A free open-weight model nearly matched OpenAI's restricted cyber model at breaking into simulated company networks, for under $3 a run

Attack capability that sat behind a vendor's gate is now in a model anyone can download.

What happened

Vals AI's CyberOffense benchmark drops AI agents into simulated corporate networks with only a public web address and no human help. The best result came from GPT-6 Sol, which OpenAI offers only through its restricted Daybreak cyber program. On the harder Lighthouse range, it broke into one company, took administrator control, stole passwords and used them to reach a second company, completing 27 of 31 objectives in under three hours.

DeepSeek V4.1 Flash 1017, a freely available open-weight model, scored level with Daybreak on the first range for under $3 per run, against about $22 for Daybreak. Vals says that once a model's weights are public, no provider can monitor or stop how it is used. It also found models kept completing objectives as they ran longer, with DeepSeek making most of its progress after 100 million tokens, so short tests understate cheap models.

The Decoder links this to a UK AI Security Institute analysis from July, which put the gap between open and closed models in cyber capability at four to seven months, down from six to ten months for most of 2025. Vals calls this a window for defenders and expects attacks of this kind on real enterprise networks to become more common in the coming months.

My take

Small businesses used to rely on being too boring to attack. When a long, patient intrusion costs a few dollars of compute, that cover is gone.

The automation stack is part of the attack surface: webhook endpoints, self hosted n8n instances, API keys sitting in workflow nodes, old Zapier connections nobody remembers. What I'd check this month:

1. List every internet facing endpoint your automations expose, and close the ones you don't need.
2. Put MFA on every admin account in your CRM and automation tools.
3. Rotate keys stored in workflows and scope them to the minimum.
4. Use the defender window: run an authorized scan of your own systems before someone else does.