A Benchmark That Measures Breakage
Vals, a company that tests what artificial intelligence systems can actually do, built two mock corporate networks and turned a set of models loose inside them. The first network sat behind a public-facing website; the second required a model to compromise one company’s systems before it could reach another’s. The tasks were multi-step and sequential, the kind of work that separates a scripted exploit from an actual intrusion. What came back was a result that reframes an argument the industry has been having for most of 2026.
OpenAI’s Daybreak, a cyber-focused model released only to vetted partners, finished 81 % of its assigned objectives across an average of two runs. [1] DeepSeek, a Chinese model whose weights anyone can download, finished 73 %. [1] On some individual tasks the gap vanished entirely. As Vals researcher Nikil Ravi puts it, the best frontier models, locked up inside the labs and available only through trusted access programs, are now starting to be matched by open models that anybody can download.
The number that matters most may not be the capability figure at all. Vals priced the same intrusion work at $17 to $46 in tokens for GPT-6-Sol and $2 to $3 for DeepSeek. [1] That spread is not a rounding error. It is roughly an order of magnitude, and it exists because an open model can run on hardware the user already owns, with no per-call billing and no vendor in the loop.
The Gate That Bought Less Time Than Advertised
Anthropic built its release strategy around a wager: that restricting access to the most capable models would slow the spread of dangerous cyber skills, buying defenders a window to prepare. Logan Graham, who leads the company’s frontier red team, framed the Project Glasswing program in April as an effort to put full-capability tools into defenders’ hands early. He also set a clock on the arrangement, warning that the capabilities would be broadly available within six, twelve, or twenty-four months and that security practices would have to change accordingly.
Seven months later, the Vals data suggests the short end of that estimate was the accurate one. The gating did not fail in the sense of being breached; it simply stopped being the binding constraint. Once a downloadable model performs nearly as well as a restricted one, the restriction governs access to a marginal advantage rather than to the capability itself.
This is where efficiency turns against the purpose it was meant to serve. A safety measure that works by slowing diffusion depends on a gap staying open. Close the gap and the measure does not become wrong so much as irrelevant, while the cost of having relied on it becomes visible all at once.
What Attackers Actually Reach For
The practical picture is more restrained than the benchmark table. Observation of criminal and state-linked intrusion activity through 2026 has consistently found attackers conserving resources, running older and cheaper models for the bulk of their work rather than reaching for the newest release. The most motivated and best-funded groups are assumed to have had some access to closed systems throughout, controls notwithstanding.
Alex Zenla, cofounder and chief technology officer at the cloud security firm Edera, agrees that open-weight models are capable of producing advanced attacks and vulnerabilities today, especially when their safety training is stripped out by modifying the weights. Her caveat is that the closed labs have likely trained additional, unreleased models that exceed these capabilities. She puts the dynamic as a cat-and-mouse game in which the labs race to outpace the open-weight models and secure vulnerabilities before the open models find them, and she suspects this may be the beginning of a dangerous security landscape rather than a settled equilibrium.
The cat-and-mouse framing is useful because it locates the gain precisely. If both sides run on comparable models, the contest stops being about who holds the better tool and becomes about who applies it faster to their own code. That is a different competition, and it favors the side with more to inspect.
The Defender’s Discount
Here the cost asymmetry stops being a threat vector and starts being an advantage. Rayan Krishnan, chief executive of Vals, says the same economics that make open models attractive to an attacker give a strong incentive to those playing defense to use open models rather than proprietary ones. A security team that can run intrusion simulations on its own hardware at a few dollars per attempt can afford to attempt many more of them.
That changes the shape of defensive work. Vulnerability discovery has always been rationed by cost: a firm tests what it can pay to test, then prioritizes the rest by intuition. When a simulated attack costs pocket change, the rationing loosens. The volume of findings rises, and so does the volume of fixing, which is the less glamorous half of the equation and the half that determines whether any of it matters.
The year’s evidence supports the first half of that claim more firmly than the second. AI has automated core hacking tasks to help both attackers and defenders find a massive number of new vulnerabilities in code, and the speed and scale of those findings, along with the intensity of fixing uncovered software flaws, have all increased. Whether the fixing has kept pace is a separate question, and one that the benchmark data cannot answer.
The Standard Nobody Has Set
Which raises the question the numbers keep circling without resolving: who decides what counts as secure enough? A model that completes 81 % of a simulated intrusion chain is impressive against a benchmark and meaningless against a real network with real defenders, real logging, and real incident response. The Vals scenarios are mock corporate networks, deliberately built for measurement. They tell us about model capability. They do not tell us about breach rates.
Experts remain divided on whether AI has altered the conceptual foundations of cybersecurity or merely amplified pressures that predate it. The distinction is not academic. If the tools amplify, the correct response is more of the same defense, executed faster. If they transform, the response requires rethinking what defense means. The parity finding sharpens the stakes of that unresolved argument without settling it.
What the research does establish is narrower and harder to argue with: closed models no longer hold a definitive edge in cyber skills. And the labs’ own timelines, set in April, have arrived roughly on schedule.
The Next Question, Not the Answer
The forward-looking problem is not whether open models will match closed ones; that has largely happened. It is whether the defensive advantage from cheap simulation gets used before the offensive advantage from the same economics gets used harder. Nothing in the benchmark determines that outcome. It depends on how many security teams treat a two-dollar attack simulation as a routine expense rather than a special project, and on how quickly the practice of continuous self-intrusion becomes ordinary.
Zenla’s cat-and-mouse image implies a race with no finish line, which is probably the honest way to describe it. The labs will keep training systems that exceed what is downloadable. The downloadable systems will keep closing the distance. Each cycle lowers the price of finding a flaw. The question worth carrying forward is not who wins that race but whether the defenders, who now hold the cheaper tool, actually run it.