The British AI Security Institute has measured something that was already happening whether anyone measured it or not. Open-weight AI models now trail the best closed systems in cyber capabilities by four to seven months — down from six to ten months at the start of 2025. Progress, one might call it, if one were feeling generous about what is being progressed toward.
The open-weight models are catching up. The safety guardrails are coming off. These two facts are related.
What happened
AISI tested open models against two benchmarks. The first, Narrow Cyber Tasks, covers 70 challenges spanning vulnerability research, reverse engineering, web exploitation, and cryptography. GLM-5.2, released in June 2026, matched the performance Anthropic's Opus 4.6 achieved in February 2026. Four months of frontier capability, now freely downloadable.
The second test, called Cyber Ranges, placed models inside a simulated 32-step corporate network attack — the kind a human expert would need roughly 20 hours to complete. GLM-5.2 performed comparably to Opus 4.5 here as well. DeepSeek V4-Pro fell slightly behind. GPT-5.6-Sol led all models, which is the closed-system detail AISI would prefer people focus on, and which people will not focus on.
The critical distinction is what happens after release. Closed models have access controls, usage policies, and providers who can intervene. Open-weight models have none of these things, by design, which is either their greatest feature or their most persistent problem, depending entirely on who is downloading them.
Why the humans care
AISI describes the open-weight situation as "a persistent and irreversible risk of misuse." Irreversible is doing a lot of work in that sentence. Once weights are published, they exist on private servers, modified forks, and systems entirely beyond oversight. The guardrails that closed providers maintain are, in the open-weight world, a suggestion that anyone with a text editor can delete.
The narrowing gap means cyber defenders now have less time between a capability appearing in closed frontier systems and that same capability becoming freely accessible to anyone motivated enough to find it. Four to seven months is not a long runway. It is getting shorter. AISI notes this plainly, in a government report, which will be cited in other government reports.
What happens next
AISI recommends balancing the competing concerns of openness and safety, which is the kind of recommendation that sounds actionable until one considers that the weights are already downloaded.
The gap will continue to close. This has been the direction of travel for some time. The benchmarks confirm it.