Open-weight models match closed systems for cyber attack prediction

On July 2026, the UK AI Safety Institute (AISI) released its evaluation of the cybersecurity capabilities of modern language models. The institute evaluated 70 different tasks, spanning four categories of difficulty: from finding vulnerabilities and reversing to hacking into web services and breaking cryptographic codes. They ran an extended test where the language model had to carry out a 32-step attack against a corporate network consisting of about 20 computers divided into four subnetworks. This would take a human expert around 20 hours.

Open-weight models GLM-5.2 and DeepSeek V4-Pro, which allow you to download their weights and run them on your own computer for free, are now on par with the closed models from four months ago. GLM-5.2 is equivalent to Opus 4.6 from February 2026 and DeepSeek V4-Pro to Opus 4.5 from November 2025. The difference between open and closed models has decreased from 6 to 10 months at the beginning of 2025 to 4 to 7 months currently. DeepSeek costs $0.28 per cybersecurity task, compared to $15 for Anthropic Opus, which is a factor of 50.

Safety filters in open-weight models are almost useless. For example, DeepSeek sometimes refused to perform reverse engineering tasks, but this could be circumvented by asking another question, and there’s nothing we can do about it. According to the AI Safety Institute, closing the time lag between open-weight and closed models will leave less time for defenders to respond before unregulated, highly capable cybersecurity tools become widely accessible.