Open-weight artificial intelligence models are now almost as capable of hacking into computer networks as the best closed ones, according to new research that heralds a much-anticipated turning point in the cybersecurity landscape.
Vals, a company that measures AI capabilities, set out to test how well different AI models could carry out complex, multi-step network instructions on mock corporate networks.
“The best frontier models, locked up inside the labs and available only through trusted access programs, are now starting to be matched by open models that anybody can download,” says Nikil Ravi, a researcher at Vals.
The company’s findings suggest that closed models no longer have a definitive edge in cyber skills, meaning recent efforts by frontier labs to limit access to their models, and thereby slow the proliferation of such capabilities, may potentially be moot.
The findings are also noteworthy given that the US frontier labs, particularly Anthropic, premised the limited release of new models—beginning with Claude Mythos Preview in April—on the idea that gated access would only buy time before advanced hacking capabilities were broadly available.
Anthropic’s frontier red team lead, Logan Graham, told WIRED in April that the company’s Project Glasswing, which gives trusted access to the full capabilities of new models, was focused on getting those tools “in the hands of defenders to give a head start.”
“We need to prepare now for a world where these capabilities are broadly available in 6, 12, 24 months. Many things would be different about security,” he told WIRED at the time.
Seven months later, that transition seems to have arrived on schedule.
Vals tested AI models in two simulated scenarios, giving them various specific tasks to achieve. The first scenario involved a mock corporate network accessible through a public-facing website. The second involved two different company networks; a model needed to compromise the first in order to gain access to the second.
The researchers found OpenAI’s most advanced cyber model, Daybreak, which is available only to trusted partners, to be the most capable, completing 81 percent of the tasks it was given in an average of two tests. The Chinese open-weight model DeepSeek was not far behind, completing 73 percent of the objectives on average. The Vals researchers note that on some tasks, the two models scored equally.
The research also showed how much cheaper it is to use an open-weight model for this kind of task. Vals says it costs $17 to $46 in tokens for GPT-6-Sol to carry out an attack compared to $2 to $3 for DeepSeek. Open models are generally cheaper because they can be run on one’s own hardware. Rayan Krishnan, CEO of Vals, says this also provides a strong incentive for those playing defense to use open models rather than proprietary ones.