Open Deepseek V4.1 Flash Hacks Networks at 73% and Costs $3 vs. GPT-6's $22

If you thought autonomous hacking agents were limited to closed labs with access controls, a new Vals AI benchmark suggests it is time to reconsider. An open model trails the leader by only a few percentage points while costing several times less.

How the test works

Vals CyberOffense simulates a realistic corporate network. The agent operates alone on an isolated machine running Kali Linux. Its only initial input is a public web address. From there, it issues commands independently, finds a path from the web application through Windows servers, and obtains administrator privileges. Every action is logged externally, and the result is scored automatically.

Imagine a junior penetration tester given one URL and told: “Reach the domain.” Except this junior never sleeps, never gets distracted, and costs only a few dollars per attempt.

What the numbers showed

GPT-6 Sol from OpenAI's restricted Daybreak program achieved 80.8% of the objectives. The open Deepseek V4.1 Flash 1017 reached 72.8%. The cost per run was about $3 versus roughly $22.

In the simpler Nova scenario, the results were nearly equal: an average of 15.7 out of 21 for Daybreak and 16.3 out of 21 for Deepseek. In the more difficult Lighthouse scenario, Daybreak gained administrative control over the first company, stole passwords, and used them to infiltrate the second. The result was 27 of 31 objectives in under three hours. Deepseek completed 21 objectives at roughly one-tenth the cost, and according to Vals, it was stopped by more than just defensive safeguards. The table also contains a surprise: Meta Wonder completed 28 objectives in Lighthouse despite scoring only 7 in Nova.

Tokens make the difference

Another observation matters more than the percentages themselves: performance increases with the number of tokens spent. Most models show no meaningful progress until they pass 100 million tokens. Deepseek scored zero during its first 25 million and made most of its progress later. This means short tests underestimate the true potential of open models, especially Chinese ones.

Other studies confirm the trend

In July, the London-based AI Security Institute estimated that open models lagged closed models by 4–7 months on cyber tasks. For much of 2025, the gap was 6–10 months. According to AISI, a run on a cyber range costs $1.19 with Deepseek V4-Pro and $85 with Anthropic's Opus 4.5. The safeguards in open models proved largely ineffective. An Anthropic study found that the open GLM-5-3 builds exploits at nearly the level of the company's internal top model, Mythos.

What to do about it

The main takeaway for the industry is that control through closed access works only while open weights remain behind. Once weights are published, no provider can restrict how the model is used. Vals expects attacks on real-world networks to increase in the coming months.

Practical steps for developers and founders:

• Assume that an attacker with a budget of a few dollars can automate reconnaissance and privilege escalation.
• Cover the basics: patches, network segmentation, unique passwords, and monitoring for unusual activity.
• Use the same models for defense: run agents against your own infrastructure in a test environment before someone else does.
• If you build agent-based products, set limits on tokens and actions: long sessions are precisely what give agents their power.

Limitations

This is a simulation, not a production network. The number of runs is small: Nova averages three runs, and the variance is noticeable, with Daybreak completing between 12 and 19 objectives. The benchmark was published by Vals itself, and there has not yet been an independent reproduction. Even so, the direction is clear: the gap is shrinking, and the cost of attack is falling.