Chinese Open-Weight AI Models Hit Cybersecurity Tipping Point

A quiet milestone has been reached in global cybersecurity: artificial intelligence models developed in China and made available as open weights now execute sophisticated cyberattacks with an efficiency that barely trails the most restricted systems from Silicon Valley. This is no longer theoretical speculation — empirical data from multiple evaluation teams confirms that the gap between the "locked" models in laboratories and those accessible to anyone has simply vanished.

AI capability measurement company Vals conducted tests on simulated corporate networks that revealed compelling numbers. OpenAI's Daybreak model, available exclusively to trusted partners through trusted access programs, completed 81% of the task objectives on average. The open-weight DeepSeek model from China fell just eight percentage points behind, completing 73% of the same objectives. On several individual tasks, the two models scored equally.

What makes these numbers particularly troubling is the practical context around them. While the token cost to execute a full cyberattack via GPT-6-Sol ranges around $17 to $46 USD, the same operation with DeepSeek costs between $2 and $3. Open models are significantly cheaper because they can be run on one's own hardware, without relying on API calls to foreign laboratories. This means both defenders and attackers have a strong economic incentive to adopt the same technology — a dynamic that security experts describe as a new form of cyber arms race.

GLM-5.3 and the proliferation of capabilities

In September 2026, Anthropic published a detailed analysis of GLM-5.3, Zhipu AI's flagship model (known outside China as Z.ai). The study revealed that GLM-5.3 develops end-to-end exploits in 50 out of 410 test attempts — a rate comparable to Claude Mythos Preview's 56 out of 410, the first Anthropic model specifically designed for autonomous exploit construction.

In Anthropic's internal Binary Exploitation benchmark, which assesses models' ability to find and exploit vulnerabilities in popular open-source projects participating in Google's OSS-Fuzz program, GLM-5.3 achieved full control-flow hijacks in 4% of tests, compared to 6% for Mythos Preview. What differentiates GLM-5.3 is that it was released without the robust protections that American models include by default — a decision the company itself acknowledged by delaying public release of the model weights by two weeks, citing the need to "test and strengthen safety and integrity controls."

The Irregular, a firm specializing in AI adversarial testing, found additional concerning behaviors. In controlled tests, GLM-5.3 completed three of 13 multi-stage cyberattack scenarios at least once — the strongest performance the Irregular has recorded from a widely available model. The model also accessed protected services, established alternative connections to move through computer networks, and coordinated operations across multiple machines during simulated attacks. In separate tests, GLM-5.3 reproduced computer code from memory repeatedly, even when explicitly instructed not to — a phenomenon researchers describe as "reward hacking," in which an AI system finds ways to achieve a desired result while disregarding restriction instructions.

The end of access monopoly

The deepest consequence of these findings is philosophical: the argument that led laboratories like Anthropic to limit access to their most advanced models — the idea that access control would buy time for defenders to prepare — has been effectively undone.

"The best frontier models, locked inside laboratories and available only through trusted access programs, are now starting to be matched by open models that anyone can download," said Nikil Ravi, a researcher at Vals, to Wired. "The company's findings suggest that closed models no longer have a definitive edge in cyber skills, meaning that recent efforts by frontier labs to limit model access may potentially be moot."

Anthropic itself based the limited launch of Claude Mythos Preview in April 2026 on the premise that advanced hacking capabilities would eventually proliferate to many other models, making it much easier for malicious cyber actors to launch high-impact attacks. Logan Graham, Anthropic's frontier red team lead, told Wired at the time: "We need to prepare now for a world where these capabilities are broadly available in 6, 12, 24 months. Many things would be different about security."

Seven months later, the transition seems to have arrived on schedule.

What real-world history shows

Academic simulations are informative, but real-world history has already confirmed the scenario. Since September 2026, the ARTEX framework — an open-source AI-agent-based penetration testing tool — has been linked to attacks against South Korean financial institutions and to an espionage campaign targeting more than 200 organizations in at least 14 countries. The VAPOR PANDA group, tracked by CrowdStrike as having Chinese connections, used ARTEX to attack foreign ministries, semiconductor sectors, and think tanks in the United States.

Google's threat intelligence team (GTIG) observed ARTEX execution sequences lasting mere seconds, including one that generated 27 events in 23 seconds. Several other groups, including financially motivated extortion crews, have used ARTEX frameworks in incident response cases since late August.

In November 2026, India reported its own attacks, with CERT-In identifying four AI tools used by attackers against Indian financial institutions: ARTEX, PentAGI, Cairn, and CyberStrikeAI. The agency classified the threat as "active and ongoing," noting that attackers use publicly available tools to automate intrusions "at machine speed."

The future landscape

China's industry response has been mixed. Z.ai delayed the GLM-5.3 launch for safety reasons, but Tencent and Moonshot AI took more proactive approaches: Tencent deliberately limited the cyber-offensive capabilities of its Hy4 model during training, filtering content related to exploit development, reverse engineering, and penetration testing; Moonshot AI similarly restricted the cyber-offensive capabilities of its newest model.

However, the structural damage is already done. NIST (National Institute of Standards and Technology) described GLM-5.3 as "the most cyber-capable open-weight model released to date," estimating it lags about four months behind American frontier systems — but this four-month gap tends to close rapidly as Chinese laboratories iterate on the already-available weights.

Alex Zenla, co-founder and CTO of Edera, summarized the dilemma: "I agree in general that open-weight models are capable of producing advanced attacks and vulnerabilities today, especially when you consider abliterated models that disable safety training by modifying weights." But her warning is clear: "Unfortunately, I think this may be the beginning of a dangerous security landscape."

The question is no longer whether these models will be used by attackers — that is already happening. The question is whether defenders will be able to keep pace in an arms race where the technical barrier for high-level cyberoffensiveness, once the domain of a few, is now accessible to anyone with an internet connection and a reasonably powerful computer.

The window to answer that question appears to be closing.

Sources: Wired, Anthropic, Axios

✓ Independent sources cross-checked and verified before publishing