This summer, a cybersecurity company called Tenzai entered a three-month-long hacking contest, racing to find vulnerabilities in computer networks operated by governments agencies, banks, hotels, airlines and other businesses.
The contest, called HackerOne, has become a real-world proving ground for the latest artificial intelligence technologies, including Claude from Anthropic and GPT from OpenAI. Over the past year, these technologies have improved to the point where they can pinpoint holes in computer networks with stunning speed, fundamentally changing the nature of cybersecurity.
But in winning this extended contest — a result announced on Thursday morning — Tenzai did not use technology from Anthropic or OpenAI. It used A.I. systems built by the Chinese start-up Z.ai.
The feat demonstrated the enormous power of Chinese A.I. technologies that are freely available on the internet. As the leading American companies tightly control how their systems are used — and even call for regulation that would further restrict their use — the top Chinese companies are releasing their technologies as “open weight” software, which means people are free to use these systems however they want.
For some executives, researchers and pundits in the United States, China’s open-weight systems are cause for alarm. As the leading American technologies become increasingly powerful — in some cases, even hacking into internet services they were not supposed to hack into — many experts believe that open-weight systems are an unnecessary invitation for malicious hackers to wreak havoc.
This week, independent researchers showed that A.I. technologies from another prominent Chinese start-up, Moonshot, could help build bioweapons. In a blog post, Anthropic complained that malicious attackers could readily use Z.ai’s technologies not just to find but also to exploit holes in computer software.
But others across the world of A.I. and cybersecurity argue that openly sharing A.I. technologies is actually the safer path forward. Although malicious hackers can use these technologies to attack a computer network, these experts say, any business or cybersecurity professional can use the same systems to defend a network.
“With open-weight systems, we can increase our defensive capabilities by 100 times,” said Johnny Wang, a former Google security researcher and the chief executive of a cybersecurity start-up called Hinoki. “We can have capabilities we only dreamed of in the past.”
“When these models are properly leveraged, they can help Americans defend themselves,” he added.
Regardless of the differing views swirling around open-weight models, Mr. Wang and other experts say, these systems are already widely available — and they are here to stay. Many cybersecurity experts make this point using familiar clichés.
“The horse is already out of the barn,” said Kara Sprague, the chief executive of the company that runs HackerOne.
Pavel Gurvich, the chief executive of Tenzai, put it only slightly differently. “You can’t put the genie back in the bottle,” he said.
Incredibly Capable, With No Guardrails
American companies like Anthropic, OpenAI and Google set off the A.I. boom, and for years, their technologies have outperformed those emerging from China. But the gap began to shrink this spring. The latest Chinese systems, including GLM from Z.ai and Kimi from Moonshot, can now match the performance of the leading U.S. technologies in some areas, according to standard benchmark tests.
As Tenzai, which is based in Israel, entered HackerOne’s three-month-long hacking contest this summer, it adopted what was then Z.ai’s latest model, GLM-5.2; later, the firm switched to GLM-5.3, a more powerful system released in mid-August.
HackerOne’s contest is not a simulation. The contest pays cybersecurity researchers and companies like Tenzai to hack into live computer networks operated by government agencies and Fortune 500 businesses so that these agencies and businesses can understand where their vulnerabilities are and ultimately fix them.
“About 30 percent of businesses are vulnerable — with critical or high-severity vulnerabilities,” Mr. Gurvich said.
In building an attack on a particular computer network, Tenzai deployed as many as 30 A.I. agents, which work collectively to find a way into a system. A “thinking” agent oversees the attack. An “action” agent scans the network for potential vulnerabilities. And myriad “exploit” agents work to string these security holes together in ways that provide accesses to the systems operated by a business or government agency.
Once a path into the system is found, a fourth agent — called a “rebuttal” agent — is deployed to verify that the attack really works.
In one case, these agents were able to log in to a web server operated by an airline without providing the proper credentials. They could then identify the locations of any customer using the airline’s mobile app.
In another case, the agents used what is called a S.Q.L. injection attack — where unexpected information is injected into a database in an effort to break through the network’s defenses — to burrow into the systems of a company that operated a call center. They could then listen in on any of its customer calls.
By definition, Mr. Gurvich explained, open-weight systems give people more freedom to use this kind of technology however they see fit. That means hackers can easily use open-weight models for malicious purposes. But it also means that businesses, government agencies and cybersecurity professionals like Mr. Gurvich can use it to defend computer networks.
“These are incredibly capable models that effectively have no guardrails in place,” he said. “You can download and run them, and they can do anything.”
‘Nation-State-Level Cybersecurity’
Companies like Anthropic and OpenAI build guardrails around their systems in an effort to prevent people from using the technology for certain tasks, like spreading disinformation or hacking into a computer network. But these guardrails are flawed. They often prevent people from using the technology to defend computer networks, too.
In recent months, Anthropic, in particular, has placed additional restrictions on its most powerful technologies in order to prevent malicious uses. This has made life even more difficult for businesses and individuals trying to defend their networks.
Although Chinese companies like Z.ai also put restrictions on their systems, anyone can readily remove them. Mr. Wang and other researchers at his company, Hinoki, have done this with various Chinese systems. They have been able to remove cybersecurity guardrails in less than a day at a cost of around $10,000 — a tiny amount in a field where costs often climb into the millions of dollars.
Both Mr. Wang and Mr. Gurvich believe that open-weight systems will drive a flurry of online attacks in the months to come. “Nation-state-level cybersecurity is now available to your average hacker,” Mr. Wang said. “That changes the calculus for defenders drastically.”
But he also believes that in the long run, the scales will balance out.
“Cybersecurity always comes in waves,” Mr. Wang said. “In the short-term, we will see a lot more attacks. We will see a lot more institutions being impacted — having to deal with service interruptions that will affect everyday Americans. But that is not new. That has happened in the past. Defensive capabilities will catch up.”
The post A Hacking Competition Shows the Power of China’s ‘Open Weight’ A.I. appeared first on New York Times.
