AI Agents Can Breach Corporate Test Networks Autonomously
Vals AI found that autonomous agents can navigate simulated corporate networks and reach admin-level access without human help.
Illustration made on Lumeta with GPT Image 2.5Make one like it
Vals AI said on Nov. 7, 2026 that open-weight models came much closer to restricted frontier systems in its CyberOffense tests, with Deepseek V4.1 Flash 1017 reaching 72.8 percent of Nova objectives versus 80.8 percent for GPT-6 Sol Daybreak, while costing about $3 per run instead of roughly $22. That matters because the same agentic skills that can automate intrusions can also be used by defenders to test and harden their own networks now.
What Vals found
Vals built a benchmark called CyberOffense that simulates realistic corporate networks. Each agent starts from an isolated Kali Linux machine with only a public web address and no human help, then has to move from a web app into Windows systems and higher-privilege access. In the Nova scenario, GPT-6 Sol Daybreak led overall, while Deepseek stayed close and much cheaper. In the harder Lighthouse scenario, the table shows Meta Wonder at 28 of 31 objectives, GPT-6 Sol Daybreak at 27 and Deepseek V4.1 Flash 1017 at 21.
Illustration made on Lumeta with GPT Image 2.5Make one like it
Why this matters
Vals says longer runs are critical to understanding what these systems can really do. Deepseek reportedly scored nothing in its first 25 million tokens and made most of its gains only after 100 million, which means short tests can understate open-model capability. That fits earlier research too. The UK's AI Security Institute said in July that the gap between open and closed frontier models in cyber tasks had narrowed to four to seven months, down from six to ten months for most of 2025. The same study also found large price gaps, with a Deepseek V4-Pro cyber-range run at $1.19 versus $85 for Anthropic Opus 4.5. Anthropic separately reported that GLM-5-3 could build exploits at nearly the same level as its internal top model Mythos.
What security teams can do now
- Re-test internet-facing apps, identity systems and privilege paths with agent-style red-team exercises, not just narrow point checks.
- Budget for longer evaluations. Short runs may miss what a model can do after tens or hundreds of millions of tokens.
- Assume open-weight models will be used offensively once weights are public, because access controls from a provider no longer apply.
- Use the same class of models on defense to find weak paths before attackers do, especially around web entry points, Windows hosts and admin rights.
What is the Vals CyberOffense benchmark?
It is a test environment that simulates realistic corporate networks. An AI agent starts from an isolated attack machine with only a public web address, then has to discover and execute the steps needed to move deeper into the network and reach higher-privilege objectives.
Which model did best in Vals' results?
GPT-6 Sol Daybreak posted the top Nova result at 80.8 percent of objectives. In the Lighthouse table, Meta Wonder reached 28 of 31 objectives, with GPT-6 Sol Daybreak close behind at 27.
Does this mean open models are already better than closed ones?
Not across the board. Closed models still led on some measures, but the gap is smaller than before and some open models are much cheaper, which makes the overall trend more important than any single leaderboard slot.
Why do longer runs matter so much?
Because some models make little visible progress early, then improve sharply after much larger token budgets. Vals says Deepseek made most of its progress only after 100 million tokens, so short tests can miss its real ceiling.
