Free Chinese AI models are now close to the best closed ones at hacking

Open-weight AI models, including Chinese ones, are now almost as good at breaking into computer networks as the best closed models, WIRED reported. The finding comes from a test by the evaluation firm Vals AI, in which DeepSeek and GLM models landed not far behind OpenAI's most advanced cyber model, which isn't public.

That matters because US labs have limited their strongest cyber models to vetted users, betting that gated access would buy defenders time.

The Vals test results

Vals let AI agents attack two simulated company networks on their own, with no human help. Going by its CyberOffense leaderboard, updated on 23 October 2026, the best result came from GPT-6 Sol, which OpenAI offers only through its restricted Daybreak program.

DeepSeek V4.1 Flash 1017, a model anyone can download, came close behind. On the first network (called Nova, with 21 objectives) it averaged 16.3 objectives against 15.7 for Daybreak. On the second (Lighthouse, 31 objectives), Daybreak completed 27 and DeepSeek 21.

Cost is the sharper difference. Vals says DeepSeek matched Daybreak on the first network for under $3 per run, against about $22 for Daybreak.

A Vals researcher told WIRED that the best frontier models, locked inside the labs, are now starting to be matched by open models anybody can download.

Gaps in the picture

I'd read the headline with some care. The leaderboard I read lists only GLM 5.3 Flash, the smaller version of Z.ai's model, and it did poorly: 5 of 21 and 5 of 31 objectives. Vals says it stalled and never recovered. So the GLM result in WIRED's summary doesn't match the Flash numbers on that page, and I couldn't read the full WIRED article to see how the two fit together.

Vals also notes that no model finished the final objectives on the two-network range. Only one run in the whole set reached the last stage of the single-network range.

The test used simulated networks. It isn't evidence of real-world attacks.

Other evaluations point the same way

NIST's Center for AI Standards and Innovation (CAISI) published an assessment on 17 September. As Anthropic's write-up quotes it, CAISI called Z.ai's GLM-5.3 "the most cyber-capable open-weight model released to date". CAISI also found it lags the US frontier by about four months.

Anthropic ran its own tests on 29 September. On ExploitBench, which measures exploits for the V8 engine in Google Chrome, GLM-5.3 built end-to-end exploits in 50 of 410 attempts. Anthropic's unreleased Claude Mythos Preview managed 56 of 410.

Anthropic is a competitor, so its framing deserves some scepticism. Still, CAISI's findings point the same direction.

On safeguards, Anthropic reports that simple techniques got around GLM-5.3's refusals between 64% and 100% of the time in its simulated tests. Safeguarded Claude models resisted the same attacks. Anthropic says several developers released stripped-down versions of GLM-5.3 within days of launch.

Separately, the security firm Irregular reported that GLM-5.3 completed at least one run in three of 13 multi-stage attack scenarios, according to The420.in. The same report says Reuters found no evidence that Chinese AI agents had independently escaped their operators. Z.ai didn't immediately respond to Reuters' request for comment.

The stakes for defenders and attackers

Vals argues the same models that find a way into a network also find the weaknesses that let them in. Companies can use them now to test their own systems first.

Anthropic makes a similar case. It says defenders should have frontier tools at least as good as their adversaries', and that it expects state and non-state attackers to use models like GLM-5.3 to cause real harm.

That dual-use point is the uncomfortable part. Once weights are public, no provider can monitor or stop how they're used, as Vals puts it.

Logan Graham, who leads Anthropic's frontier red team, told WIRED in April that Project Glasswing aimed to put tools "in the hands of defenders to give a head start." The Vals result suggests that head start may be shorter than hoped.

Honestly, I think gating is a delay rather than a wall, at least for the tasks Vals measured. The cost gap is probably the bigger story: under $3 versus about $22 per run is the kind of difference that changes who can afford to try.

Next steps

Vals says it will add more ranges and models as frontier systems advance. It also expects attacks of this kind on real enterprise networks to become more common in the coming months.

Anthropic has called on governments to safety-test capable models, including successors to GLM-5.3. CAISI's GLM-5.3 assessment is itself an example of that kind of testing.

I think the next real signal will be whether independent testers see the same pattern on other benchmarks, since Vals' results come from just two networks and a handful of models.