Free Chinese AI Models Are Getting Scary Good at Hacking

Open-weight AI models are now almost as capable of hacking into computer networks as the best closed models, according to new research from Vals. The company tested models on mock corporate networks and found DeepSeek close to OpenAI's Daybreak, suggesting that efforts to limit access may not slow the spread of such capabilities.

Simulated networks show a narrow gap

Vals, a company that measures AI capabilities, tested models on two mock corporate network scenarios. The first involved a network accessible through a public-facing website. The second involved two company networks, where a model had to compromise the first to reach the second. OpenAI's Daybreak, available only to trusted partners, completed 81 percent of tasks in an average of two tests. The Chinese open-weight model DeepSeek completed 73 percent on average, and the two models scored equally on some tasks. "The best frontier models, locked up inside the labs and available only through trusted access programs, are now starting to be matched by open models that anybody can download," says Nikil Ravi, a researcher at Vals. Vals says closed models no longer have a definitive edge in cyber skills, so recent efforts by frontier labs to limit access may be moot.

Cost and incentives for defenders

The research also showed how much cheaper open-weight models can be for this kind of task. Vals says it costs $17 to $46 in tokens for GPT-6-Sol to carry out an attack, compared with $2 to $3 for DeepSeek. Open models are generally cheaper because they can be run on one's own hardware. Rayan Krishnan, CEO of Vals, says this gives a strong incentive for defenders to use open models rather than proprietary ones. OpenAI did not immediately respond to a request for comment.

From gated access to a broader threat

The findings are noteworthy because US frontier labs, particularly Anthropic, premised limited releases, beginning with Claude Mythos Preview in April, on gated access buying time before advanced hacking capabilities were broadly available. Anthropic frontier red team lead Logan Graham told WIRED in April that Project Glasswing gives trusted access to full model capabilities and was focused on getting tools "in the hands of defenders to give a head start." He said capabilities would be broadly available in 6, 12, 24 months; seven months later, that transition seems to have arrived on schedule. Much of the year has played out as predicted, with AI automating core hacking tasks for attackers and defenders, finding many new vulnerabilities and probing networks. The speed and scale of findings, and the intensity of fixing uncovered flaws, have increased. Experts still debate whether AI has fundamentally changed cybersecurity or amplifies long-standing challenges. Open-weight models matching closed ones is crucial for understanding how criminal hackers can use AI and how companies should respond. In practice, attackers often conserve resources and use older, less capable models. Defenders must assume that well-funded, highly motivated attackers may already have had some access to closed models. Alex Zenla, cofounder and CTO of Edera, said open-weight models can produce advanced attacks today, especially abliterated models that disable safety training by modifying weights, but closed labs may have unreleased models with greater capabilities, making it a cat-and-mouse game.

Sources: Wired