Free Chinese AI Models Are Getting Scary Good at Hacking

Independent benchmark provider Vals published new empirical test results demonstrating that openly downloadable artificial intelligence models can now carry out multi-step corporate network intrusions with success rates nearly matching gated frontier systems. Detailed in Wired's report, the benchmarking firm evaluated how frontier architectures break into simulated environments across multi-stage cyber attacks. The outcome shows that OpenAI's proprietary model Daybreak achieved an 81 percent completion rate across tests, while China's open-weight model DeepSeek followed closely by completing 73 percent of the assigned intrusion objectives. The findings reveal that strict access restrictions maintained by closed labs are rapidly losing their protective lead over publicly downloadable weights.

This analysis examines the measured technical capabilities, token cost differentials, network intrusion mechanics, and strategic defensive consequences revealed by the Vals evaluation. It is written for security architects, incident response leads, infrastructure engineers, and policy specialists assessing offensive AI automation and threat modeling. While closed frontier labs historically justified restricted access tiers to grant defensive engineers a temporary head start, these comparative benchmarks show the timeline has compressed significantly, altering the cost economics for threat actors and internal red teams alike.

Free Chinese AI Models Are Getting Scary Good: what actually changed

Testing conducted by capability measurement firm Vals shows that closed-source artificial intelligence systems no longer maintain a definitive performance monopoly in offensive cyber execution. In rigorous comparative trials, researchers measured how effectively different architectures navigated multi-step instructions inside simulated enterprise networks. OpenAI's dedicated cyber model Daybreak, which remains accessible exclusively to trusted partners, completed an average of 81 percent of assigned tasks across two test rounds. The Chinese open-weight model DeepSeek resolved 73 percent of the same objectives, achieving identical scores on specific subsets of the intrusion exercises.

The narrowing capability delta confirms that gated deployment strategies adopted by frontier artificial intelligence labs are failing to prevent the proliferation of sophisticated automated hacking tools. In April, Anthropic initiated limited distribution for models starting with Claude Mythos Preview, arguing that restricted releases through efforts like Project Glasswing would provide defenders with a six to twenty-four month advantage. Seven months later, publicly downloadable weights match these proprietary capabilities, effectively eliminating the anticipated delay between closed research breakthroughs and public model availability.

Free Chinese AI Models Are Getting Scary Good: how it works

Vals assessed offensive competencies using two distinct simulated corporate attack architectures. The initial testing environment presented a mock enterprise perimeter accessible via an external public-facing website, requiring models to discover ingress vectors and establish footholds. The secondary scenario demanded lateral pivoting across organizational boundaries, forcing models to fully compromise an initial enterprise network before leveraging acquired privileges to penetrate a separate, secondary corporate target. Both scenarios required models to execute sequential, programmatic decisions without manual human intervention.

Executing these automated intrusion chains proved substantially cheaper on open-weight infrastructure than on proprietary API endpoints. Vals recorded token operational costs ranging between $17 and $46 when directing GPT-6-Sol through an attack sequence, whereas running the equivalent workload on DeepSeek required only $2 to $3 in tokens. Because open weights operate on local hardware without per-token platform surcharges, organizations executing continuous offensive simulations or automated software audits gain substantial financial efficiencies by running local instances rather than commercial application interfaces.

Free Chinese AI Models Are Getting Scary Good: why it matters

The rapid closure of the performance gap undermines the assumption that export controls and platform filtering can bottle up offensive capabilities. While automated models continue to streamline vulnerability discovery, security researchers note ongoing debates over whether artificial intelligence introduces fundamentally novel threat mechanisms or merely amplifies existing exploitation velocity. However, the commercial disparity documented by Vals fundamentally alters attacker economics, permitting persistent reconnaissance and exploit chaining at a fraction of prior operating expenses.

Defenders now face symmetric access pressures as open models match commercial tools. Rayan Krishnan, chief executive of Vals, pointed out that the steep cost difference provides defensive teams with an economic incentive to adopt open-weight systems for vulnerability discovery and internal hardening. Furthermore, developers frequently deploy abliterated open models, where modified parameter weights neutralize safety guardrails entirely, enabling unrestricted security testing without commercial content-filtering interventions.

Free Chinese AI Models Are Getting Scary Good: who is affected

Security operations centers, system administrators, and corporate infrastructure teams face increased reconnaissance pressure from automated tools probing perimeter attack surfaces. At the same time, real-world monitoring indicates that typical cybercriminals and state-sponsored units continue to conserve computational resources, relying largely on older proprietary and open models for routine campaigns. Security analysts note that sophisticated and well-capitalized adversaries have historically managed to access closed systems regardless of vetting programs, meaning enterprise defenses must already withstand frontier-level exploitation attempts.

Cloud security providers and software vendors must also adjust defensive release pipelines. Alex Zenla, cofounder and chief technology officer at cloud security firm Edera, observed that while open weights now reliably generate advanced exploits, closed frontier laboratories likely retain unreleased internal models exceeding currently observed capabilities. This dynamic locks enterprise defenders and commercial laboratories into a continuous race to identify and patch zero-day software vulnerabilities before autonomous open-weight agents systematically uncover and weaponize them.

Free Chinese AI Models Are Getting Scary Good: what to watch

The primary indicator to track is how frontier research organizations adjust their restricted-access protocols and vulnerability disclosure workflows. Closed developers like OpenAI and Anthropic are accelerating defensive automation research to discover software weaknesses before open-weight variants reach parity on newer architectures. Observers are monitoring whether proprietary laboratories widen access to dedicated defensive models like Daybreak or establish tighter hardware-level telemetry to restrict downstream open-weight model extraction.

Enterprises must also monitor the integration of customized, abliterated open weights into automated vulnerability scanning pipelines. As developer communities continue stripping commercial alignment layers from models like DeepSeek, defensive engineers must deploy equivalent open-source tooling locally to audit internal source code repositories and patch exposed network paths before low-cost, automated external attack chains discover them.