UK: gap between open and closed AI models on cybersecurity shrinking

The UK government's AI Security Institute published the first public analysis of how far leading open-weight models trail proprietary frontier models specifically on cybersecurity tasks. The results show a marked acceleration in open-source capability development.

On a benchmark of 70 evals for narrow, specific cybersecurity capabilities, GLM-5.2 performed closest to Claude Opus 4.6, which was released 4.3 months earlier. DeepSeek V4-Pro positioned itself between Claude Opus 4.5 (released in August 2025) and GPT-5 (released in November 2025). This represents a compression of the historical gap: through most of 2025, the Institute measured lags of 6 to 10 months. The Institute intends to evaluate Kimi K3, a Chinese model, once its weights become publicly available.

For longer-horizon cyber range tasks—which test an AI system's ability to chain multiple capabilities together to complete full hacking operations—the gap widens somewhat. GLM-5.2 reaches the level of Opus 4.5 (released less than 7 months before), while DeepSeek V4-Pro falls below Sonnet 4.5, a model released 7 months earlier. The Institute attributes this larger gap to open models' sometimes lacking the "generalization magic juice" that distinguishes proprietary systems, a phenomenon industry participants call "big model smell."

The Institute's central concern is temporal: as the frontier-to-open lag shrinks, "cyber defenders have a short window to prepare before today's frontier cyber capabilities may become accessible without the same safeguards" employed by proprietary companies. Once open-weight models with frontier cybersecurity capabilities are released, they become permanently distributed and impossible to recall, fundamentally shifting the balance between offense and defense.

The UK AI Security Institute's analysis reveals a structural shift in the AI landscape: the technical capability gap between closely guarded proprietary models and freely available open-weight alternatives is contracting faster than previously observed. Through 2025, this gap averaged 6 to 10 months; now it has narrowed to 4 to 7 months for cutting-edge capabilities. This trend is driven partly by aggressive open-source development from Chinese firms (exemplified by DeepSeek and Kimi), but the implications extend beyond geopolitical competition.

The significance lies not in the raw performance numbers, but in the control surface. Proprietary models are deployed by a small number of companies that can theoretically gate access, apply safety classifiers, and enforce know-your-customer procedures. Open-weight models, once released, cannot be recalled or centrally controlled. As the gap narrows, widely distributed, uncontrollable AI systems with cybersecurity capabilities—one of the most sensitive domains—become inevitable. The Institute notes that long-horizon cyber tasks (which chain multiple capabilities into full hacking operations) still show a wider gap, suggesting open models may still lack some generalization ability; but this too will likely close over time.