AI Policy

Offensive AI Now Costs Attackers 28 Cents a Task

The UK AI Security Institute found open-weight models now run cyber tasks like frontier systems from months earlier, at a fraction of the cost, with weak guardrails.

AI PolicyBy Servola Tech Desk2026-07-193 min read

AI-assisted, edited by humans. | Editor-in-Chief: Leon Soliman | Editorial standards

Offensive AI Now Costs Attackers 28 Cents a Task

Key takeaways

The UK AI Security Institute found open-weight models GLM-5.2 and DeepSeek V4-Pro now handle cyber tasks like frontier systems from four to seven months earlier, and one ran them at 28 cents per task against about 15 dollars for a top closed model, so capable attack tooling just became cheap enough for almost anyone to self-host.
Open weights make guardrails advisory: the institute got past DeepSeek's occasional refusals by simply asking again, and a downloaded model cannot be rate-limited, audited, or switched off the way a hosted one can.
The cost of a full cyber-range pass fell from about 85 dollars on a closed frontier model to roughly 1 dollar 19 on DeepSeek V4-Pro, removing the price barrier that used to limit who could run sustained attacks.
Under NIS2 and DORA the legal duty to manage this risk falls on the operator you are, not on the lab that released the weights, so the exposure is yours to close.
Because the attack tooling is now cheap and unmonitored, the defences that pay off are the model-agnostic basics: fast patching, segmentation, tested backups, and behaviour-based detection rather than signature matching.

A government lab put open models on a cyber range

Britain's AI Security Institute has measured how close freely downloadable AI models have come to the best closed systems on offensive cyber work, and the answer is uncomfortably close. In a report published on 17 July 2026, the institute tested two open-weight models, GLM-5.2 and DeepSeek V4-Pro, across 70 cyber tasks spanning four skill levels from technical non-expert to expert, plus a longer 32-step attack scenario on its cyber range.

GLM-5.2, released in June, matched Anthropic's Opus 4.6 from February on the narrow tasks and Opus 4.5 from November on the longer ranges. DeepSeek V4-Pro landed at the level of Opus 4.5. In plain terms, the open model you can download today and run on your own hardware performs like a frontier system that was state of the art four to seven months ago.

The price of a capable attack collapsed

The gap that matters most is not months, it is money. Running the institute's cyber range with a leading closed model cost about 85 dollars for a 100 million token pass; GLM-5.2 did the same for around 46 dollars, and DeepSeek V4-Pro for roughly 1 dollar and 19 cents. Per task at full reliability, Opus 4.6 cost 15 dollars and 17 cents, GLM-5.2 cost 6 dollars and 12 cents, and DeepSeek V4-Pro cost 28 cents.

That is not a rounding difference. The same offensive capability that a year ago sat behind a frontier lab's paid interface, with its usage logging and abuse monitoring, now runs on a self-hosted model at roughly one fiftieth of the cost and with no one watching. For anyone running a European business, the economics of who can afford to probe your systems just changed.

The safety catches did not hold

Open weights do not come with a working off switch. The institute reported that its evaluations of these models were largely unimpeded by safeguards. DeepSeek V4-Pro sometimes refused a reverse-engineering request, but simply asking again was enough to get past the refusal.

This is the structural point about open-weight release. Once a model's weights are public, its guardrails are advisory, because anyone can fine-tune them away or route around them. A closed model can be rate-limited, audited, and cut off; a downloaded one cannot. The safety story for these systems is therefore about capability, not about the polite refusals a chatbot shows a casual user.

What a European operator should take from this

The takeaway is not panic, it is timing. The window in which cutting-edge offensive tooling stayed expensive and monitored is closing, and your security planning should assume that a competent attacker now has cheap, unlogged access to capabilities that were frontier-grade last winter. Under NIS2 and DORA, the duty to manage that risk sits with the operator, not the model maker.

Practically, this raises the value of the basics that do not care how the attack was generated: patch latency, network segmentation, tested backups, and detection that watches behaviour rather than known signatures. It also means the question to ask a security vendor is no longer whether they defend against human attackers, but whether their assumptions still hold when the attacker's tooling costs pennies and never sleeps.

Frequently asked questions

What did the AI Security Institute actually test?

It ran two open-weight models, GLM-5.2 and DeepSeek V4-Pro, against 70 cyber tasks across four difficulty levels and a 32-step attack scenario on its cyber range, then compared their scores and running costs to leading closed models such as Anthropic's Opus 4.5 and 4.6.

Does this mean open-weight models should be banned?

The report does not call for that. Its point is narrower and more useful: once weights are public the safeguards are hard to enforce, so defenders should assume capable offensive tooling is now cheap and widely available and plan accordingly, rather than relying on the release model to hold it back.

What should a business do differently because of this?

Treat the finding as a timing signal. Shorten patch cycles, segment networks, test your backups, and favour detection that watches behaviour over detection that matches known signatures, because those defences work regardless of how cheap or capable the attacker's AI has become.

The comfortable assumption that dangerous capability stays locked behind an expensive, monitored interface no longer holds. Plan for an attacker whose tools are cheap, private, and only a few months behind the best.

Open-weight modelsAI Security InstituteDeepSeekGLMCyber capabilitiesFrontier AINIS2AI safety

China Clears Its Top Labs to Buy Nvidia H200s

Beijing will let Alibaba, ByteDance and DeepSeek buy a capped batch of Nvidia H200s. For European buyers, the cheap Chinese model on your shortlist is about to train on better hardware.

3 min read

AI Policy

Europe Will Grade Frontier AI Itself Now

On 7 July 2026 the European Commission presented an Action Plan on Cybersecurity and Artificial Intelligence. It adds no new law and leans on NIS2, the Cyber Resilience Act and the AI Act, while building an EU capacity to test frontier models instead of trusting vendor claims. From 2 August the Commission can enforce against general-purpose AI.

3 min read

Digital Sovereignty

The EU Council Revived the Rule That Scans Private Messages

The EU Council revived the lapsed rule that lets providers scan private messages with AI. For owners, confidential communication is now a governance choice.

2 min read

← All articles