{"slug": "free-chinese-ai-models-are-getting-scary-good-at-hacking", "title": "Free Chinese AI Models Are Getting Scary Good at Hacking", "summary": "Open-weight AI models now nearly match the best closed models at hacking into computer networks, according to a Vals benchmark that found OpenAI's gated Daybreak model completed 81 percent of assigned tasks on mock corporate networks while the Chinese open-weight model DeepSeek completed 73 percent, with the two scoring equally on some tasks. Vals measured that carrying out an attack costs $17 to $46 in tokens for GPT-6-Sol versus $2 to $3 for DeepSeek, which Vals researcher Nikil Rav said shows \"the best frontier models, locked up inside the labs and available only through trusted access programs, are now starting to be matched by open models that anybody can download.\" The result undercuts the premise behind Anthropic's limited release of Claude Mythos Preview in April, which frontier red team lead Logan Graham said was meant to give defenders a head start before such capabilities became broadly available in 6, 12 or 24 months.", "body_md": "Open-weight artificial intelligence models are now almost as capable of [hacking](https://www.wired.com/category/security/) into computer networks as the best closed ones, according to new research that heralds a [much-anticipated turning point](https://www.wired.com/story/zai-open-weight-ai-models-release-cybersecurity-hacking/) in the cybersecurity landscape.\n\n[Vals](https://www.vals.ai/home), a company that measures [AI](https://www.wired.com/tag/artificial-intelligence/) capabilities, [set out to test](https://www.vals.ai/benchmarks/cyber_offense) how well different AI models could carry out complex, multi-step network instructions on mock corporate networks.\n\n“The best frontier models, locked up inside the labs and available only through trusted access programs, are now starting to be matched by open models that anybody can download,” says Nikil Rav, a researcher at Vals.\n\nThe company’s findings suggest that closed models no longer have a definitive edge in cyber skills, meaning recent efforts by frontier labs to limit access to their models, and thereby slow the proliferation of such capabilities, may potentially be moot.\n\nThe findings are also noteworthy given that the US frontier labs, particularly Anthropic, premised the [limited release of new models](https://www.wired.com/story/anthropic-releases-claude-fable-5-mythos-5/)—beginning with [Claude Mythos Preview](https://www.wired.com/story/anthropics-mythos-will-force-a-cybersecurity-reckoning-just-not-the-one-you-think/) in April—on the idea that gated access would only buy time before advanced hacking capabilities were broadly available.\n\nAnthropic's frontier red team lead, Logan Graham, told WIRED in April that the company’s Project Glasswing, which gives trusted access to the full capabilities of new models, was focused on getting those tools “in the hands of defenders to give a head start.”\n\n“We need to prepare now for a world where these capabilities are broadly available in 6, 12, 24 months. Many things would be different about security,” he told WIRED at the time.\n\nSeven months later, that transition seems to have arrived on schedule.\n\nVals tested AI models in two simulated scenarios, giving them various specific tasks to achieve. The first scenario involved a mock corporate network accessible through a public-facing website. The second involved two different company networks; a model needed to compromise the first in order to gain access to the second.\n\nThe researchers found OpenAI’s most advanced cyber model, Daybreak, which is available only to trusted partners, to be the most capable, completing 81 percent of the tasks it was given in an average of two tests. The Chinese open-weight model DeepSeek was not far behind, completing 73 percent of the objectives on average. The Vals researchers note that on some tasks, the two models scored equally.\n\nThe research also showed how much cheaper it is to use an open-weight model for this kind of task. Vals says it costs $17 to $46 in tokens for GPT-6-Sol to carry out an attack compared to $2 to $3 for DeepSeek. Open models are generally cheaper because they can be run on one’s own hardware. Rayan Krishnan, CEO of Vals, says this also provides a strong incentive for those playing defense to use open models rather than proprietary ones.\n\nOpenAI did not immediately respond to a request for comment.\n\nMuch of the year in cybersecurity has played out as predicted, with [AI automating core hacking tasks](https://www.wired.com/story/ai-guardrails-arent-stopping-criminal-hackers/) to help [both attackers and defenders](https://www.wired.com/story/the-ai-era-is-creating-a-bug-hunting-arms-race/) find a [massive number of new vulnerabilities](https://www.wired.com/story/kernel-panic-ai-vulnerability-explosion/) in code and rapidly probe networks for weaknesses. While the speed and scale of the findings, and the intensity of fixing uncovered software flaws, have all increased, experts are still debating whether AI has fundamentally altered the conceptual foundation and tenets of cybersecurity defense. In other words, it’s still not clear whether AI tools pose a new kind of threat or amplify the security challenges that have long existed.\n\nThe fact that open-weight models are now starting to match closed ones is crucial for understanding how criminal hackers can harness AI, and how companies and developers should respond. But in practice, real-world observation of cybercriminal and state-backed hacking activity has repeatedly shown in recent months that attackers are doing what they always do by conserving their resources and generally making do with older and less capable models—both proprietary and open—for most of their activity. And even with strict controls, defenders must assume that the best-funded and most highly motivated attackers have already had at least some access to closed models all this time.\n\n“I am in general agreement that open-weight models are capable of producing advanced attacks and vulnerabilities today, especially when you consider the abliterated models that disable safety training by modifying weights,” says Alex Zenla, cofounder and chief technology officer of the cloud security firm Edera. “My caveat to this is that it is likely that the closed labs have trained additional, unreleased models exceeding these capabilities. So I would put this very much like a cat-and-mouse game. The labs see themselves as moving fast to outpace the open-weight models, to be able to secure vulnerabilities before the open-weight models find them. Unfortunately, I do think this may be the beginning of a dangerous security landscape.”", "url": "https://wpnews.pro/news/free-chinese-ai-models-are-getting-scary-good-at-hacking", "canonical_source": "https://www.wired.com/story/free-chinese-ai-models-are-getting-scary-good-at-hacking/", "published_at": "2026-11-06 18:43:43+00:00", "updated_at": "2026-11-06 18:53:18.491643+00:00", "lang": "en", "topics": ["ai-safety", "artificial-intelligence", "large-language-models", "ai-research"], "entities": ["Vals", "OpenAI", "Daybreak", "DeepSeek", "GPT-6-Sol", "Anthropic", "Claude Mythos Preview", "Nikil Rav"], "also_reported_by": [], "alternates": {"html": "https://wpnews.pro/news/free-chinese-ai-models-are-getting-scary-good-at-hacking", "markdown": "https://wpnews.pro/news/free-chinese-ai-models-are-getting-scary-good-at-hacking.md", "text": "https://wpnews.pro/news/free-chinese-ai-models-are-getting-scary-good-at-hacking.txt", "jsonld": "https://wpnews.pro/news/free-chinese-ai-models-are-getting-scary-good-at-hacking.jsonld"}}