For most of 2025, proprietary frontier systems held a capability lead over publicly accessible software, but an analysis from July by the UK's AI Security Institute confirmed that this lead has shrunk to four to seven months. The commercial implication of that compression is visible in automated offensive capabilities, where Deepseek V4.1 Flash 1017, a freely available open-weight model, scores 72.8 percent on the Vals CyberOffense benchmark while costing about $3 per run instead of roughly $22 for proprietary alternatives.
The widespread availability of low-cost open weights for offensive tasks erases the operational advantages of proprietary platforms and forces a structural reassessment of corporate defense spending. While access to frontier models can be policed through hosted platforms, open distributions remove commercial gatekeepers entirely.
The Economics of Autonomous Penetration
Testing conducted on the Vals CyberOffense benchmark demonstrates how automated penetration testing has moved beyond theoretical disruption. The benchmark simulates realistic corporate networks by deploying each agent solo on an isolated attack machine, providing nothing more than a public web address and zero human assistance.
OpenAI's GPT-6 Sol, operating within OpenAI's restricted Daybreak cyber program, posted the top result by solving 80.8 percent of the benchmark objectives. Earlier testing showed OpenAI's specialized cyber operations model Daybreak, where access is strictly limited to verified partners, completed an average of 81 percent of assigned tasks across the two trials, while China's open model DeepSeek recorded a 73 percent result, fully matching Daybreak on specific subtasks.
In the harder Lighthouse test, Daybreak took over admin control of the first company, stole passwords, and used them to break into the second company, completing 27 of 31 objectives in under three hours. Deepseek managed 21 objectives at a fraction of the cost.
"Once a model's weights are public, no provider can control or restrict how it's used, Vals researchers say."
As Vals researchers observed regarding public releases, the safety measures on the open models proved largely ineffective, leaving providers without leverage to enforce access policies once the files are downloaded.
Compute Thresholds and Defensive Parity
Operational performance in open-weight models does not scale linearly from short interaction windows. Longer runtimes turned out to be critical as well. Deepseek scored zero results in its first 25 million tokens and made most of its progress only after 100 million tokens. Evaluations based on brief test runs consequently underestimate the operational reach of open models when workloads run extended reasoning chains.
Cost discrepancies appear across other evaluations as well. Data from the UK's AI Security Institute shows a cyber-range run with Deepseek V4-Pro costs just $1.19 according to the Institute, compared with $85 for Anthropic's Opus 4.5. Furthermore, an Anthropic study also showed that the freely available model GLM-5-3 can build exploits at nearly the same level as the internal top model Mythos.
Corporate security teams often maintain that defensive organizations possess identical tooling, suggesting internal units can deploy these same systems to identify vulnerabilities and patch perimeter infrastructure before attackers exploit them. Deepseek wasn't limited solely by safety guardrails during its 21-objective run, and Vals points out that attacks on real networks are likely to increase in the coming months.
Organizations betting their perimeter security on closed enterprise licenses now face offensive actors whose primary operational expense is roughly three dollars of inference compute.
Why it matters
Cloud prompt filters and verified partner programs maintained by OpenAI or Anthropic offer little solace once weights can be pulled onto local servers to automate complex network lateral movement without external oversight. Defending internal assets under legacy cost assumptions is broken, especially when cheap open setups can easily outrun older playbooks over extended reasoning loops. Slashing the cost of an automated network compromise to three dollars strips corporate security teams of their traditional reaction buffer.
Our stories: Open-Source AI Matches Closed Models in Cyberattacks (November 6).