Free AI models that anyone can download are getting close to the best restricted American models at breaking into simulated networks. That is the finding of benchmark testing by Vals reported in a Wired story on November 6, headlined that free Chinese AI models are getting scary good at hacking. Wired’s page could not be fetched, so the details below come from write-ups that cite it, including Dealroom and MLQ, and a link to the Wired story.
The test. Vals tested open-weight models, meaning models whose files are published for anyone to download, against OpenAI’s restricted cyber model on simulated corporate network hacking tasks. According to the write-ups, DeepSeek V4.1 Flash completed about 73% of the objectives, compared with about 81% for OpenAI’s GPT-6 Sol Daybreak model.
The cost gap. The same reports say Wired put the cost of a full simulated attack at $2 to $3 for the DeepSeek model, against $17 to $46 for GPT-6 Sol. A model that is nearly as capable and much cheaper lowers the barrier for anyone who wants to try the same tasks.
Other models. One separate assessment, according to secondary coverage, rated Z.ai’s GLM-5.3 as the strongest open-weight cyber model tested, though it still trailed the US frontier overall. Anthropic’s research on GLM-5.3 reportedly found that simple jailbreak techniques got past its safety filters between 64% and 100% of the time in simulated tests. A CNBC piece describes a related defensive use of a Z.ai model, and names GLM 5.2 instead, so the model version details differ between sources.
What the numbers do not show. These are results in simulated environments, set by a benchmark company, and they say little about attacks on real networks where defenders react. A score of 73% means about three of four objectives, not three of four attacks succeeding. The write-ups also do not make clear how the tasks were chosen.
The policy problem. Experts worry that cheap, downloadable models could widen access to offensive hacking capability as much as to defensive tools. CNBC reports that restricting the most capable open-weight models is hard, wherever they are made. Once a model is published, it cannot be recalled.
Why it matters. Security teams in the US and UK should plan for attackers who have access to capable AI at very low cost. Basic defenses, such as multi-factor authentication, prompt patching and limiting what services are exposed, are the main protections against automated attacks. The same models can also help defenders find weaknesses faster.
What to watch. Look for Vals’ published methods, responses from DeepSeek and Z.ai, and any policy proposals on open-weight cyber capabilities.
Sources: Dealroom and MLQ, summarizing a Wired report on Vals benchmark results, with CNBC context. Wired’s original could not be read directly, so figures are secondhand.
Shenzhen skyline (representative image), Wikimedia Commons, CC0
