Free Chinese AI Models Are Getting Scary Good at Hacking

AI capability firm Vals tested how well different models could execute complex, multi-step instructions against simulated corporate networks, and found that open-weight models are closing in on the best closed systems. "The best frontier models, locked up inside the labs and available only through trusted access programs, are now starting to be matched by open models that anybody can download," said Vals researcher Nikil Rav. The results suggest closed models no longer hold a definitive edge in cyber skills.

The company ran two scenarios: one involving a mock corporate network reachable through a public-facing website, and another requiring a model to compromise one company's network to reach a second. OpenAI's most advanced cyber model, Daybreak — available only to trusted partners — topped the leaderboard, completing 81 percent of tasks in an average of two runs. DeepSeek, the Chinese open-weight model, followed at 73 percent, with the two scoring equally on some tasks.

Cost may matter as much as capability. Vals estimates a GPT-6-Sol attack consumes $17 to $46 in tokens, versus $2 to $3 for DeepSeek. Because open models can run on a user's own hardware, Vals CEO Rayan Krishnan argues that defenders have a strong incentive to favor them over proprietary options.

The findings land amid a shifting release philosophy at US frontier labs. Anthropic began gating new models with Claude Mythos Preview in April, premised on the idea that restricted access would buy time before advanced hacking capabilities spread widely. Anthropic frontier red team lead Logan Graham said the company's Project Glasswing — which grants trusted access to full model capabilities — was about getting tools "in the hands of defenders to give a head start." He added that teams must prepare for a world where such capabilities are broadly available in 6, 12 or 24 months.

Cybersecurity's year has largely tracked predictions, with AI automating core hacking tasks, surfacing large numbers of code vulnerabilities, and accelerating the pace of both probing and patching. Yet experts still disagree over whether AI has changed the conceptual foundations of defense or simply amplified long-standing challenges. Real-world observation adds a counterweight: attackers, both criminal and state-backed, have repeatedly stuck to older, less capable models to conserve resources. And even with strict controls, defenders should assume well-funded adversaries have already had some access to closed models.

What to watch is whether the cost gap pushes more offensive and defensive workloads onto open-weight models, and whether labs' gating strategies hold up as downloadable alternatives keep improving. The open question is whether AI constitutes a genuinely new threat class or an accelerant on existing ones — and how quickly defenders can adapt either way.