Chinese open models near OpenAI's gated frontier system on autonomous hacking, at a tenth of the cost

A Dealroom report published November 6 lands on an uncomfortable finding: in evaluations where AI agents attack simulated enterprise networks unaided, Chinese open-weight models have drawn close to the frontier model OpenAI releases only through a restricted security program, at a fraction of the cost.

The tests differ from the usual capture-the-flag style security benchmark. Agents face simulated company networks with servers, workstations, accounts and realistic gaps, and must chain reconnaissance, credential theft and lateral movement toward control of key systems without human help, with every step depending on the one before it.

Cost is the sharpest contrast. The closed frontier model is reachable only inside a vendor-controlled access programme, with prices and quotas set by the provider. Open-weight alternatives can be downloaded and self-hosted, performing the same tasks at roughly a tenth of the cost per attempt and without usage limits.

Control is the harder problem. Once weights are public, no provider can monitor or stop how the model is used; abuse detection, rate limits and access approvals all stop applying at the point of download.

The evaluation also found that capability scales with runtime. Agents kept completing objectives as they consumed more compute, with some models doing most of their work only after very long runs, which suggests short tests understate what these systems can do.

The same skills cut both ways. Models that find a way into a network also find the weaknesses that let them in, so defenders can use them to test and patch their own systems first. The report's expectation is that attacks of this kind on real enterprise networks will become more common in the coming months.