Open models are about six months behind on cyber, by Epoch's count

Epoch AI has started tracking cybersecurity capability as its own measure, a Cyber version of its Epoch Capabilities Index, and the first read puts open-weight models roughly six to seven months behind the closed frontier. The best open model, Z.ai's GLM-5.3, scores 160. That is ahead of OpenAI's GPT-5.4 from early March but behind Anthropic's Claude Mythos Preview from April and GPT-5.5 from late April. The current closed leaders, Claude Opus 5.5 and GPT-6 Astra, sit near 171.

The index now covers 76 models across 35 cyber benchmarks, pulling results from the UK AI Security Institute, the US CAISI program, and the evaluation firm Irregular, among others. Turning a pile of inconsistent benchmark scores into one comparable number is the hard part, and Epoch is careful about the seams. GLM-5.3's position, for instance, rests on just three CAISI benchmarks, and the authors note that refitting the model lowered several top scores, so older values are not directly comparable.

The six-month figure is a specific, dated claim. GPT-5.4 was seven months old at the data cutoff and Mythos Preview six, which brackets where the open frontier now sits. Whether that lag holds is the open question, since a single strong open release could close it fast.

Why it matters

If you plan defenses around what attackers can run locally, the capability they can download today is roughly what the top labs had half a year ago, and that lag is the margin you are actually working with. For defenders it is a planning number, not a reassurance.