AI hacks corporate networks on its own, and open models are catching the leaders

What's happening

On October 23, 2026, independent testing firm Vals AI released a new version of its CyberOffense benchmark. It tests whether AI agents (AI systems that use tools on their own and plan multiple steps in sequence) can break into realistic corporate networks by themselves. The result, reported by The Decoder and Crypto Briefing among others: they can. And the models anyone can download are now only slightly behind the best locked-down systems from US labs.

The test setup is deliberately tough. Each agent works alone on an isolated attack machine. It starts with nothing but a public web address and gets no human help at all.

The results at a glance

The top performer was GPT-6 Sol, a model from OpenAI's Daybreak program. It isn't publicly available; access is only through a vetted partner program. GPT-6 Sol hit 80.8 percent of attack targets overall. Right behind it is Deepseek V4.1 Flash 1017, an open-weight model released around October 17, 2026, at 72.8 percent. The big difference is cost: according to Vals, one run cost about $3 with Deepseek and about $22 with GPT-6 Sol.

Vals tested two simulated networks: the smaller "Nova" with 21 targets and the much harder "Lighthouse" with 31.

Notably, Deepseek actually edged out GPT-6 Sol on Nova on average. Meta Wonder, meanwhile, posted the best single result on Lighthouse with 28 targets but largely failed on Nova. So results vary a lot depending on the scenario and the run.

In the Lighthouse test, GPT-6 Sol first took admin control of the first simulated company, stole passwords there and used them to break into a second company. It completed 27 of 31 targets in under three hours. Deepseek managed 21, at a tenth of the cost.

Why long runs matter

One key finding concerns compute. Deepseek scored nothing at all in its first 25 million tokens (tokens are the chunks of text AI models read and write in). It made most of its progress only after 100 million tokens. Vals concludes that short tests underestimate what open models can really do.

That matches measurements from the UK AI Security Institute (AISI). According to its research, performance in cyber training environments scales log-linearly with token budget, at least up to 100 million tokens per run. Extra compute budget alone can boost performance by 59 percent, without the attacker needing any more technical skill, as Tech Times sums it up.

What the UK AISI measured

In July 2026, the AISI published its first public measurement of the gap between open and closed models in cyber capabilities. The result: it has shrunk to four to seven months. For much of 2025, it had been six to ten months.

The AISI tested two Chinese open-weight models, Z.ai's GLM-5.2 and DeepSeek V4-Pro, using two methods:

• 70 narrowly scoped cyber tasks across four difficulty levels, ranging from data analysts with little security knowledge to experts with more than ten years of experience. Topics: finding and exploiting vulnerabilities, reverse engineering (taking software apart to understand how it works), web attacks and cryptography. Each model got five attempts per task with 2.5 million tokens each.
• Cyber ranges, meaning complete simulated corporate networks. The flagship scenario, "The Last Ones", involves 32 steps across four subnets and about 20 machines. According to the AISI, a human expert would need about 20 hours.

On the individual tasks, GLM-5.2 performed on par with Anthropic's Opus 4.6 (February 2026), roughly four months behind the frontier. DeepSeek V4-Pro matched Opus 4.5 (November 2025). In the cyber range, GLM-5.2 got as far as Opus 4.5, a lag of up to seven months.

The cost gap is even starker. According to the AISI, a full run through "The Last Ones" with 100 million tokens costs about $85 with Opus 4.5 or 4.6, about $46 with GLM-5.2, and just $1.19 with DeepSeek V4-Pro. Those are official API list prices; the AISI ran the open models itself.

Safeguards barely work

What the AISI found about safety measures is especially concerning: neither GLM-5.2 nor DeepSeek V4-Pro put up any real barriers. DeepSeek occasionally refused tasks, mainly in reverse engineering, but those refusals could be overcome simply by trying again, no jailbreak (tricks for getting around an AI's safety rules) required.

There's also a fundamental problem. With a closed model, the provider can monitor usage, improve safety filters or cut off access entirely. Once the weights are published, none of that is possible. The Vals researchers say so plainly too: once a model is freely available, no provider can control how it's used. On top of that, an Anthropic study found that the open GLM-5-3 can build exploits (programs that take advantage of a security vulnerability) almost on par with Anthropic's internal frontier model, Mythos.

Why the labs lock their models away in the first place

The restricted-release strategy started in April 2026. Anthropic didn't release Claude Mythos Preview to the public because the model can find and exploit software vulnerabilities, and gave it only to just over 40 partners. Other US labs followed with similar programs, such as OpenAI's Daybreak.

Vals researcher Nikil Ravi sums up the situation:

"The best frontier models, locked away in the labs and only available through trusted access programs, are now gradually being caught up to by open models that anyone can download."

Vals CEO Rayan Krishnan is also questioning whether such access controls still do what they're meant to do. Back in June 2026, Vals had already shown that open models keep pace at finding and fixing vulnerabilities. The new test goes further: it measures the ability to chain together a real attack operation.

Europe is in the mix too. Mistral is explicitly pitching Mistral Large 4, an open-weight model released at the end of October, at defenders. Independent measurements by Artificial Analysis, however, put it at 51 points on their cyber index, behind Deepseek V4.1 Flash at 57. Mistral's own claim of 82 percent on a test for reproducing and patching vulnerabilities hasn't been independently verified yet.

Our take

The studies send a consistent message: if you want to attack, you don't need the best model. A cheap open model that hits most targets and can be rerun several times for the price of one premium run is often enough. Crypto Briefing points out that for security teams, the cost gap may matter more than the performance gap. Vals expects attacks on real networks to increase in the coming months.

There's an opportunity here too. The same models that exploit vulnerabilities can help companies find and close them first. The AISI talks about a "preparation window" for defenders. But that window is shrinking, and the frontier itself is moving fast: according to the AISI, the cyber performance of closed models was doubling every 4.7 months as of February 2026, compared with every eight months in November 2025. In April, Mythos Preview became the first model to complete "The Last Ones" end to end, with GPT-5.5 the second.

A caveat: these are simulated networks, results vary widely between runs, and it's unclear how well the numbers translate to real, defended corporate networks. Still, the findings are politically explosive, especially since the strongest open model comes from China, and the debate over export controls and release rules has so far assumed that locked-down US models set the pace.