AI Policy

The Defender's AI Head Start Is Down to Months

The UK AI Security Institute measured open-weight AI at four to seven months behind the closed cyber frontier, down from six to ten in 2025. Why the defender's head start just halved, and what owners should plan for.

AI PolicyBy Servola Tech Desk2026-07-184 min read

AI-assisted, edited by humans. | Editor-in-Chief: Leon Soliman | Editorial standards

The Defender's AI Head Start Is Down to Months

Key takeaways

The UK's AI Security Institute measured that open-weight AI now matches the cyber capability of closed frontier models from four to seven months earlier, down from six to ten months in 2025, so the head start your defenders buy with the best paid model has roughly halved.
Plan security to a two-quarter clock: treat whatever the closed frontier can do offensively today as available in an unmonitored, downloadable model within about six months.
Open weights carry no rate limit, no abuse refusal and no off switch, and the safeguards around a hosted model do not travel with the file once it is public.
AISI tested two ways, seventy graded cyber tasks and autonomous cyber ranges, and found GLM-5.2 and DeepSeek V4-Pro standing where Opus 4.5 stood only months earlier.
Under NIS2 the accountability for judging this timeline sits with named management, so the six-month assumption is a board-level budget number, not an IT footnote.

A Government Lab Put a Number on the Gap

On 17 July 2026 the United Kingdom's AI Security Institute published the first empirical measurement of how far open-weight AI trails the closed frontier on offensive cyber work, and the number is smaller than the industry assumed. AISI found that the best downloadable models now match the cyber capability of closed frontier systems released four to seven months earlier. Through most of 2025 that gap ran six to ten months. The lead that closed labs held over freely available models has narrowed by roughly a third to a half in a single year.

The finding rests on two test regimes, not one benchmark. AISI ran seventy narrow cyber tasks graded across four difficulty levels, then a set of cyber ranges that measure whether a model can run an end-to-end attack against a simulated network on its own. GLM-5.2, released in June 2026, performed like closed models from four months earlier on the narrow tasks and matched Opus 4.5 on the longer ranges. DeepSeek V4-Pro tracked the same Opus 4.5, a model that shipped five months ahead of it.

The Head Start Was Never Free

The gap is the whole point of measuring it. The most capable cyber models have always been closed, reachable only through a developer's interface where the maker can watch usage, refuse abuse and switch off an account. That control is what buys defenders time: security teams with access to the strongest guarded systems can find and fix weaknesses before the same capability reaches attackers through a model nobody is monitoring.

The window is not hypothetical. In April 2026 two closed models, Mythos Preview and GPT-5.5, posted the largest single jumps in cyber capability AISI had recorded since it began testing in 2023, which triggered international warnings. The closed frontier keeps moving; the question AISI answered is how fast the open pack follows. The comparison set tells the story on its own, with GLM-5.2 and DeepSeek V4-Pro now standing where Opus 4.5, Opus 4.6 and GPT-5.3-Codex stood only months ago.

What a Months-Long Gap Means for Your Security Budget

Plan your defence around a clock that now reads months, not a year. Whatever the paid frontier can do offensively today should be treated as available inside an unmonitored, downloadable model within roughly half a year. An open model carries no rate limit, no abuse refusal and no off switch; once the weights are public, the safeguards that sit around a hosted service do not travel with them. The practical planning assumption is attacker parity with the guarded frontier on a two-quarter delay.

For an operator that reframes several line items. A patch cadence tuned to a leisurely quarterly cycle is now inside the window in which a commodity model can chain a public vulnerability into a working intrusion. Detection tooling bought on the promise that novel attacks stay rare needs to assume novel-looking attacks become routine sooner. And the security value of paying for a top closed model is real but shrinking, because the same reasoning your team rents is months from being downloadable by whoever targets you.

An Open Model Cannot Be Recalled

The asymmetry that makes this hard is permanence. A closed lab that finds its model has become dangerous can tighten filters, throttle access or pull it. Open weights, once released, are copied, stored and re-hosted beyond any single party's reach, and the guardrails a maker trains in can be stripped by anyone with the file and modest hardware. AISI's own framing is blunt: defenders have a short window before today's frontier cyber capabilities may become accessible without the same safeguards.

None of this makes open models the villain; the same openness underpins the research, auditing and sovereignty that European firms increasingly want from their software stack. It is an argument about timing. The benefit of open weights and the risk of open weights arrive together, and the risk clock is the one that just sped up. Treating the four-to-seven-month figure as a fixed law would be a mistake too, because the trend across the year is that it keeps shrinking.

The Bottom Line

Assume the attacker's tools reach the guarded frontier within about six months, and staff, patch and monitor to that assumption. Under NIS2 the accountability for that judgement now sits with named management, not a contractor, so the calendar you plan against is a board-level number. Ask your security lead one question this quarter: if a downloadable model could run an autonomous attack on our network by year end, what changes today. The honest answer is a budget line, not a reassurance.

Frequently asked questions

Does this mean open-weight AI models are more dangerous than closed ones?

No. AISI found closed frontier models are still the most capable on cyber tasks; the point is that open models now reach the same capability four to seven months later instead of six to ten. The risk is timing, because a capability you can watch and switch off today becomes downloadable and unmonitored sooner than it used to.

What did AISI actually test?

Two regimes. Seventy narrow cyber tasks graded across four difficulty levels, and cyber ranges that measure whether a model can run an end-to-end attack on a simulated network without human help. GLM-5.2 and DeepSeek V4-Pro were the open models; Opus 4.5, Opus 4.6 and GPT-5.3-Codex were among the closed comparators.

What should a European business change because of this?

Treat the closed frontier's current offensive capability as roughly six months from being freely downloadable, and set patch cadence, detection tooling and staffing to that clock. Under NIS2 the accountability for that call now sits with named management, so it belongs in the board's risk budget, not only in the IT backlog.

The gap between guarded and ungoverned AI is still real, but it is no longer measured in years. Plan for the shorter clock.

AI Security InstituteOpen weightsCybersecurityGLM-5.2DeepSeekNIS2Frontier AI

A 29-Year-Old Squid Bug Leaks Cleartext Logins

Squidbleed (CVE-2026-47729) is a one-line flaw that let any user of a shared Squid proxy read other people's cleartext HTTP requests, including passwords and session tokens. It hid in default configs for 29 years, and an AI agent found it, not a human audit.

3 min read

Cybersecurity

This Malware Deletes Your Backups First

A new attack kit called Avalon hunts your backup servers and deletes Windows shadow copies before its CrownX ransomware encrypts anything. It sat undetected for four months while evading nine major security tools.

3 min read

Digital Sovereignty

The EU Council Revived the Rule That Scans Private Messages

The EU Council revived the lapsed rule that lets providers scan private messages with AI. For owners, confidential communication is now a governance choice.

2 min read

← All articles