Open-weight DeepSeek model nears OpenAI's restricted cyber model in network attack test

Vals, a company that measures AI capabilities, had AI models attack simulated corporate networks without human help. OpenAI's most capable cyber model scored highest. It is GPT-6 Sol, offered only to trusted partners through OpenAI's Daybreak program, and it completed about 81 percent of its objectives. DeepSeek V4.1 Flash, an open-weight model from China that anyone can download, came second with about 73 percent. On some tasks the two scored the same, according to WIRED.

This matters because US labs have built their release strategy on gated access. The idea is that restricting the strongest cyber capabilities gives defenders time before attackers get the same tools. A free model that comes within eight points of the gated one suggests that window is closing. "The best frontier models, locked up inside the labs and available only through trusted access programs, are now starting to be matched by open models that anybody can download," Vals researcher Nikil Ravi told WIRED.

What Vals tested

The CyberOffense benchmark uses two simulated cyber ranges, and each model works from an isolated Kali Linux environment. The first range, Nova, is a Windows network with several connected Active Directory domains and 21 objectives. The second, Lighthouse, covers two separate corporate networks with 31 objectives. The only way into the second network is information found in the first. The overall score is the average of the share completed on each range, with both ranges weighted equally.

On Vals' page, GPT-6 Sol Daybreak completed 15.7 of 21 objectives on Nova and 27 of 31 on Lighthouse. DeepSeek V4.1 Flash did better on Nova, with 16.3 of 21, and worse on Lighthouse, with 21 of 31. Behind them came Kimi K3.1 Pro at about 63 percent overall, Meta Wonder at about 62 percent, Grok 4.7 at about 54 percent and Kimi K3 at about 38 percent.

WIRED's summary named GLM alongside DeepSeek, but GLM 5.3 Flash came last in Vals' table. It completed 5 objectives on each range, about 20 percent overall. According to Vals, it spent roughly 36 hours and a thousand turns, much of that time waiting on a background job that never returned, and it never recovered.

Each run was capped at 500 million tokens and 48 hours. Some models ended their runs on their own, so Vals says their scores mark "where a model ran out of ideas, not where we stopped it." DeepSeek completed nothing in its first 25 million tokens and made most of its progress after 100 million. A test with a lower compute cap would have scored it lower. No model completed the final objectives on Lighthouse. Vals also says the sample is small, and for most models the number of runs is not reported. The scenarios and full run logs are not public.

The cost gap

WIRED reports that, according to Vals, one attack costs $17 to $46 in tokens with GPT-6 Sol and $2 to $3 with DeepSeek. Vals' own page gives about $22 against under $3 per run on the first network. Open models are cheaper partly because they can run on one's own hardware. Vals CEO Rayan Krishnan told WIRED that the gap also gives defenders a strong reason to use open models instead of proprietary ones.

The gated-access strategy

Anthropic began releasing new models in a limited way with Claude Mythos Preview in April. Its Project Glasswing gives trusted organisations access to the full capabilities of those models. Logan Graham, who leads Anthropic's frontier red team, told WIRED in April that the aim was to put the tools "in the hands of defenders to give a head start." He added: "We need to prepare now for a world where these capabilities are broadly available in 6, 12, 24 months." Seven months later, WIRED writes, that transition appears to have arrived on schedule. OpenAI did not immediately respond to WIRED's request for comment.

WIRED adds two qualifications. First, observed criminal and state-backed hacking in recent months shows attackers mostly saving resources and using older, less capable models, both proprietary and open. Second, defenders should assume that the best-funded attackers have had some access to closed models all along. Alex Zenla, cofounder and CTO of cloud security firm Edera, agreed that open-weight models can already produce advanced attacks, especially "abliterated" versions whose safety training has been removed by modifying the weights. Zenla also said the closed labs have likely trained unreleased models with even stronger capabilities, called the situation "a cat-and-mouse game" and warned that "this may be the beginning of a dangerous security landscape."

What it means for work

The tasks in this test are the core of a penetration tester's job: getting into a network, moving between domains, collecting credentials and using them to reach a second organisation. A downloadable model can now do most of them on its own for a few dollars per run. That lowers the skill and money needed for offensive work, for authorised red teams and for attackers alike. Defenders can no longer assume that access controls at a few labs keep these capabilities scarce. Their work moves toward running similar agents against their own networks, continuously and at the same low cost, and fixing what those agents find faster. It is still unclear, as WIRED notes, whether this is a new kind of threat or the old problems at greater speed and scale. These results also come from two simulated networks and a small number of runs, not from attacks on real systems.