The results of the Vals benchmark
Artificial intelligence agents are capable of penetrating realistic corporate networks on their own. This is what emerges from the Vals CyberOffense benchmark, reported by The Decoder, which simulates corporate environments to test the offensive capabilities of models: each agent works autonomously on an isolated machine, starting from only a public web address and without any human support.
The best result is that of GPT-6 Sol, part of OpenAI's restricted Daybreak cyber program, which achieved 80.8 percent of the objectives. Not far behind is DeepSeek V4.1 Flash 1017, a freely available open-weight model, which reaches 72.8 percent at a cost of about $3 per run versus about $22 for OpenAI's system. As Vals researchers observe, once a model's weights are made public, no provider can control or limit its use any longer.
The most difficult test and the time factor
In the most complex test, called Lighthouse, Daybreak took administrative control of a first company, stole its passwords, and used them to breach a second company: 27 of 31 objectives completed in less than three hours. DeepSeek stopped at 21 objectives, at one-tenth of the cost, and according to the source was not limited solely by the model's safety measures.
A relevant element concerns the duration of the trials. DeepSeek produced no results in the first 25 million tokens and made most of its progress only after 100 million: short tests, therefore, underestimate the real potential of open models. Vals also notes a possible defensive upside, because the same models capable of exploiting vulnerabilities can help companies identify and correct them in advance. According to the researchers, attacks on real networks could increase in the coming months.
The comparison with the UK analysis and the open questions
The data are consistent with a July analysis by the UK's AI Security Institute (AISI), according to which the gap between open and closed frontier models in cyber capabilities has narrowed to four to seven months, versus the six to ten months that characterized much of 2025. AISI also points to a stark cost gap: a session in a cyber range costs $1.19 with DeepSeek V4-Pro and $85 with Anthropic's Opus 4.5, while safety measures for open models proved largely ineffective.
The picture is completed by an Anthropic study according to which the free GLM-5-3 model is capable of building exploits at a level almost equal to that of the leading internal model Mythos. Several aspects remain to be clarified: the material does not specify the complete test methodologies or the exact conditions of the simulations, and predictions about the increase in attacks are attributed to the researchers, not to observed data. Indications of individual models' performance should also be considered benchmark results, not measures of capabilities in real-world scenarios.
