DeepSeek nearly matches OpenAI's Daybreak in hacking tests, Vals finds

Open-weight AI models are now almost as capable of hacking into computer networks as the best closed ones, according to new research reported by Wired. Vals, a company that measures AI capabilities, set out to test how well different models could carry out complex, multi-step network instructions on mock corporate networks.

Vals used two simulated scenarios and gave the models specific tasks to achieve. In the first, a mock corporate network was reachable through a public-facing website. In the second, there were two different company networks, and a model had to compromise the first to gain access to the second.

OpenAI's most advanced cyber model, Daybreak, which is available only to trusted partners, was the most capable. It completed 81 percent of the tasks it was given, averaged over two tests. The Chinese open-weight model DeepSeek was not far behind, completing 73 percent of the objectives on average. The Vals researchers note that on some tasks the two models scored equally.

Cost differed sharply. Vals says it costs $17 to $46 in tokens for GPT-6-Sol to carry out an attack, compared with $2 to $3 for DeepSeek. Open models are generally cheaper because they can be run on one's own hardware. Rayan Krishnan, CEO of Vals, says this gives those playing defense a strong incentive to use open models rather than proprietary ones. Nikil Ravi, a researcher at Vals, put the finding this way: the best frontier models, locked up inside the labs and available only through trusted access programs, are now starting to be matched by open models anyone can download.

Wired reads the results as a sign that closed models no longer have a definitive edge in cyber skills, so recent efforts by frontier labs to limit access, and so slow the spread of such capabilities, may potentially be moot. US labs, particularly Anthropic, premised the limited release of new models, beginning with Claude Mythos Preview in April, on the idea that gated access would only buy time before advanced hacking capabilities were broadly available. Anthropic's frontier red team lead, Logan Graham, told Wired in April that the company's Project Glasswing, which gives trusted access to the full capabilities of new models, was focused on getting those tools "in the hands of defenders to give a head start." He added: "We need to prepare now for a world where these capabilities are broadly available in 6, 12, 24 months." Seven months later, Wired says, that transition seems to have arrived on schedule.

The article adds context. AI has automated core hacking tasks this year, helping both attackers and defenders find a massive number of new code vulnerabilities and probe networks quickly, yet experts still debate whether AI has changed the foundations of cybersecurity defense or only amplified old challenges. In practice, recent observation of cybercriminal and state-backed activity shows attackers conserving resources and mostly making do with older, less capable models, both proprietary and open. Defenders must also assume the best-funded and most motivated attackers have already had some access to closed models.

Alex Zenla, cofounder and chief technology officer of the cloud security firm Edera, broadly agrees that open-weight models can produce advanced attacks and vulnerabilities today, especially abliterated models that disable safety training by modifying weights. Her caveat is that closed labs have likely trained additional, unreleased models that exceed these capabilities. She calls it a cat-and-mouse game and says this may be the beginning of a dangerous security landscape. OpenAI did not immediately respond to a request for comment.

Key facts

In Vals' simulated network-attack tests, OpenAI's trusted-partner-only Daybreak completed 81 percent of tasks (average of two tests); the open-weight Chinese model DeepSeek completed 73 percent of objectives on average.
Vals says an attack costs $17 to $46 in tokens for GPT-6-Sol versus $2 to $3 for DeepSeek.
Wired reads the results as a sign that closed models no longer have a definitive edge in cyber skills, which may potentially make gated-access policies moot.
Anthropic's Logan Graham warned in April of a world where these capabilities are broadly available in 6, 12, 24 months; Wired says that shift seems to have arrived seven months later.
In practice, attackers still mostly use older, less capable models, and Edera's Alex Zenla notes closed labs likely hold unreleased stronger models.

Why it matters

Frontier labs, particularly Anthropic, limited releases such as Claude Mythos Preview on the premise that gated access would only buy time before advanced hacking capabilities spread. Vals' results, as Wired reports them, suggest that window is closing: a freely downloadable Chinese model came within 8 percentage points of the best gated cyber model from OpenAI (73 versus 81 percent) at a small fraction of the token cost. That bears on whether restricting access to top models can still slow the proliferation of hacking skills.

Who it affects

Defenders and security teams, who per Vals' CEO now have a strong incentive to use cheaper open models. Frontier labs running trusted-access programs such as Project Glasswing, whose gating strategy is questioned by the findings. Companies and developers deciding how to respond to AI-assisted attacks. Wired also says the finding is crucial for understanding how criminal hackers can harness AI.

How to use it

Krishnan says the low cost gives defenders a reason to use open models rather than proprietary ones, since open models can be run on your own hardware. The $2 to $3 per attack figure for DeepSeek, against $17 to $46 for GPT-6-Sol, is the cost comparison Vals offers. The article gives no setup guidance beyond this.

How solid is it

The reporting is Wired's account of Vals' research; Vals measures AI capabilities and the quotes come from its researcher Nikil Ravi and CEO Rayan Krishnan. The 81 and 73 percent figures are task and objective completion rates in simulated networks, not real-world attack success rates. The article does not give the specific DeepSeek model or version tested, and does not state how many tasks or tests were run beyond an average of two tests for Daybreak. No score is given for GPT-6-Sol, only its cost range. The article does not say when the Vals research was published or link to a report. OpenAI had not responded to a request for comment.

Risks and caveats

Zenla notes that closed labs have likely trained unreleased models stronger than these, which is her opinion rather than a verified fact, and she calls the situation a cat-and-mouse game. Wired stresses that real attackers mostly use older, less capable models, and that it remains unclear whether AI poses a new kind of threat or amplifies long-standing ones. Defenders must also assume well-funded attackers have already had some access to closed models. Zenla adds that abliterated models, which disable safety training by modifying weights, make open models more dangerous, and that this may be the beginning of a dangerous security landscape.

“The best frontier models, locked up inside the labs and available only through trusted access programs, are now starting to be matched by open models that anybody can download.”

— Nikil Ravi, researcher at Vals