Open-weight DeepSeek nearly matches OpenAI’s gated cyber model on network attacks, at a fraction of the cost

WIRED reports on new evaluations by Vals that ran AI models through two simulated scenarios: attacking a public-facing corporate web perimeter, and a two-company pivot in which compromising the first network unlocked the second. OpenAI’s Daybreak, a cyber model available only through a trusted-access program, completed 81 percent of tasks on average. DeepSeek, an open-weight Chinese model anyone can download, completed 73 percent and matched Daybreak on some objectives.

Cost is the second headline. A single attack run cost roughly $17 to $46 in tokens on OpenAI’s GPT-6-Sol, versus $2 to $3 on DeepSeek. Cheap and runnable anywhere changes who can afford to practice.

U.S. labs, Anthropic especially, argued that limiting access to their strongest cyber models would give defenders a head start. Anthropic’s Project Glasswing and its gated Mythos Preview were built on that logic. In April, Anthropic’s Logan Graham told WIRED to prepare for broad availability of these capabilities within 6 to 24 months. Seven months on, Vals’ Nikil Ravi says frontier closed models are starting to be matched by downloads anyone can pull. OpenAI’s own expansion of Daybreak and launch of a cyber-focused ChatGPT were already landing in a world where hobbyists find severe bugs with older models (our analysis).

This is not a reason to panic. WIRED and practitioners note that criminals often stick with older, cheaper models, and well-funded attackers likely had access to closed systems anyway. Alex Zenla of Edera agrees that open weights, especially “abliterated” versions with safety training stripped out, already produce advanced attacks, while cautioning that closed labs are still training stronger unreleased models. It is cat and mouse, not checkmate. The scale of the stripped-model problem is real: Hugging Face has listed more than 6,000 abliterated checkpoints (our coverage of an open-weight safety partnership).

Still, the threat model has to change. Rate limits and trusted-access programs no longer define what an attacker can do. If mid-tier groups can automate multi-step compromise at mock-network difficulty, real networks that resemble those simulations will be hit harder and faster.

Use the same open models for purple-team work, the practice of combining attack and defense testing, a point Vals’ Rayan Krishnan makes explicitly. Useful AI here means accelerating patch discovery and network probing for defenders at the same price attackers already pay. Planning as though open models have already cleared the bar Graham described is prudent, because on Vals’ results they are close. See more in our cybersecurity coverage.