Cyber ranges: How researchers test whether an AI can hack a whole network

A cyber range is a practice network that looks like a real company’s computers but is built only for testing. Researchers now point AI agents at these ranges and count how far each one gets. The result is a measure of whether a model can carry out a long attack on its own, not just answer security questions.

The idea sits behind a recent result. Evaluation firm Vals found that a free DeepSeek model came close to OpenAI’s restricted Daybreak model on its ranges, as our news story reported.

A flight simulator for break-ins

Think of a flight simulator. Pilots can crash it without hurting anyone, and instructors can see exactly where each trainee went wrong. A cyber range does the same for hacking. It is a set of virtual machines with servers, user accounts, web applications and deliberate weaknesses, wired together like an office network.

The UK AI Security Institute (AISI) describes a range as a simulated network with multiple hosts, services and vulnerabilities arranged into sequential attack chains, built by security experts. That chain is the point. Each step opens the door to the next.

Why one puzzle is not enough

Older tests were often capture-the-flag (CTF) challenges. A CTF is a single puzzle, such as breaking one login page to reveal a hidden string. Models have become good at these, so they say little about real intrusions.

Real attacks are long. An intruder gets a foothold, steals a password, moves to another machine, gains administrator rights and repeats. AISI contrasts ranges with isolated CTF challenges and question-answer sets for exactly this reason: a range tests whether an agent can stay on a plan across many steps, using what it learned earlier.

How a run is set up and scored

An AI agent is a model running in a loop: it reads the situation, types a command, reads the result and decides what to do next. In a range test, the agent sits on an attacker machine and has only the range in front of it.

Vals describes its setup on the CyberOffense benchmark page. The agent is an open-source tool called Pi, running on an isolated Kali Linux machine, a common distribution for security work. That machine can reach only the model provider and the range. Every run starts from a fresh copy.

Scoring avoids trusting the model. Each objective has a hidden marker, and after a run Vals searches the recorded command output for markers from a private answer key. In its words, it never credits an objective from the model’s own claim. Vals also caps a run at 500 million tokens, the units of text a model reads and writes, and at 48 hours.

The two ranges Vals uses, and the UK alternative

Vals has two ranges. Nova is a Windows network with several connected Active Directory domains. Active Directory is Microsoft’s system for managing users and computers in a company. The agent starts with almost no access and must get in through a public web application, gain administrator rights, reuse passwords and move across domains. Nova has 21 objectives.

Lighthouse has 31 objectives across two separate corporate networks. Whatever the agent finds in the first network is the only way into the second, and later stages include phishing and abusing trust between domains. Vals designed this range to check whether an agent can reuse information it gathered earlier when it moves to a new target.

AISI published its own pair in a March 2026 paper, “Measuring AI Agents’ Progress on Multi-Step Cyber Attack Scenarios”. “The Last Ones” is a 32-step corporate network that AISI estimates would take a human expert about 14 hours. “Cooling Tower” is a 7-step industrial control system where the attacker must reverse-engineer a proprietary protocol to disrupt a simulated power plant.

What the results show, and what they miss

Ranges make progress visible. In AISI’s tests on The Last Ones, the average steps completed at a 10-million-token budget rose from 1.7 for GPT-4o in August 2024 to 9.8 for Claude Opus 4.6 in February 2026. Performance also grew steadily with more tokens: going from 10 million to 100 million improved results by up to 59%, with no plateau seen. A bigger budget needs no special skill from the attacker.

That finding explains why Vals does not cut runs short. Its page warns that an evaluation capping compute early would have ranked DeepSeek far below its real reach. The model started slowly and needed more tokens, but got close in the end. For that reason, the cost per run matters as much as the score.

The tests have clear limits:

• No active defenders. In AISI’s setup, detections were logged but did not block or slow the agent. Results show raw capability, not how an attacker fares against a security team.
• Few ranges. Vals has two and plans more. AISI tested two ranges and seven models. A model can score high on one and low on the other: Vals reports Meta’s Wonder at 28 of 31 on Lighthouse but only 7 of 21 on Nova.
• Shortcuts. AISI found that in early Cooling Tower testing some models skipped the intended path by probing the protocol directly from network traffic, and patched it. Vals says it reviewed every run and found none.
• Scores mark where a run ended. Vals notes that a score shows where a model ran out of ideas, not where the testers stopped it.

Why these numbers drive access decisions, and what to watch

Ranges matter because they feed policy. Some labs restrict their strongest cyber models to vetted users. If an open-weight model that anyone can download scores close to a restricted one, the case for gating looks weaker. The Vals authors put it this way: “Cyber capability that was limited to trusted-access AI is now available to anyone.” Vals CEO Rayan Krishnan told Wired that open weights also give defenders a reason to prefer them, since they can run on a company’s own hardware.

Three things are worth watching. First, harder ranges: no model finished the last Lighthouse objectives, and AISI says future work will move to hardened ranges with active defenders. Second, cost: Vals puts DeepSeek under $3 per run against about $22 for Daybreak, so cheap models can simply be run more times. Third, how consistent ranges are across labs, since different step counts, caps and agent tools make scores hard to compare directly.