The BaseResearchLessWrong
Tracking the Cyber Capabilities of Cheap Open-Weight Models
In a LessWrong post, Sergei Smirnov, Simon Lermen and kapedalex test Xiaomi's cheap open-weight MiMo-V2.6-Pro on an exploit benchmark and on the recent PHP vulnerability. They report strong results at low cost and no refusals.
Why it matters
The same thing, for different readers.
What it means for you
Smirnov, Lermen and kapedalex report that a very cheap, freely downloadable Chinese AI model could hack a deliberately vulnerable test server without refusing.
For lawmakers
The authors show a cheap open-weight model that did not refuse offensive cyber tasks, which export rules or release-gating on closed models alone would not address.
For researchers
The authors find that outside hints raised MiMo's exploit success from one in nine runs to eight in nine, so single-model benchmarks may understate what attackers can do.
In their own words
Every quotation was found, word for word, in the text we saved from the source. That shows the words are there; it does not make them true, or prove the speaker meant them as quoted.
From the source’s own text.
“With access to the oracle tool, eight out of nine runs succeeded at arbitrary read/write outside the sandbox (T2); in the remaining run, the model did not call the tool.”
“MiMo showed no significant safety guardrails and did not refuse this task.”
“The extremely low inference costs of MiMo change the economics of exploitation. They make it economically viable for attackers to make many more attempts across many targets, even when the expected payoff from each attempt is small.”
How the finding was reached
In our words, from the source. Weigh the finding by how it was made.
- What was done
- An evaluation of Xiaomi's MiMo-V2.6-Pro on all 41 ExploitBench CVEs (V8 engine bugs; 300 turns, 5 hours, 3 seeds each), a hint experiment on one task, and a test against an unpatched PHP server with web access.
- What it found
- MiMo ranked 3rd of 9 models on ExploitBench, triggered the bug on 33 of 41 CVEs, reached arbitrary read/write outside the sandbox on only one, and never reached code execution. With a correct hint, 8 of 9 runs reached arbitrary read/write against 1 of 9 without. Given web access, it exploited the PHP flaw in about 13 steps and 4 minutes.
- What it does not show
- The authors say MiMo is likely somewhat benchmaxxed, results vary strongly by seed, the hint was fixed to a known-correct one, and in the PHP test the model read public information about the flaw rather than finding it itself. The comparison omits the latest frontier models.
- Status
- A report
The record
- Questions
- How is AI used in attacks, defence and war? · Can AI systems act beyond what people intended or allowed?
- People
- Sergei Smirnov (Wrote it) · Simon Lermen (Wrote it) · kapedalex (Wrote it)
- What we read
- We read the whole source.
- Found by
- The Radar, run of October 29, 2026, via
lesswrong(tier 1: the source’s own channel or an official record) - Cite this
- LessWrong, “Tracking the Cyber Capabilities of Cheap Open-Weight Models”, October 28, 2026. Entry in the Ctrl AI Base, https://ctrlai.com/base/lesswrong-2026-10-28-cheap-open-weight-cyber-capabilities