Vals AI's CyberOffense ranges put Claude Opus 5.5 first at 77.1%, with open-weight DeepSeek V4.1 Flash matching GPT-6 Sol Daybreak on the Windows network range at about a tenth of the cost
Vals AI's CyberOffense benchmark, updated November 10, runs models through three ranges with the open-source Pi agent, a 500-million-token budget and a 48-hour limit: Nova, an Active Directory network with 21 objectives; Lighthouse, with 31 objectives; and Watershed, a simulated AWS environment whose scores are marked provisional. Its three-range averages: Claude Opus 5.5 77.1%, GPT-6 Sol Daybreak 65.9%, DeepSeek V4.1 Flash 1017 54.8%, Kimi K3.1 Pro 53.8%, Meta Wonder 47.2%, Grok 4.7 42.3%, Kimi K3 25.0%, GLM 5.3 Flash 18.3%. On Nova, DeepSeek scored 16.3 of 21 against Daybreak's 15.7, at about $2 a run against about $22. Vals writes: "Once a model's weights are public, no provider can monitor or stop how it is used." Earlier press accounts carry different figures that do not match the live page.
Dream says a suspected China-nexus actor chained the PHP2Shell flaws with a kernel bug to root 25 PAN-OS firewall and management servers, with Claude Code in its attack infrastructure
Dream says an attacker used "a custom, non-public build" of the PHP2Shell exploit chain (CVE-2026-109618 and CVE-2026-109619), paired with the Fragnesia kernel privilege escalation (CVE-2026-46300), to root 25 PAN-OS firewall and management servers in the US, Japan, Taiwan and South Korea. In a US government-affiliated environment, the attacker zeroed in on three servers: two firewalls and an internal firewall management server reached through a reverse SSH tunnel. Dream found Claude Code installed on the attack infrastructure and an AI offensive platform, aiscan, configured with DeepSeek and Kimi models. It says the code's structure and style across about 40 scripts "suggest AI-assisted development" but that it has no direct evidence that AI tools wrote the exploit or scripts.
Moonshot says it removed cyber data from Kimi K3.1 Pro's training before releasing the weights, and that doing so cut its own exploit-benchmark score from 90.5% to 81.0%
Moonshot AI says it identified and removed cyber-related data from both the mid-training and reinforcement-learning stages of Kimi K3.1 Pro, and that on its in-house xdev-bench-hard vulnerability discovery and exploitation set a checkpoint without those measures solved 90.5% at pass@3 against 81.0% for the released model. It says it aims "not to release open weights that would extend the absolute frontier of cyber capability" and that full weights would be released by November 4, 2026.
OpenAI names Moonshot AI in a campaign to extract its models' protected reasoning
OpenAI says it disrupted “a coordinated campaign designed to extract protected reasoning from our models” and links the activity to “individuals associated with Moonshot AI, the developer of Kimi.” It dates the campaign from July 1 and says it was fully disrupted by July 28, with high-volume spikes on July 24–25 of “16,000 requests using a relevant extraction pattern from over 4,000 users” and related activity across “a cluster of more than 15,000 users.” OpenAI says it banned or restricted fraudulent accounts, strengthened signup and infrastructure controls, expanded monitoring and “closed a pathway that allowed someone who already possessed another user's encrypted reasoning to replay it.” Two limits are its own: “it is unclear whether all operators we observed during the relevant time period originated from a single actor,” and the extractions it counts are attempts rather than confirmed successes.
Anthropic reports the open-weight GLM-5.3 building end-to-end exploits at nearly its own frontier model's rate, and says stripping its refusals cost about $4,400 (via The Next Web)
Anthropic published an evaluation of GLM-5.3's cyber capabilities, which Gigazine dates to September 29 — the only one of the three pages opened here that gives a date for the report itself. The Next Web reports that on ExploitBench “GLM-5.3 built end-to-end exploits in 50 of 410 attempts. Mythos Preview did so in 56,” and that on an internal binary-exploitation set “GLM-5.3 achieved a full control-flow hijack in 4% of 100 tasks, against 6% for Mythos Preview,” while “earlier models, Claude Opus 4.6 and GLM-5.2, managed none”; Gigazine's account of the same comparison also lists Kimi K3 and DeepSeek-V4.1-Flash at a 0% success rate. On safeguards, The Next Web reports that “telling the model it was an autonomous red-team agent got it to engage 64% of the time,” “prefilling its reasoning so it appeared to have agreed raised that to 92%,” and that “a copy with its refusals edited out engaged every time” — an abliterated copy it puts at “roughly $4,400” and “about 2,200 GPU hours” to produce. Business Standard's account of the report has the refusal rate on JailbreakBench and HarmBench falling “from above 90 per cent to around 3 per cent and 2 per cent” after abliteration, puts one exploit-development task at “$20.40 at Zhipu's API prices” using GLM-5.3-Flash, and records the scope limit: “the tests were conducted in isolated, sandboxed environments rather than live systems.” Both Business Standard and Gigazine report that NIST's CAISI has called GLM-5.3 the most cyber-capable open-weight model released to date; no CAISI primary was opened for that. Anthropic's own post could not be opened, so every figure here is carried as the outlet named for it quotes it, and Z.ai has not responded on any page opened here.
Given root inside a sandbox, four frontier models found their way back out to the network
Perplexity's Secure Intelligence Institute reports a month-long red team of SPACE, the Firecracker-based microVM sandbox behind Perplexity Computer, in which nine model configurations — among them Claude Opus 5.0, GPT-5.6 Sol, GPT-5.6 Cyber, Gemini 3.1 Pro, Kimi K3, GLM 5.2, Grok 4.20, DeepSeek V4 Pro and Qwen 3.8 27B — were given root inside the guest VM and, in some runs, the sandbox source code. No run escaped the VM-to-host boundary in 108 attempts, and no run beat a no-network configuration in 54 attempts; with partial network access allowing package repositories, four models got out, using forged DNS responses and the shared IP addresses of public package CDNs. The institute says "eight of the ten third-party sandbox platforms" it also tested "exhibited at least one network-policy bypass," and cautions that "cases in which the boundaries held should not be interpreted as evidence that they are perfectly secure."
Anthropic names seven China-based AI companies it says ran industrial-scale distillation against Claude
The Hacker News, reading Anthropic's September 2026 misuse report, says the company attributes illicit distillation campaigns to seven China-based labs and gives each a tracking identifier: Alibaba (GTG-16005), Moonshot AI (GTG-16002), DeepSeek (GTG-16001), Zhipu/Z.ai (GTG-16006), Xiaomi (GTG-16008), SenseTime (GTG-16012) and MiniMax (GTG-16003). It reports 151 million exchanges attributed to Alibaba from more than 3,500 fraudulent accounts between May and July 2026, 23 million to Moonshot from 5,380 accounts over the same window with almost 300,000 customer requests relayed in ten days, and more than 12.1 million to DeepSeek over 14 days in July. Five of the seven — Alibaba, Moonshot, DeepSeek, Z.ai and MiniMax — also appear in the September 8 NSA/CISA/FBI advisory; Xiaomi and SenseTime do not, and StepFun, which the advisory names, is not among Anthropic's seven.
A preprint tracking penetration-testing agents finds the limit is planning, not memory
A September 9 preprint compares two PentestGPT-based systems, “a legacy human-in-the-loop system running the open-weight Kimi K2.5, and a newer autonomous system running Claude Opus 4.8.” Across three public targets the autonomous system solves all three, “including the two the legacy system never finishes,” while the legacy system “completes about half the subtasks, while running on ordinary university GPUs with no provider guardrails.” Adding a coverage-memory layer to both systems improved neither, and the authors write that in the stalled runs they could review, “the limiting factor appeared to be planning and commitment rather than lost memory: agents held the evidence for a route forward and never turned it into a concrete exploitation hypothesis.” The authors caution that they “can describe the trend but not explain it, since model, harness, autonomy, and memory architecture all change together.”
NSA, CISA and FBI name six China-based AI companies running industrial-scale distillation campaigns against US frontier models
The joint advisory says DeepSeek, Moonshot AI, Alibaba, MiniMax, StepFun and Z.AI “extracted billions of tokens across millions of exchanges/requests from U.S. frontier AI models” — naming the Claude, GPT, Gemini and Grok families — “since at least late 2024,” routed through a gray market of API proxies the advisory calls “transfer stations,” which resell frontier-model access below official prices, and through pools of accounts running concurrent sessions with load distribution. It states that “distillation is not a supplement to these companies' AI model development, but the critical core of it,” says Z.AI distilled “billions of tokens of GPT-5.5 data and Claude Opus 4.8 data,” and calls DeepSeek's publicly quoted $5.6M training cost misleading because it excludes the cost of the data acquired this way.
Kimi K3 is the first open-weight model to record a verified solve on Irregular's scenario suite
Irregular reports that Kimi K3, a 2.8-trillion-parameter mixture-of-experts model with 104 billion active parameters, is the first open-weight model it has evaluated to record a verified solve on CyScenarioBench, where GLM-5.2 solved none. On the harder FrontierCyber suite Kimi K3 produced no verified solves. Irregular states the strongest closed frontier models still hold a clear advantage in converting technical capability into sustained operational success, and publishes no numeric scores on the page.
Rapid7 finds a crypto-fraud crew used Claude Code to build and run a vishing pipeline against wallet users
Rapid7 Labs, analysing an exposed web directory and recovered session logs from a cryptocurrency fraud operation it named ASTERIX, found the operators used Anthropic's Claude Code to manage target lead lists and configure network infrastructure — cleaning a dataset of more than 103,000 Polish phone numbers and setting up scripts to validate numbers against Crypto.com and Kraken accounts — as part of a pipeline of phishing, vishing and fake wallet apps built to steal recovery phrases. The exposed server held roughly 885,000 phone numbers across 54 countries. When the operator asked Claude to help obfuscate a malicious build, Claude declined, and the operator switched to Moonshot's Kimi model with a jailbreak prompt.
Two open-weight models match a frontier model on a re-run of previously unsolved AI red-team tasks
Dreadnode re-ran 13 AIRTBench tasks that had previously been unsolved or solved by only one model. GLM-5.2, Kimi-K3 and Claude Sonnet 5 each solved 10 of 13 at AIRT@1, Qwen3.7-Plus and Nemotron-3-Ultra 6 of 13, and Trinity-Large-Thinking 1 of 13. The authors call it a system-level follow-on rather than a controlled model-only rerun and say AIRT@1 should be read as a snapshot, not a pass@k reliability estimate.
UK AISI and US CAISI jointly assess Kimi K3 — safeguards did not stop it attempting offensive cyber
A joint preliminary assessment puts Moonshot's open-weight Kimi K3 at 32% on ExploitBench against GLM-5.2's 24%, still short of US frontier models: it achieved arbitrary code execution on 0 of 41 samples versus 20 of 41, and reached step 17 of the 32-step "The Last Ones" attack path versus 28.5. The institutes state plainly that Kimi K3's safeguards did not prevent it from attempting exploit development or offensive cyber operations during the evaluations.
NIST director Arvind Raman named acting CAISI head after Fall's exit
NIST Director Arvind Raman was named acting director of the Center for AI Standards and Innovation after Chris Fall resigned on July 20 — about three months in, and after a predecessor who lasted under a week. Two days later CAISI co-published the Kimi K3 cyber assessment with UK AISI, its first public output in months.
Planting guardrail-tripping text in decoy resources cut offensive AI agents' success by about 90% in one vendor's range
Tracebit, which deploys canaries as a product and offers context bombs as an option, published a July working paper testing them — "a short piece of text designed to trigger safety guardrails in offensive AI agents", planted in a decoy such as a Secrets Manager secret — across 152 scored attack runs in a range of roughly 300 AWS resources with ten distinct attack paths. It gives all-model average full-account-admin success falling from 57% to 5%, full compromise from 36% to 1% and completion of any attack path from 91% to 15% across Opus 4.8, Gemini 3.1 Pro, GLM 5.2, DeepSeek 4 Pro and Kimi K2.6, with Opus 4.8's admin rate going from 93% to 0%; Tracebit says it is "still working to try to assess OpenAI models reliably in the range".