A free AI model now breaks into company networks almost as well as the best
In a security test, an AI model anyone can download came close to OpenAI's restricted hacking model at about a tenth of the cost. Attackers and defenders both have it now.
The short version
- Vals AI, a company that tests AI models, let them attack two practice company networks with no human help.
- OpenAI's restricted security model did best, but a free DeepSeek model came close for about a tenth of the cost.
- Vals expects attacks like this on real company networks to become more common in the coming months.
What the test did
Vals built two practice networks that copy a real company's setup. They have servers and staff computers, with the same kind of user accounts and security gaps real firms have. They are cut off from real systems, so an AI can attack them safely.
Each AI worked alone. It got a starting computer, the address of a public website to attack and the limits of the job. Then it ran commands until it finished or gave up. Hidden markers on each target machine showed how far it really got. Vals never took a model's own word for it.
The harder network holds two separate companies. To finish, the AI must break into the first and take control of it. It then has to steal passwords and use them to reach the second company. Both networks run on Active Directory, the Microsoft system most large companies use to decide who can log in where.
What the results show
The top score went to OpenAI's strongest model, in a version it offers only through a restricted security program. On the harder network it completed 27 of 31 goals in under three hours. It broke in and took administrator control. Then it used stolen passwords to move into the second company.
A DeepSeek model that anyone can download came second. On the first network it matched OpenAI's score for under $3 a run, against about $22. It worked slowly and made most of its progress late in each run. Because it is so cheap, letting it run for hours still cost very little.
Vals draws a blunt conclusion. Skills that used to sit behind a provider's approval process are now free to download. Once a model can be downloaded, no provider can watch or stop how it is used.
Not every free model is this capable. Several stalled early and never recovered. No model completed the final goals on the two-company network either.
What it means for your company
The strongest AI hacking skills no longer need a provider's approval. In this test, running a capable free model cost under $3 per attempt.
The test also points at where large groups are weakest. Big organizations often run a separate network for each subsidiary, joined by a few trusted links. In the test, what the AI found in one network was the only way into the next. The best model got partway along that path, into the second company.
The same tools work for defense. Vals says the models that find a way in also find the weaknesses that let them in. Your security team can use them to test your own systems before someone else does.
What to do next
- Ask your security team, or the firm you hire, to test your network with AI tools of this kind.
- Ask how long their tests run. Vals found that short tests understate what cheap models can do.
- Review who holds administrator rights in Active Directory, and where passwords are stored and reused.
- Map the trusted links between your subsidiaries' networks, and close the ones nobody needs.
- Put this on the board's risk agenda. Vals expects attacks like these on real companies soon.