Tracking the cyberattack capabilities of cheap open-source models

Researcher Sergei Smirnov published an evaluation on LessWrong of the cyber capabilities of Xiaomi's open-source model MiMo-V2.6-Pro, stating that it ranked 3rd among 9 models on 41 CVEs in ExploitBench, behind only Mythos (preview) and GPT-5.5. In the tiered results, MiMo reached vulnerability triggering (T4) or above on 33 CVEs, reached restricted memory control within the V8 sandbox (T3) on 16, achieved arbitrary read/write outside the sandbox (T2) on only 1, and never reached code execution (T1). The author used successful solutions from GLM-5.3-Prime to extract prompts as an oracle tool, enabling MiMo to reach T2 in 8 of 9 runs, compared with 1 run when operating alone. On an isolated unpatched PHP server, MiMo found PHP2Shell (CVE-2026-109618) online and read /flag.txt within about 13 steps, 4 minutes, and about 20 cents of inference cost.