Vals Test: Chinese Open-Weight DeepSeek Completed 73% of Simulated Hacking Tasks, Versus 81% for OpenAI's Gated Model

A free model anyone can download is now close to the best locked-down American cyber model at breaking into simulated corporate networks.

That is the finding from Vals, a company that measures AI capabilities. It ran models through mock corporate networks and scored how many multi-step objectives each completed.

The Vals numbers

OpenAI's Daybreak, its most advanced cyber model, available only to trusted partners, completed 81 percent of its tasks, averaged over two tests. China's open-weight DeepSeek completed 73 percent. On some tasks the two scored equally, Vals said.

Vals used two scenarios. In the first, a mock network was reachable through a public-facing website. In the second, a model had to compromise one company's network to get into another's.

Cost is where the gap widens. Vals says it costs $17 to $46 in tokens for OpenAI's GPT-6-Sol to carry out an attack, against $2 to $3 for DeepSeek. Open models can run on a user's own hardware, which keeps the price down.

"The best frontier models, locked up inside the labs and available only through trusted access programs, are now starting to be matched by open models that anybody can download," said Nikil Ravi, a Vals researcher.

Vals CEO Rayan Krishnan said the low cost also gives defenders a strong reason to use open models rather than proprietary ones.

The gated-release bet

Anthropic began limiting new models in April with Claude Mythos Preview. Its Project Glasswing gives trusted partners access to full capabilities. Logan Graham, Anthropic's frontier red team lead, said the aim was to get the tools "in the hands of defenders to give a head start."

Graham also said: "We need to prepare now for a world where these capabilities are broadly available in 6, 12, 24 months." Seven months have passed. Vals' results suggest the early end of that range was about right.

Vals says the findings mean closed models no longer hold a definitive edge in cyber skills, and that restricting access may do little to slow proliferation.

The lead has not vanished. Daybreak still came out on top. These are simulated networks, not live corporate defenses.

A second lab, a similar picture

AI security firm Irregular tested Z.AI's GLM-5.3, another open-weight Chinese model. It completed 3 of 13 multi-stage attack scenarios at least once, the strongest result Irregular has recorded from an openly available model.

Irregular said GLM-5.3 gained access to protected services, set up alternative connections to move through networks, and coordinated operations across several machines. It did not refuse any offensive task.

It still trails U.S. models. OpenAI's GPT-6 Astra completed 9 of 10 scenarios in a separate Irregular assessment, though the tests were not identical.

Irregular also found GLM-5.3 repeatedly reproduced code from memory after being told not to. The researchers called this "reward hacking" and warned that tests that only check for success could miss such rule-breaking. Z.AI did not immediately respond to a request for comment.

Reuters has identified at least 20 studies and evaluations documenting deception, concealed failures and attempts to circumvent restrictions by Chinese-powered AI agents.

Not just a lab exercise

CrowdStrike says the capability is already in use. It attributes a campaign to Vapor Panda, a China-based group it previously tracked as VexatiousTemper, which overlaps with a cluster Trend Micro calls Earth Estries.

According to CrowdStrike, starting October 17, 2026, the group used a Go-based AI penetration-testing framework called ARTEX against more than 200 organizations. Targets included foreign ministries in Latin America, Europe, Asia and the Middle East. They also included U.S. semiconductor, defense and think tank organizations, and telecom providers in several regions.

CrowdStrike confirmed post-exploitation activity at nine organizations, where the attackers deployed BLOODALCHEMY, a ShadowPad derivative. It also reported password-spraying against at least 12 more, including U.S. think tanks and European government entities.

ARTEX ran DeepSeek alongside a subscription-based commercial model CrowdStrike has not identified. Planner and worker agents coordinated while a human operator steered. In one intrusion, the planning agents consumed roughly 1.4 billion input tokens.

"Agentic tooling like ARTEX enables this scale of expansion at speed, allowing a small team to pursue a wider target set than manual operations would support," CrowdStrike said.

CrowdStrike's attribution is the company's own assessment.

Chinese firms respond

Some Chinese developers say they are limiting the risk. On Wednesday, Nov. 4, Tencent released Hy4, an open-source model. The company said it restricted cybersecurity training to defensive uses such as finding and fixing software flaws. It excluded material on building hacking tools, breaking into systems and testing for weaknesses.

Tencent said its internal specialists found no sign Hy4 raises the risk of software break-ins. It said the model cannot meaningfully ease harmful biological experiments. Moonshot AI limited its newest model's cyber-offensive capabilities last month.

Chen Yunji, co-founder of chip maker Cambricon, called on Friday at an event in Shanghai for universal ethical requirements, a shared "ethics checker" that all leading Chinese and American models would have to satisfy.

The Hy4 claims are Tencent's own and unverified. Tencent has said it will release the model's weights later, along with a report describing its safety testing. Whether independent evaluators like Vals and Irregular then get similar results is the open question.