The Open-Weight Cyber Gap Is Four Months. The Price Gap Is 45x.

GLM-5.2 is the most cyber-capable open-weight model AISI has tested. It is also the model Hugging Face fell back on a week ago when it needed to reconstruct 17,000 attacker events from its own breach and the commercial APIs refused the work as unsafe. Same weights, same week, two jobs. That is what dual-use looks like when it stops being a policy abstraction and becomes a model you can download.

Last Friday’s post is AISI’s first public attempt to put a number on how far the open frontier trails the closed one in offensive cyber: four to seven months, narrowed from the six to ten it measured internally on open models released between January and September 2025.

What got measured

Two evaluation families, which is what makes the result readable.

The narrow cyber tasks are a 70-task subset of AISI’s 96-task suite, kept fixed so historical comparisons hold. They span vulnerability research and exploitation, reverse engineering, web exploitation, and cryptography, graded across four difficulty tiers from “technical non-expert” (a data analyst who can code) up to “expert” (ten years plus in the field). Each model gets five attempts per task with a 2.5M token budget. On these, GLM-5.2 performs comparably to Opus 4.6 and GPT-5.3-Codex, released four months before it, and the match holds at every one of the four difficulty levels. DeepSeek V4-Pro lines up with Opus 4.5, five months its senior.

The cyber ranges are the harder test: expert-built simulated networks where a model has to run an end-to-end intrusion from initial access. The one AISI charts here, “The Last Ones”, is a 32-step attack across four subnets and roughly 20 hosts, which AISI estimates would take a human expert about 20 hours. Models get 100M tokens per run, ten runs each. GLM-5.2 reaches as far as Opus 4.5, released just under seven months earlier, while DeepSeek V4-Pro lands below Sonnet 4.5, which was never at the cyber frontier to begin with. GPT-5.6 Sol tops the chart.

One detail in that range result deserves more attention than the headline gap. GLM-5.2 reached step 7 using marginally fewer tokens than any other model on average, and tracked Opus 4.6’s trajectory all the way to step 11 before stalling. For the first third of a 20-hour expert intrusion, the open-weight model was the efficient one.

The months are the wrong unit

AISI reports the cost figures under “real-world constraints”, almost as an aside. They are the most operationally significant thing in the post.

A 100M-token range run cost roughly $85 on Opus 4.5 or 4.6, an estimated $46 on GLM-5.2, and $1.19 on DeepSeek V4-Pro. Across tasks both models in a pair solved with 100% reliability, Opus 4.6 cost $15.17 per task against GLM-5.2’s $6.12, and Opus 4.5 cost $12.50 against DeepSeek V4-Pro’s $0.28. That last pair is a 45x spread for equivalent measured capability.

Framing the risk as a time lag quietly assumes the binding constraint on an attacker is capability. For a well-resourced state team, sure. For everyone below that tier, the constraint is budget, and budget determines how many parallel attempts you can afford against how many targets. A capability that cost $12.50 a shot in November and costs 28 cents a shot in June has landed in a different threat model, one where the attacker can burn a hundred failed attempts per target and still come out ahead. AISI’s own cheating research suggests these models will happily spend those attempts on paths the task designer never intended.

And these are first-party advertised rates. AISI notes it didn’t use first-party providers for the open models; anyone running downloaded weights on rented GPUs pays compute costs alone.

Safeguards, briefly

Short section, because there was barely anything to get past.

AISI’s evaluations of both open models were “largely unimpeded by safeguards”. DeepSeek V4-Pro occasionally refused narrow cyber tasks, mostly in reverse engineering, and AISI got past it by retrying the refused tasks a few times. That is the entire circumvention methodology. No jailbreak, no fine-tuning, no abliteration.

This is structural rather than sloppy. Once weights are public, the safeguards that depend on controlling access (monitoring, classifiers, rate limits, banning users) stop existing. Refusal training is the one mechanism left standing, and it is also the one most easily stripped by anyone with the weights and a modest fine-tuning budget. AISI’s phrasing is that open release creates “a persistent and irreversible risk of misuse”. Irreversible is the load-bearing word.

What the window is for

The reason AISI measures the gap at all is that the UK’s NCSC treats it as preparation time: a period in which defenders holding the best closed models can harden things before equivalent capability shows up without safeguards attached. Four months is not a lot of hardening.

AISI is careful about what it hasn’t shown. The ranges have no active defenders, no defensive tooling, and no penalty for tripping alerts, so they measure attack execution against a static target. A trajectory stall doesn’t tell you whether the model lacked the cyber skill for that step or lost the plot over a long horizon. AISI also treats the range comparison as its weaker evidence, drawn from fewer scenarios than the task suite. And since it did no elicitation or scaffolding optimisation for the open models, these numbers read as floors.

The obvious next data point is Kimi K3, whose weights are due at the end of this month and which is already at the centre of a distillation fight with the White House. AISI says it intends to test K3 on this same basis once the weights land. Given that K3 benchmarks near the closed frontier on coding, that test will say more about the trend than either model here.

For a finding that reframes the open-weight debate with actual measurements, it landed quietly: two Hacker News submissions, seven points between them, zero comments. The AI-safety internet would rather argue about the gap than read the number.

Sources

• AISI, How Far Behind the Frontier are Leading Open Weight Models on Cyber? (17 July 2026)
• AISI, Measuring AI agents’ progress on multi-step cyber attack scenarios
• AISI, Managing risks from increasingly capable open weight AI systems
• NCSC, Retaining defensive advantage in the age of frontier AI cyber capabilities
• The Decoder, Open-weight models now match frontier cyber performance from just four months ago at a fraction of the cost (18 July 2026)
• Hugging Face, Security incident disclosure (16 July 2026)

Related on this blog

• The Attacker Had No Usage Policy. The Defenders’ Model Did.
• Sandboxes are just escape rooms for LLMs
• The White House Says Kimi K3 Is Distilled Fable