AI security
The closing cyber gap: open-weight AI is four to seven months behind the frontier
On 17 July 2026, the UK government's AI Security Institute (AISI) published the first public measurement of a question defenders have been guessing at for two years: how far behind the closed frontier are the AI models anyone can download and run themselves? On offensive-cyber tasks, the answer is four to seven months. Through most of 2025 that gap was six to ten. It is closing.
The finding is narrow and technical, and it rewards being read precisely rather than through the headline. AISI tested the most capable open-weight models available, chiefly the Chinese models GLM-5.2, released in June 2026, and DeepSeek V4-Pro, and found they now perform on cyber tasks at the level the best closed models reached a few months earlier. On the narrow tasks, GLM-5.2 performs about as well as Anthropic's Opus 4.6 did in February, some four months earlier; on the harder end-to-end ranges it slips to the level of Opus 4.5, from last November, which is also where DeepSeek V4-Pro lands. Four months at the near end, seven at the far: that spread is the gap. Nobody was attacked in the study. What AISI measured is capability, in a lab, under evaluation. The direction, though, is not in doubt.
Dated analysis. Written 19 July 2026, two days after AISI published its evaluation on 17 July, from AISI's own report and coverage by The Decoder and Tech Times. The four-to-seven-month figure is an estimate from a deliberately narrow test, offensive cyber only, and AISI flags that its own setup probably understates what these models can do. Nothing here describes a real breach. This is analysis of a capability measurement, not a security advisory for any specific system.
What "open-weight" actually means
Two words carry this whole story, so it is worth being exact about them. A closed frontier model, the flagship tier like GPT-5.6 or Claude Fable 5, lives behind an API. You send a request to the lab's servers, the lab runs the model, and it sends back an answer. That arrangement puts a broker in the loop. The lab can refuse a request that reads like an attack, rate-limit you, log what you asked, and revoke your access.
An open-weight model is different. The maker publishes the model's weights, the trained parameters that are the model, for anyone to download and run on their own hardware. GLM-5.2 and DeepSeek V4-Pro are open-weight. Once the file is on your machine there is no broker: no refusal you cannot remove by fine-tuning, no rate limit but your own graphics card, and no one watching what you do with it. AISI itself found the safety refusals on the open models it tested were easily reversible once you hold the weights. This is the same downloadable-capability story as Moonshot's Kimi K3; what is new here is what the capability is being measured on.
What AISI measured, and how
AISI ran two kinds of test. The first was a set of 70 narrow cyber tasks across four difficulty levels, discrete skills such as finding a specific class of vulnerability or writing a working exploit for a known one. The second, more lifelike but weaker as evidence, was a set of cyber ranges: end-to-end simulated intrusions in which the model has to chain many steps together on its own. One, called "The Last Ones," is a 32-step attack across a simulated corporate network. On both, the leading open models sat within a few months of the frontier.
| Open-weight model | Comparable closed model | Approx. gap |
|---|---|---|
| GLM-5.2 (Jun 2026) | Opus 4.6 (Feb 2026) | ~4 months (narrow tasks) |
| DeepSeek V4-Pro | Opus 4.5 (Nov 2025) | ~5 months |
| Open field, most of 2025 | Closed frontier of the day | 6-10 months |
A worked example: the price of a near-frontier cyberattack
The gap in months is the headline, but the number that should change how you think is the price. AISI reported what each run cost. On one cyber-range test, a full multi-step simulated intrusion measured over roughly a hundred million tokens, DeepSeek V4-Pro cost about $1.19; the comparable run on a closed Opus model cost about $85. On the separate narrow-task suite the ratio holds: per task, DeepSeek V4-Pro cost about 28 cents against roughly $12.50 for the comparable Opus 4.5.
Read that as a defender. The same near-frontier cyber capability that, on a closed model, costs real money and runs through a broker who can cut you off, runs on an open-weight model for about the price of a coffee, on hardware you own, with no one in the loop. The capability was already roughly this good on the frontier months ago. What changed in the last year is that it became cheap and unsupervised.
Why this shifts the threat model, not the panic level
It is easy to over-read this, so hold two things at once. The frontier is still ahead: four to seven months is a real lead, and a benchmark score in a controlled range is not the same as a skilled human running a live intrusion against defenders who fight back. AISI's ranges had no active defenders in them. The thing that actually shifts is an assumption defenders have leaned on: that the most dangerous offensive-AI capability is gated behind a handful of labs who can refuse and revoke, and priced high enough to deter casual misuse. Both halves of that assumption are eroding on a clock AISI has now, for the first time, made legible.
The frontier still leads. What closed is the broker.
AISI puts open-weight models four to seven months behind the closed frontier on offensive-cyber tasks. The capability gap is real; the supervision gap is what disappeared.
Closed frontier model (via the lab's API)
- A broker sits in the loop The lab can refuse a request that reads like an attack, rate-limit it, log it and revoke access.
- Priced per token AISI's comparable Opus 4.5 run cost about $85; about $12.50 a task.
- Months ahead, for now Still the most capable tier on offensive-cyber tasks.
same skill, months later
Open-weight model (downloaded, self-hosted)
- No broker AISI found the safety refusals easily reversible once you hold the weights, and no one is watching what you run.
- Priced at your electricity The comparable DeepSeek V4-Pro run cost about $1.19; about 28 cents a task.
- Four to seven months behind, and closing Down from a six-to-ten-month lag through most of 2025.
The defender's old assumptions - too expensive, too gated, too far behind - each lose a little more force every quarter.
What to actually do
For almost everyone reading this, the move is not to panic; it is to update one number in your head. Stop assuming attackers are throttled by a vendor's guardrails or priced out of automation. Assume instead that the offensive capability cheaply available to anyone is roughly what the frontier could do a couple of quarters ago, and that the lag shrinks with each release. In practice that raises the value of the unglamorous disciplines, not the fashionable ones: know which internet-facing systems you actually run, patch them on the assumption that exploit development is now cheap to automate, and rehearse detection and response rather than betting the attacker cannot get in. The durable lesson is the one this site keeps returning to: when a capability becomes rentable or downloadable by everyone, your advantage is not in having it but in what you have built around it. Here, that is the boring operational muscle to find, patch and watch your own systems faster than the gap closes.
Where this reading could be wrong
Two honest caveats, one in each direction. AISI says its own testing probably understates these models: it did not do bespoke elicitation, the practice of coaxing a model to the top of its ability with tuned prompts and scaffolding, so a determined attacker might close the gap further than the report shows. Pulling the other way, the cyber-range results, the most attack-like part, come from a small sample and are the weaker evidence; the tasks had no live defenders; and this is offensive cyber only, a deliberately narrow slice of what these models do. The safe conclusion is the narrow one. The precise number will move. The trend, open-weight capability trailing the frontier by months, and by fewer months each year, is the part to plan around.
Questions people ask
What did the AI Security Institute find? AISI, the UK government's AI Security Institute, published its first public measurement of how far open-weight AI models trail closed frontier models on offensive-cyber tasks. The gap is now four to seven months, down from six to ten through most of 2025. The leading open models tested, GLM-5.2 and DeepSeek V4-Pro, performed at the level the best closed models reached a few months earlier.
What is an open-weight model? A model whose trained parameters are published for anyone to download and run on their own hardware. Unlike a closed model reached through a lab's API, there is no provider in the loop to refuse, rate-limit, log or revoke a request, and safety refusals can be removed by fine-tuning.
Does this mean open-weight models are now as dangerous as the frontier? Not quite. The frontier still leads by four to seven months, and AISI measured capability in controlled evaluations with no live defenders, which is not the same as a skilled human running a real intrusion. What changed is that near-frontier cyber capability is now cheap and unsupervised: one comparable test cost about $1.19 on an open model versus about $85 on a closed one.
What should a business actually do about it? Update one assumption: stop treating the most dangerous offensive-AI capability as gated behind a few labs and priced out of casual misuse. Treat cheap, near-frontier automation of exploit development as available to anyone, and put weight on the unglamorous defences, knowing your internet-facing systems, patching them quickly, and rehearsing detection and response.
Sources & caveats. The four-to-seven-month finding, the six-to-ten-month 2025 baseline, the two test methods (70 narrow cyber tasks across four difficulty levels; cyber ranges including the 32-step "The Last Ones"), the named models GLM-5.2 and DeepSeek V4-Pro and their closed comparators (Opus 4.6, Opus 4.5), and AISI's own caveats are drawn from AISI's report, "How Far Behind the Frontier are Leading Open Weight Models on Cyber?" (17 July 2026), and corroborating coverage by The Decoder and Tech Times. The cost figures (about $1.19 versus about $85 for a 100-million-token cyber-range run; about 28 cents versus about $15 per task) are AISI's own, as reported by The Decoder. AISI states its setup likely slightly underestimates open-weight capability, that the cyber-range evidence is drawn from a smaller set, and that the ranges excluded active defenders. That GLM-5.2 and DeepSeek V4-Pro are Chinese open-weight models (from Zhipu/Z.ai and DeepSeek) is independently documented, not a point the AISI report turns on. The "cheap and unsupervised" framing, the broker metaphor and the practical advice are mine, not AISI's.