Free Chinese AI Models Are Getting Scary Good at Hacking

Open-weight models are now nearly as capable at complex network intrusion tasks as the best closed systems, according to Vals’ new evaluations on simulated corporate networks. OpenAI’s trusted-access cyber model Daybreak completed 81 percent of tasks on average; DeepSeek hit 73 percent, tying on some objectives. Token cost for an attack run: roughly $17–$46 for GPT-6-Sol versus $2–$3 for DeepSeek.

That gap closing matters because U.S. labs — Anthropic especially, via Project Glasswing and gated Mythos Preview — argued limited release would buy defenders a head start. Anthropic’s Logan Graham told WIRED in April to prepare for broad availability in 6–24 months. Seven months later, Vals’ Nikil Ravi says frontier closed models are starting to be matched by downloads anyone can pull.

We expected this curve; seeing the numbers still lands. Gating buys calendar time, not a permanent moat. When an open Chinese weight file clears most of the same mock objectives as a lab’s restricted cyber model, the proliferation story stops being theoretical.

I’m not rushing to “the sky is falling.” WIRED and practitioners note criminals still often stick to older, cheaper models, and well-funded actors likely touched closed systems anyway. Alex Zenla at Edera agrees open weights — especially abliterated ones with safety stripped — already produce advanced attacks, while warning closed labs still train unreleased stronger ones. Cat and mouse, not checkmate.

Still: cost and run-anywhere change who can rehearse. Defenders should use the same open stacks for purple-team work — Vals’ Rayan Krishnan flags that incentive explicitly. Useful AI here means accelerating patch finding and network probing for the good guys at the same price point attackers already enjoy. The harm if we sleep: assuming API rate limits and trusted-access programs still define the threat model.

Where this leads if it scales is a security landscape where every mid-tier crew can automate multi-hop compromise on mock-grade difficulty, and real networks that look like the lab sims get hit harder and faster. Prepare as if the open models already cleared the bar Graham described — because on Vals’ tape, they’re close.

Vals used two scenarios: a public-facing corporate web perimeter, and a two-company pivot where compromising the first unlocked the second. The broader 2026 cyber year has seen AI automate vuln discovery and probing for both sides without a settled consensus on whether the foundations of defense changed or merely accelerated.