Free AI models lag just 4-7 months behind closed ones on hacking skills

The best AI models that anyone can download and use freely are catching up with the closed top models when it comes to the ability to carry out cyberattacks. That is the conclusion of the UK's AI Security Institute (AISI) in a new blog post.

"Open-weight models" are models where the trained model itself can be downloaded and run by anyone. Closed models can only be used through the provider's own service.

The lead has shrunk

According to AISI, newer open models are 4-7 months behind the closed frontier models on cyber skills. An earlier internal measurement of open models released from January to September 2025 showed 6-10 months.

The most capable open model in the test was GLM-5.2 from June 2026. DeepSeek V4-Pro was also included. Testing of Kimi K3 is planned.

On a set of 70 narrow cyber tasks, GLM-5.2 matched Opus 4.6 from February 2026 and GPT-5.3-Codex. DeepSeek V4-Pro matched Opus 4.5 from November 2025.

In a more realistic test, "The Last Ones," the models had to carry out a simulated attack on a corporate network in 32 steps. The task is estimated to take human experts about 20 hours. Here, GLM-5.2 reached the level of Opus 4.5, while DeepSeek V4-Pro fell below Sonnet 4.5. In that test, the lead is up to roughly 7 months.

Far cheaper

A run in the test environment of 100 million tokens (the unit AI models are billed in) cost about $85 with Opus 4.5 or 4.6, about $46 with GLM-5.2 and about $1.19 with DeepSeek V4-Pro.

The Cloud Security Alliance (CSA), which reports AISI's results, says DeepSeek V4-Pro costs about $0.28 per task versus roughly $15.17 for Opus 4.6.

Risk of misuse

AISI points out that open models have fewer safeguards, and that protections cannot be reinstated once a model has been released. DeepSeek occasionally refused tasks, but this could be bypassed with repeated attempts.

CSA assesses that availability matters more than raw capability: Downloaded models cannot be recalled, monitored or updated, and the combination of a narrower gap and low costs creates, according to CSA, a persistent and irreversible risk of misuse.

AISI recommends that organizations use the window of time the lead provides to strengthen basic cybersecurity and AI-enhanced defense.

Caveats

AISI made only limited efforts to get the most out of the models and estimates that the method may slightly underestimate their abilities. The evaluation covers only cyber. The test environments lack defensive features such as monitoring or intrusion detection and provide a weaker basis for comparison than the task set. And because the closed models are advancing quickly, the comparison keeps shifting.