially modified versions with safety training stripped out — but suspects closed labs have unreleased models that go further. He calls it a cat-and-mouse game, and warns it may be the start of a dangerous security landscape.