One Step Behind the Flagships: Why Open AI Models Matter for Cybersecurity

When a flagship AI model demonstrates a new capability, security teams should ask how long that capability will remain limited to a few controlled services.

Open models make that question increasingly urgent. Developers can download their weights, deploy them independently, and modify their behaviour. Capabilities that initially require access to a leading commercial provider can eventually become available beyond that provider’s monitoring and restrictions.

Qwen’s 27-billion-parameter models, including community versions labelled “uncensored,” are one example. Gemma, GLM, DeepSeek, and MiniMax show that this is a broader development.

The concern is straightforward: open models can remain behind the flagships while still becoming capable enough to change the cost and scale of cyberattacks. Attackers do not need the best model in the world. They need one that makes their work easier.

How close are they to today’s flagships?

Readers understandably want to know how these models compare with Claude, GPT, Gemini, and Grok.

The table below uses one independent evaluator’s aggregate index, rather than combining unrelated scores from different vendors.

Snapshot checked October 25, 2026. These are index points, not percentages. Settings and fallback configurations are part of the evaluated system. Source: Artificial Analysis.

The comparison does not support calling Qwen 27B equivalent to current flagships. Larger open-family models sit closer, particularly to Grok on this measure, while Opus retains a substantial lead.

Hosted results also do not guarantee identical performance from a downloaded checkpoint, a compressed version, or a community modification.

That distinction strengthens the security argument. We can discuss the spread of useful capabilities without pretending that every small model has reached the frontier.

What “one step behind” really means

A leaderboard is a snapshot. The more important question is how the gap changes over time.

In May 2026, Epoch AI reported that the strongest open-weight models had trailed leading closed models by an average of approximately four months since January, using its Epoch Capabilities Index. Epoch AI’s analysis

Mozilla’s September report estimated a similar 4.4-month lag through its analysis of METR task-horizon data, which examines the duration of tasks models can complete at a specified success rate. Mozilla’s report

These findings support a pattern of open models following the frontier with a delay. They do not prove identical growth rates or promise that every capability arrives four months later.

They also describe leading open models, not specifically models small enough to run on a personal workstation. New flagship releases can widen the gap again.

For cybersecurity planning, however, a delay measured in months is significant. A capability demonstrated today could become more widely accessible before an organisation finishes its next security improvement programme.

The flagship providers are moving too

The commercial frontier includes several different approaches.

Anthropic describes Opus 5.5 as performing at the level of Fable 5.1 on most work. It also reports deploying safeguards for sensitive capabilities, including cybersecurity, with additional access for verified practitioners. Anthropic’s announcement

OpenAI positions GPT-6 Astra as its most capable model for demanding reasoning and coding, while GPT-6.1 Sol targets near-Astra performance at a lower cost. OpenAI’s model documentation

Google describes Gemini 4 Argon as a frontier model for complex work across coding, science, and cybersecurity. Google’s model card

Grok 4.7 emphasises coding and knowledge work, alongside safeguards and restricted access to some cybersecurity capabilities. Grok’s announcement

These providers are competing on capability, efficiency, and deployment controls simultaneously. Open models follow a different distribution path: once weights are available, the original developer has less control over how independent operators deploy them.

Qwen is part of a much larger ecosystem

The open models in this discussion serve different purposes and hardware budgets.

Qwen3.8-27B offers a comparatively compact model with reasoning, coding, and visual capabilities under Apache 2.0. Its importance is partly practical: it provides a foundation that developers can deploy and adapt themselves. Qwen’s model card

Gemma 4 31B is a useful comparison near Qwen’s size. Google’s model supports text and image input, reasoning, and function calling, and targets consumer GPUs and workstations. Whether it runs comfortably on a particular machine depends on memory, compression, and context length. Gemma’s model card

GLM-5.3 belongs to the much larger end of the ecosystem, with an emphasis on coding and extended agent tasks. It is more relevant to discussions about the open frontier than to an ordinary desktop deployment. GLM’s model card

DeepSeek-V4.1-Flash uses a large mixture-of-experts architecture, selectively activating parameters during computation. It supports multimodal input and a million-token context. DeepSeek’s model card

MiniMax-M3 illustrates why parameter counts need care. It contains approximately 428 billion parameters but activates about 23 billion. That does not give it the storage requirements of a 23-billion-parameter dense model: the other weights still have to be available. MiniMax’s model card

Smaller models broaden access. Larger open releases bring more advanced capabilities within reach of organisations that can afford the infrastructure. Both affect the security landscape.

Coding ability and offensive capability are different measurements

General intelligence scores cannot tell us how reliably a model can conduct a cyberattack.

Security work involves unfamiliar systems, incomplete information, tool use, and decisions whose consequences may only become apparent much later. A model can perform well on individual coding tasks and still fail over a long sequence of actions.

Even specialised benchmark results show uneven progress. Z.ai reports GLM-5.3 scores of 84.5 on CyberGym and 54.4 on ExploitBench. Its comparison table gives GPT-5.6 Sol 83.6 and 76.5, respectively. These are publisher-reported comparisons with an earlier commercial generation, not current flagship rankings. GLM evaluation details

The difference matters: competitiveness on one evaluation does not establish equivalent capability across an attack workflow.

Benchmarks provide evidence about particular tasks under particular conditions. Real-world incident evidence is needed to establish what attackers are actually achieving.

What “uncensored” changes

Open-weight and uncensored are separate claims.

Open-weight means the weights can be downloaded, subject to their licence. It does not mean safeguards have been removed, the entire training process is public, or every use is permitted.

“Uncensored” usually describes a community modification intended to reduce refusal behaviour. For example, one Qwen3.8-27B derivative describes substantially reduced refusals rather than their complete elimination.

A model’s willingness to answer does not establish its competence. It can comply with a harmful request and still produce incorrect output. Modification or compression may also change its performance.

The risk becomes more meaningful when reduced refusals coincide with useful technical ability, access to tools, and repeated opportunities to try.

A screenshot of a model answering a dangerous prompt demonstrates much less than a controlled evaluation of whether it can complete the task.

Attackers can benefit before full autonomy arrives

The security discussion often jumps to an AI system conducting an entire intrusion alone. Partial automation deserves attention too.

A model may help an existing operation process material, understand unfamiliar code, draft messages, or reduce repetitive work. Human operators can handle the stages where it fails.

The economic question is whether the model saves enough time to make more attempts worthwhile.

A criminal group does not necessarily need frontier-level reasoning for every part of its operation. A cheaper, less capable model might still be useful for routine tasks, while people or stronger systems handle difficult decisions.

That creates a plausible route to increased pressure on defenders: more activity, faster preparation, and less human effort per attempt. It does not require every attacker to gain the skills of an expert overnight.

The warning is already reaching security agencies

New Zealand’s National Cyber Security Centre reported in September 2026 that malicious actors were already using AI to increase the speed, scale, and sophistication of attacks.

It also assessed that attackers might gain access by early 2027 to advanced capabilities then available only through leading frontier models. That is a forecast, but it directly reflects concern about capability spreading beyond its initial providers. NCSC’s assessment

This does not establish that Qwen or another specific release has caused a wave of breaches. Attribution requires evidence from actual incidents.

The supported conclusion is narrower: AI already assists malicious activity, and broader access to stronger capabilities could increase its usefulness.

Downloadable weights change the control point

A hosted provider can monitor its own service, restrict accounts, update safeguards, or withdraw access.

Those controls do not automatically follow downloaded weights. An independent operator chooses the surrounding software, permissions, logging, and tools. The original publisher cannot centrally disable every copy.

This independence also benefits legitimate users. It can support privacy, research, resilience, and work involving data that cannot leave an organisation.

The security trade-off comes from the same feature: control moves to the operator.

And “free” needs qualification. Downloadable weights do not eliminate hardware, electricity, maintenance, or engineering costs. They can, however, remove dependence on a particular provider’s access decisions.

Defenders have access to the same progress

Open models can help security teams analyse sensitive material locally, evaluate tools against their own systems, and build workflows without relying entirely on external APIs.

Potential applications include explaining suspicious code, organising incident evidence, and assisting with remediation. Teams need to measure errors and missed findings as carefully as useful output.

The practical priorities remain familiar:

• Reduce the time that known vulnerabilities remain exposed.
• Limit credentials and service accounts to the access they need.
• Test recovery procedures and backup restoration.
• Evaluate AI assistance on representative internal tasks.
• Give agents scoped permissions and review consequential actions.

Organisations deploying agents also create new security responsibilities. An assistant with excessive access can become a route to sensitive systems. Joint guidance on adopting agentic AI addresses the risks of introducing these systems into operational environments.

The gap is preparation time

Current flagships still lead on broad evaluations. Qwen 27B is not a substitute for all of them, and “uncensored” does not turn it into one.

The longer-term concern is that useful capabilities continue to spread. Larger open models move toward the frontier, while smaller releases make independent deployment more practical.

Security teams should treat a new flagship capability as an early planning signal. If comparable assistance becomes widely available within months, which exposed systems, excessive permissions, and slow response processes would become more costly?

Being one step behind can still be close enough to change an attacker’s options. The value of that remaining step depends on what defenders do before it disappears.