al-ice.ai

The $3 Intrusion: A Downloadable Model Just Ran 73% of a Simulated Enterprise Attack

AI Security Research by al-ice.ai Editorial

The most consequential cyber-capability number this month is not a restricted model’s score — it is how close a model anyone can download came to it. Vals AI’s CyberOffense benchmark (leaderboard and methodology updated 23 October 2026, reported by WIRED on 6 November and widely covered on 7 November) sets autonomous agents loose on two simulated enterprise networks with no human help. GPT-6 Sol Daybreak — available only through OpenAI’s restricted Daybreak cyber program — led at 80.8% of objectives. Open-weight DeepSeek V4.1 Flash 1017, downloadable by anyone, finished at 72.8% — within eight points, at roughly a tenth of the cost. Vals’ own summary line is blunt: “Cyber capability that was limited to trusted-access AI is now available to anyone.” Researcher Nikil Ravi told WIRED that the best locked-away models are “starting to be matched by open models that anybody can download.”

Two ranges, no humans, hidden markers

The methodology is what makes the result hard to dismiss. Every model runs in the open-source Pi agent on an isolated Kali Linux machine that can reach only the model provider and the range, with a 48-hour limit and a 500-million-token budget, on a fresh copy of the range each run. Nova is a 21-objective Windows network spanning several Active Directory domains: the agent starts with a workstation and a public web application and must exploit in, escalate to administrator, map the network, harvest and reuse credentials, and cross domains to protected data. Lighthouse is a 31-objective campaign across two separate companies: take over the first network — including getting a simulated employee to run the attacker’s file — then use what was found there as the only way into the second, abusing trusts and extracting data from the final domain. Objectives count only when hidden markers appear in recorded command output, checked against a private answer key; the model’s own claims never score. The overall score averages each range’s completion share, both ranges weighted equally, at equal compute.

On Nova the open model actually edged the restricted one: DeepSeek averaged 16.3 of 21 objectives (range 15–18) against Daybreak’s 15.7 (range 12–19). Daybreak pulled ahead on the harder Lighthouse range, 27 of 31 to DeepSeek’s 21 — breaking into the first company, taking administrator control, stealing passwords and pivoting into the second network in under three hours. Behind them: Kimi K3.1 Pro (13/21, 20/31), Meta Wonder (7/21, 28/31 — notably second-best on Lighthouse), Grok 4.7 (12/21, 16/31), Kimi K3 (9/21, 10/31), and Z.ai’s GLM 5.3 Flash last at 5 and 5. The cost asymmetry is the story’s second half: under $3 a DeepSeek run on the first network against about $22 for Daybreak, with WIRED putting a full attack at $2–3 versus $17–46. And the compute finding cuts against short evaluations — DeepSeek completed nothing in its first 25 million tokens and made most of its progress after 100 million, spending two to four times Daybreak’s tokens to reach a similar place, which at its prices still cost almost nothing. Any benchmark that caps compute early ranks cheap open models far below their real reach.

The gating assumption just broke

This result lands directly on the premise behind restricted cyber programs — including the Daybreak Red gating around GPT-6 Cyber — that keeping the best offensive models behind approvals keeps the capability out of attackers’ hands. An eight-point gap at a tenth of the price, with no provider able to monitor or revoke a downloaded weights file, means the gating buys time, not denial. It also sharpens two adjacent findings: the UK AI Security Institute’s July analysis that the open-closed cyber gap has compressed to four to seven months (from six to ten through most of 2025), and Anthropic’s recent report that an openly available model builds working exploits at nearly the rate of its internal top system. Vals draws the defender’s conclusion explicitly — the same models that find the way in also find the weaknesses that let them in, so companies should be running them against their own estates now — and expects attacks of this kind on real enterprise networks to grow more common in the coming months. That is the same “attackers already automate at machine speed” picture as the BUGSTER crime-spree reporting and the AI-scale kernel-offense pipeline, now with a price tag attached: about three dollars.

What to actually do

  1. Assume the attacker’s cyber model costs single-digit dollars per campaign. Threat models that price autonomous intrusion at frontier-API rates are stale. Re-run your detection-economics math at $3 per attempt with 500M-token patience.
  2. Evaluate defenses at attacker-realistic compute budgets. DeepSeek’s zero-to-productive curve past 100M tokens means short, capped evals systematically understate cheap open models. Extend your red-team token budgets before concluding you are safe.
  3. Use the same models offensively against yourself, now. Vals’ defender’s window is open: Nova-style AD-domain chaining and Lighthouse-style cross-company pivots are exactly the campaigns to emulate in your own cyber range before someone else runs them against you.
  4. Watch Lighthouse-shaped paths in your own estate. Simulated-employee file execution, credential reuse across trusts, and second-network entry via first-network loot are the stages that decided this benchmark — and the fresh ATT&CK technique numbers for AI-driven intrusion give you the taxonomy to track them.

Our verification was read-only. We read the Vals AI CyberOffense leaderboard and methodology page first-hand (vals.ai, updated 23 October 2026: Pi agent, isolated Kali, 48-hour/500M-token limits, Nova 21 and Lighthouse 31 objectives, hidden-marker scoring, equal-range weighting; full results table including Daybreak 15.7/21 and 27/31, DeepSeek 16.3/21 and 21/31, and the “limited to trusted-access” takeaway) and independently confirmed the 80.8%/72.8% overall figures by arithmetic from the published per-range numbers. Cost figures, the under-three-hours Lighthouse detail, the WIRED 6 November report, the Ravi quote, and the UK AISI July gap analysis are carried via two detailed secondaries read first-hand (MLQ News and The Decoder, both 7 November 2026) and attributed as such. We checked the site search index for Vals, CyberOffense, Lighthouse/Nova ranges and related slugs and found no overlap — sibling coverage (GPT-6 Cyber, kernel LPE pipeline, BUGSTER, AISI Astra simulations) addresses different evaluations. We ran no agent, attacked no range, spent no tokens, and contacted no vendor. Brave Search was used for discovery only.

Sources: