“The top frontier models, locked inside laboratories and accessible only through trusted access programs, are now starting to catch up with open models that anyone can download,” states Nikhil Ravi, a researcher at evaluation firm Vals.
A new study by Vals, a company specializing in artificial intelligence capability assessment, demonstrates that open AI models today practically match the performance of top closed systems in corporate network penetration. In simulated enterprise environments, publicly available weights are closing the performance gap with proprietary infrastructure, fundamentally altering the economics of offensive digital operations.
Open-weight architectures have achieved parity with closed systems in automated penetration tasks, turning network attack tooling into an inexpensive and massively accessible commodity. American developers of frontier models attempted to restrict access to flagship releases to give network defenders a time advantage. Anthropic structured a restricted release of new models—starting with Claude Mythos Preview in April—on the assumption that closed access would slow the proliferation of advanced exploitation tools. Logan Graham, head of the frontier red team at Anthropic, told WIRED in April that the Glasswing project aimed to channel these capabilities to security services to build a preemptive advantage. Seven months later, empirical capability measurements show these defensive barriers are losing practical relevance.
The Economics of Automated Penetration
Vals tested models across two distinct simulation scenarios requiring the execution of complex multi-step network instructions. The first trial evaluated an attack on a test corporate network via a public web site. In the second test, the artificial intelligence was required to compromise a company's primary perimeter and subsequently execute lateral movement into a second, isolated corporate network. OpenAI's specialized cyber operations model Daybreak, access to which is strictly limited to verified partners, completed an average of 81% of assigned tasks across the two trials. China's open model DeepSeek recorded a 73% result, fully matching Daybreak on specific subtasks.
What is the actual cost for an adversary to execute an automated corporate network penetration using models of varying tiers?
Token consumption metrics show that executing a single offensive session via GPT-6-Sol incurs computational expenses ranging from $17 to $46. For comparison, running the same penetration testing workload through DeepSeek costs between $2 and $3.
Rayan Krishnan, CEO of Vals, notes that this also creates a powerful incentive for the defensive side to transition to open models instead of proprietary alternatives.
Because open models run directly on an enterprise's own hardware without vendor token markups, the staggering gap in API costs dictates defense tooling budgets just as uncompromisingly as it lowers the barrier to entry for attackers.
Threat Realities and Defensive Strategy
Real criminal syndicates and state-sponsored hacking units do not deploy the newest releases instantaneously: for ongoing campaigns, they conserve operational resources by using battle-tested models. State-sponsored offensive teams with significant funding have highly likely gained access to closed systems despite laboratory restrictions. Alex Zenla, co-founder and CTO of cloud security firm Edera, confirms that open-weight systems are capable of generating complex attacks and exploiting vulnerabilities, particularly when utilizing modified weights with removed corporate safety guardrails (abliteration).
Security teams conducting perimeter audits should deploy DeepSeek-tier open models on private hardware to stress-test public web assets against multi-step lateral movement techniques, calibrating their defense perimeter against automated attack scenarios costing a mere $3.
The democratization of offensive cyber capabilities via open-weight models renders security-through-obscurity strategies obsolete. As inference costs for advanced penetration drop to single-digit dollars, enterprise risk models must assume that sophisticated threat simulation is universally accessible, shifting the competitive edge entirely to continuous automated perimeter validation.
What changed
In late July, AISI found that the open-weight lag had shrunken to four to seven months. Removing corporate safety guardrails from accessible architectures leaves commercial API gatekeeping toothless.
Our stories: Open-Source AI Closes Gap with Proprietary Models to 4 Months (July 28).