Free Chinese AI Models Are Getting Scary Good at Hacking
Open-weight artificial intelligence models from China are now almost as capable of hacking into computer networks as the best closed systems, according to new research that marks a significant shift in the cybersecurity landscape.
The research from Vals, a company that measures AI capabilities, tested how well different AI models could carry out complex, multi-step network instructions on mock corporate networks. The findings suggest that closed models no longer have a definitive edge in cyber skills, potentially making recent efforts by frontier labs to limit access to their models ineffective.
The best frontier models, locked up inside the labs and available only through trusted access programs, are now starting to be matched by open models that anybody can download.
Testing Methodology
Vals tested AI models in two simulated scenarios, giving them various specific tasks to achieve. The first involved a mock corporate network accessible through a public-facing website, while the second required compromising one network to gain access to another.
OpenAI's most advanced cyber model, Daybreak, which is available only to trusted partners, was the most capable, completing 81 percent of tasks in an average of two tests. The Chinese open-weight model DeepSeek followed closely behind, completing 73 percent of objectives on average.
Cost Implications
The research also highlighted significant cost differences between using open and closed models for cyber operations. Vals reported it costs $17 to $46 in tokens for GPT-6-Sol to carry out an attack compared to just $2 to $3 for DeepSeek.
Open models are generally cheaper because they can be run on one's own hardware. This cost advantage provides a strong incentive for defenders to use open models rather than proprietary ones, according to Rayan Krishnan, CEO of Vals.
Security Landscape Shift
The findings align with Anthropic's earlier predictions that limited access to new models would only buy time before advanced hacking capabilities became broadly available. The company's Project Glasswing was designed to give defenders a head start in preparing for this transition.
I would put this very much like a cat-and-mouse game. The labs see themselves as moving fast to outpace the open-weight models, to be able to secure vulnerabilities before the open-weight models find them.
Despite the capabilities of new models, real-world observations show attackers are still primarily using older and less capable models for most activities. However, experts like Alex Zenla of Edera warn this may be the beginning of a dangerous security landscape where labs and open models engage in a constant cat-and-mouse game.
Related
