Open DeepSeek nearly matches closed models at hacking networks

Vals, a company that evaluates AI capabilities, tested how models handle multi-step tasks in simulated corporate networks. OpenAI’s closed Daybreak completed an average of 81% of the tasks, while the open DeepSeek scored 73%; on some tasks, their results were identical. Yet an attack using DeepSeek costs $2–3, compared with an estimated $17–46 in tokens for GPT-6-Sol, according to Vals. The researchers say open models are beginning to catch up with leading closed systems on cyber tasks.

How the models were tested

Vals tested the models in two scenarios. In the first, they had to complete tasks in a simulated corporate network accessible through a public website. In the second, there were two separate networks: to reach the second, a model first had to compromise the first.

Across the two tests, Daybreak, OpenAI’s leading cyber model, available only to trusted partners, completed 81% of the assigned tasks on average. DeepSeek, an open model developed in China, scored 73%. Vals researchers noted that the models achieved identical results on some tasks.

According to Vals researcher Nickel Ravi, open models are beginning to compete with leading systems available only through labs and programs for vetted users. This raises questions about how effectively access restrictions can limit the spread of advanced cyber capabilities.

The cost difference

Vals estimates that the tokens for a single attack cost $17–46 with GPT-6-Sol and $2–3 with DeepSeek. Open models are usually cheaper because they can be run on a user’s own hardware. Vals CEO Ryan Krishnan says this gives defenders an added incentive to choose open models over proprietary ones.

OpenAI did not respond to WIRED’s request for comment.

Access restrictions and risks

Labs developing advanced models have restricted access to new systems, hoping to buy time before advanced hacking capabilities become widely available. In the US, this strategy has been particularly associated with Anthropic: in April, the company began a limited release of Claude Mythos Preview. Logan Graham, head of Anthropic’s frontier red team, told WIRED at the time that Project Glasswing gives trusted users full access to new models so defenders can get ahead.

Graham also said that people need to prepare for these capabilities to become widely available over the next 6, 12 and 24 months. Seven months later, the source notes, that transition appears to have happened on schedule.

Over the past year, AI has automated core hacking tasks: attackers and defenders alike have used it to find more vulnerabilities in code and check networks for weaknesses faster. The speed and scale of vulnerability discovery have increased, as has the pace of fixing the software flaws found. Experts continue to debate whether AI is changing the fundamentals of cyber defense or amplifying familiar problems. It remains unclear whether these tools pose a new kind of threat.

Open models catching up with closed ones matters for understanding how criminal groups might use AI and how companies and developers should respond. But observations of cybercriminals and state-linked groups in recent months suggest that many conserve resources and mainly use older, less capable models, both proprietary and open. Moreover, even with strict restrictions, defenders have to assume that the best-resourced and most motivated attackers have already had at least some access to closed models.

Alex Zenla, co-founder and CTO of cloud security company Edera, agrees that open models can already help create sophisticated attacks and find vulnerabilities. He specifically mentioned models with safety training disabled by modifying their weights. However, he said closed labs have probably trained additional models they have not released yet, and that these outperform the systems tested. Zenla describes the situation as a constant race: labs are trying to stay ahead of open models and patch vulnerabilities before those models find them. He believes this could be the beginning of a dangerous period for cybersecurity.

Dataist's take: Vals’s results show that restricted access alone no longer guarantees closed models a lasting advantage: open DeepSeek is close to Daybreak and costs less. But the test used simulated networks, while data on real attacks show that criminals often choose older, less capable tools. So models drawing level in tests does not yet mean that the scale and methods of attacks on real networks have changed in the same way.