Open DeepSeek Hacks Networks Almost as Well as Closed Daybreak: 73% vs. 81%

Six months ago, US labs offered a simple justification for closed releases: restrict access to models capable of hacking and give defenders a head start. At the time, Logan Graham of Anthropic said such capabilities would become available to everyone in 6, 12, or 24 months. Seven months have passed, and the forecast has come true almost on schedule.

What the Test Showed

Vals, a company that measures AI capabilities, built two scenarios using simulated corporate networks. In the first, a model attacks a network through a public website. In the second, it must first compromise one company and then use it to reach another. This is not a test of a single vulnerability, but a chain of steps resembling a real attack.

The top performer was OpenAI's Daybreak, a cyber model available only to trusted partners: it completed 81% of tasks on average across two runs. Open DeepSeek completed 73%. On some tasks, the models achieved identical results. Nikhil Ravi of Vals puts it this way: open models that anyone can download are beginning to catch up with the best models locked inside laboratories.

Money Matters

The price gap is more striking than the quality gap. According to Vals, running an attack with GPT-6-Sol costs $17–46 in tokens, compared with $2–3 for DeepSeek. An open model can be run on your own hardware, pushing the cost even lower. Vals CEO Ryan Krishnan believes this also creates an incentive for defenders: penetration testing and vulnerability discovery with open models are easier to scale across an entire service portfolio.

What This Changes

The main conclusion is that closed access no longer guarantees an advantage. If you are building a product around the assumption that dangerous capabilities are confined to a lab, that protection is weakening. Threat models should now assume that attackers have access to a powerful autonomous tool at almost no cost.

Still, panic would be premature. Observations of real-world groups, both cybercriminal and state-backed, show that most attackers conserve resources and use older, less capable models. The wealthiest and most motivated actors probably already had access to closed models. For them, this news changes nothing.

Alex Zenla, CTO of Edera, points to two nuances. First, abliterated models exist: their safety training has been disabled through weight modifications, making them suitable for attacks. Second, closed labs have probably already trained more powerful internal models. He describes the situation as a cat-and-mouse game: labs are trying to find vulnerabilities before open models do.

Limitations

It is worth remembering that the test used simulated networks, not live infrastructure with monitoring and employees. The result is an average from two runs, and the sample is small. OpenAI had not commented on the data at the time of publication. Experts also disagree over whether AI creates a fundamentally new class of threat or merely amplifies existing ones.

What to Do

Developers and security teams should take several steps:

• Assume that automated vulnerability discovery is cheap and available to anyone.
• Accelerate patching and shorten response times: the pace of discoveries will increase.
• Try open models for your own internal penetration testing before they are used against you.
• Do not rely on safety filters as the only barrier, because they can be removed.

The race is not between closed and open models. It is between whoever finds the hole in your code first: you or someone else.