Risky Business says open-weight models have closed on frontier ones for offensive cyber work
Five Eyes cyber agencies issued a call-to-action saying AI is accelerating the speed, scale and sophistication of cyber threats. Risky Business reads it as the agencies' view that limiting AI's offensive capabilities to benign actors is no longer possible.
The Watch · Security desk
Key figures from the OALABS case. GPT-5.2 flagged one usage policy violation across more than 1,000 sessions with a hacker who framed his requests as an authorised red team engagement. Using Opus 4.5 and GPT-5.2, he hacked at least 14 companies in partially automated attacks.
| Figure | Value | Note | Claim |
|---|---|---|---|
| Usage policy violations GPT-5.2 flagged | 1 violation | 12 | |
| Sessions, more than | 1,000 sessions | 12 | |
| Companies hacked, at least | 14 companies | using Opus 4.5 and GPT-5.2 | 7 |
What happened
- An independent safety evaluation compared Kimi 2.5 with Opus 4.5 and GPT-5.2, the frontier models at its release, and found it competitive on structured cyber security tasks.
- OALABS Research reported in the week before the call-to-action that one hacker used Opus 4.5 and GPT-5.2 in partially automated attacks on at least 14 companies.
- The hacker framed his requests as an authorised red team engagement, and GPT-5.2 flagged only one usage policy violation across more than 1,000 sessions.
- Kimi 2.7 Code was released the same preceding week, and Uren says he has seen no independent evaluation of it.
Why it matters
- decision Defenders who assume vendor-side refusals will slow attackers have weak evidence for it here, and a locally run model has no vendor to refuse anything.
- exposure Any organisation with internet-exposed services is in scope for an operator who can supply only vague prompts and let the model do the research and exploit writing.
- contradiction The shrinking-window claim leans on orchestration and workflow speed. The one evaluation cited has Kimi 2.5 behind on discovery and exploitation, so gains there for newer open models remain an expectation.
The sharper claims here are Tom Uren's reading of the Five Eyes position, written for the Risky Business newsletter. He says the agencies believe it is no longer possible to limit AI's offensive cyber capabilities to benign actors [2]. He writes that "AI is lowering barriers for malicious actors and shrinking the window between vulnerability discovery and exploitation," and that organisations need to be ready [3]. Those are his words for the agencies' thinking.
His evidence for open-weight parity is narrower than that framing. Kimi 2.5 was released in late January. Opus 4.5 came out in late November and GPT-5.2 in mid-December [6]. That is a lag of about two months and about six weeks [14]. The evaluation that scored Kimi as competitive on structured tasks also found it weaker at vulnerability discovery and exploitation [5]. In our view the record supports "close on orchestration" and nothing wider.
Uren does not claim full automation. He writes that threat actors cannot simply ask open-weight models to run completely automated campaigns, but that for expert users the models are speeding up offensive workflows and vulnerability discovery [16]. As examples of researchers finding bugs with open-weight models, he links an interview with Niels Provos and a post by Karsten Nohl [18].
The workflow case is the OALABS report. The hacker's operational security was poor, and OALABS obtained his working directory from a compromised host he launched attacks from [8]. He got results anyway. OALABS wrote: "What stands out most is how little the attacker needed to provide to get meaningful results." [9] It added: "In many cases, the attacker supplied only vague, low-skill prompts and allowed Claude to fill in the gaps: researching exposed services, identifying possible vulnerabilities, writing exploit code, validating access, and harvesting data." [10]
Uren argues the same hacker could now reach that level of automation with Qwen 3.6 hosted locally, because Opus 4.5 and GPT-5.2 are no longer frontier models [19]. The newsletter does not cite a test of that claim. He adds that open-weight models come with guardrails that are ineffective and easy to remove [11], then cautions that it is easy to put too much emphasis on guardrails [13].
What to watch
- An independent evaluation of Kimi 2.7 Code, to see whether the vulnerability discovery and exploitation gap seen in Kimi 2.5 has narrowed.
- A published test of a locally hosted model such as Qwen 3.6 against the workflow OALABS documented.
- The text of the Five Eyes call-to-action itself, to check whether the agencies state the access-limits conclusion that Risky Business attributes to them.
Clarity's read
What the record supports and how the coverage leans. The claims behind it follow.
Reality
- Evidence50
- Adoption
- Insufficient
- Hype gap+25
- Incentives
- Insufficient
- Confidence45
Claim ledger
Ranked by verification strength, evidence, and original report placement.
- [1]
The Five Eyes cyber security agencies issued a call-to-action warning that AI is accelerating "the speed, scale, and sophistication of cyber threats".
- [2]
Tom Uren writes that the Five Eyes believe it is no longer possible to limit AI's powerful offensive cyber security capabilities to benign actors.
- [3]
Uren writes that AI is lowering barriers for malicious actors and shrinking the window between vulnerability discovery and exploitation, and that organisations need to be ready.
- [4]
An independent safety evaluation of the Chinese-made Kimi 2.5 compared it to Anthropic's Opus 4.5 and OpenAI's GPT-5.2, the frontier models available at its release, and found Kimi "performs competitively on structured cyber security tasks".
- [5]
The same evaluation found Kimi 2.5 was not as good at vulnerability discovery and exploitation as the frontier models.
- [6]
Opus 4.5 was released in late November, GPT-5.2 in mid-December, and Kimi 2.5 in late January.
- [7]
A report from OALABS Research, released in the week before the call-to-action, describes how a single hacker used Opus 4.5 and GPT-5.2 to hack at least 14 companies in partially automated attacks.
- [8]
OALABS was given a copy of the hacker's working directory on a compromised host he was launching attacks from; his operational security was poor.
- [9]
OALABS wrote: "What stands out most is how little the attacker needed to provide to get meaningful results."
- [10]
OALABS wrote: "In many cases, the attacker supplied only vague, low-skill prompts and allowed Claude to fill in the gaps: researching exposed services, identifying possible vulnerabilities, writing exploit code, validating access, and harvesting data."
- [11]
Uren writes that open weight models come with ineffective and easy-to-remove guardrails.
- [12]
The hacker framed his requests as occurring in an authorised red team engagement, and in more than 1,000 sessions GPT-5.2 flagged only one usage policy violation.
- [13]
Uren writes that it is easy to put too much emphasis on guardrails.
- [14]
Kimi 2.5 was released about two months after Opus 4.5 and about six weeks after GPT-5.2.
- [15]
Uren writes that freely available open weights models have closed the gap with frontier models to the extent that they are now extremely useful in orchestrating various offensive cyber security tasks.
- [16]
Uren writes that threat actors cannot just ask open weight models to conduct completely automated campaigns, but for expert users open weight models are accelerating offensive workflows and vulnerability discovery.
- [17]
Kimi 2.7 Code was released in the week before the call-to-action; Uren has not seen an independent evaluation but expects improved coding performance to mean it is better at some cyber security tasks.
- [18]
Vulnerability researchers are getting better at using open weight models to find bugs even when the models are less capable than the newest frontier releases; Uren links an interview with Niels Provos and a post by Karsten Nohl.
- [19]
Uren writes that Opus 4.5 and GPT-5.2 are no longer frontier models and the hacker could easily achieve the same level of automation now with something like Qwen 3.6, a locally hosted model.
Get this ledger inside ChatGPT. Ask about any of our stories and the answer brings its figure, each claim’s verdict and the sources. Free, no account.
Sources
1 independent publisher whose own reporting we read for this story.
- news.risky.bizwe've said before
1 article · October 14, 2026
Topics and entities
Follow any of these and your For You feed starts watching them — no settings page required.
Topics
- AI and offensive cyber operationsFollow
- Open-Weight Model PublishingFollow
- AI Guardrails and Safety MechanismsFollow