Open-weight AI models are approaching the performance of restricted systems in simulated hacking tasks, according to research by Vals. That narrows the gap between models available to trusted users and models that anyone can download, raising questions about how companies should prepare for AI-assisted cyberattacks.
How the models performed
Vals tested models on two mock corporate network scenarios. In one, the model worked against a network reachable through a public-facing website. In the other, it had to compromise one company network before reaching a second.
OpenAI’s Daybreak, available only to trusted partners, completed 81 percent of assigned tasks on average across two tests. DeepSeek, an open-weight model from China, completed 73 percent of objectives on average. Vals researchers said the models performed equally on some tasks.
The results suggest that restricted access no longer guarantees a clear lead in cyber skills. That matters for organizations considering how quickly advanced capabilities could spread beyond controlled programs.
Access and cost are changing
Vals also compared the cost of carrying out the simulated attacks. The company says GPT-6-Sol cost $17 to $46 in tokens, while DeepSeek cost $2 to $3. Open-weight models can often be run on a user’s own hardware, which helps explain their lower cost.
Rayan Krishnan, CEO of Vals, said the price difference gives defenders a strong reason to consider open models too. Lower operating costs may make such tools more accessible for security teams that want to test systems or look for weaknesses.
The research adds pressure to a debate over restricted releases. Frontier AI labs have limited access to some advanced models partly to give defenders time to prepare before similar capabilities become broadly available. The Vals results suggest that open models are now beginning to narrow that window.
What the tests do—and do not—show
Simulated network tasks measure a model’s ability to follow complex instructions in a controlled setting. They do not establish how often criminals or state-backed groups will use the strongest available systems in real attacks.
Recent observations described in the report indicate that attackers often conserve resources and rely on older, less capable models, both proprietary and open. The best-performing model is not necessarily the one an attacker will choose for routine activity.
There is also continued uncertainty over whether AI changes the foundations of cybersecurity or accelerates longstanding challenges. AI can help identify vulnerabilities and probe networks more quickly, but the research does not settle whether that creates a fundamentally new kind of threat.
A continuing race between attackers and defenders
Alex Zenla, cofounder and chief technology officer of cloud security firm Edera, said open-weight models can already produce advanced attacks and vulnerabilities. He also cautioned that closed labs may have unreleased models with capabilities beyond those measured in the study.
That points to a moving contest: labs may try to stay ahead of widely available models, while defenders work to find and fix vulnerabilities before attackers exploit them. Even when access is restricted, organizations have to consider that well-funded and highly motivated attackers may have had some access to closed systems.
For security teams, the practical takeaway is that model access alone is unlikely to determine risk. The cost and availability of capable tools are changing, while the familiar work of finding weaknesses and securing networks remains central.