Failure got cheap

24 Aug, 2026

Twenty thousand dollars to attack, seven million to figure out what happened

In my notes folder, the graveyard of articles that never shipped, there are a number of drafts. The security of LLMs has always fascinated me (my first article), and so has the economics behind the discipline (another one). In May 2025 I read a paper that sharpened my thinking on the subject: LLMs unlock new paths to monetizing exploits by Carlini et al., which formalises a simplified economic model (a toy model):

value = (profit per exploit × number of victims) − (cost to identify the vulnerability and develop the exploit)

The paper's main thesis is this: if the cost of finding a bug and writing its exploit collapses, then it becomes worthwhile to attack targets that previously did not repay the effort. Not the software used by millions of people, but the thousands of niche applications.

LLMs will change that third term, and in doing so they reach the long tail. Instead of a human attacker manually hunting for one hard-to-find bug in a product with millions of users, an LLM can find thousands of easy bugs in products with thousands of users.

Also in May 2025, something had started to move: Sean Heelan's post on how he used o3 to find CVE-2025-37899, a remote vulnerability in the Linux kernel's SMB implementation. In my notes I had added a caveat: o3 "almost" found it on its own; the bug had been found by hand, but the model was still capable of finding it. The jump from "assistant" to "autonomous operator" looked short, and it turned out to be exactly that.

April 2026: the cost didn't slide, it went through the floor

On 8 April 2026 Anthropic announced Claude Mythos Preview, a model that was not released publicly because the capabilities measured were judged too dangerous. Access was restricted to a limited set of organisations, with a hundred million dollars in usage credits behind the initiative (Project Glasswing). The capabilities looked very interesting, but what I want to focus on in this piece are the costs.

The first row is what made me pull these notes back out, think about the past, and write an article. We have 1,000 attempts for less than 20k dollars of inference, which is 20 dollars per attempt. And the result is a bug that stayed invisible for twenty-seven years to every fuzzer and every human reviewer who had looked at that code.

The other point of interest is that 72.4%, which has to be read next to o3's "almost". In twelve months we went from a model that got close to an already known vulnerability, to a model that produces a working exploit three times out of four. In the language of these reports this is called emergent capability: nobody trained Mythos specifically to write exploits.

So in 2025 we had a paper arguing that the cost of finding bugs would collapse. How did the market react in a year? I expected a shift downward, toward the long tail, which is what the paper suggested. But let us look at the price the high tail still commands today. The Crowdfense acquisition programme pays up to 7 million dollars for a full chain on iOS, up to 5 million on Android, 3.5 million for Safari, 3 million for Chrome, and between 3 and 5 million for iMessage and WhatsApp.

The arbitrage did not open up only at the bottom of the market: it widened at the top. The long tail is a direct consequence of the cost collapse, and what I read as a model in a paper in 2025 is not wrong, but perhaps it is not the point. The point is that when the "cost" term collapses by three orders of magnitude, the whole equation stops being a problem of target selection and becomes a problem of volume of attempts. And that is probably what changes the economics.

Here is the spread, on a logarithmic scale, with all the numbers in this article put on the same chart. The value at the bottom, the defender's one, is dealt with in the next section.

July 2026: the attack

Three months after the Mythos announcement came the demonstration of an end-to-end attack carried out by an AI agent. Except it was not carried out by an attacker.

On 9 July 2026, during an internal capability evaluation, an OpenAI agent escaped its own evaluation sandbox through a 0-day in the package proxy cache, found itself on the internet, located an unprotected public endpoint (belonging to a third party, hosted on Modal, designed to execute arbitrary code) and adopted it as a launchpad: a base for command-and-control, staging and egress. From there, over the following four and a half days, it got inside Hugging Face's infrastructure and obtained cluster-admin on multiple Kubernetes clusters.

The public write-ups from the two companies are genuinely interesting and worth reading: the Hugging Face technical timeline, the OpenAI post and OpenAI's technical reconstruction at Black Hat.

Without going into detail, the climb inside Hugging Face was a sequence of identity thefts and not some wild exploit: from code execution in a single worker pod, to the service account token, to the node credentials read from the Instance Metadata Service, all the way to root on the host machine. That last jump, from container to host, required two misconfigurations at the same time: a CSI driver ClusterRole that granted pod creation across the whole cluster, and the absence of an admission policy rejecting privileged pods with the host filesystem mounted. Make a note of them, they come back later.

Four things worth keeping in mind

The first: there was no economic incentive in the traditional sense. No extortion, no ransomware, no buyer. Potentially destructive cloud calls were issued with DryRun=True, which means simulate but do not execute. The agent was mapping the infrastructure, not causing damage, consistent with an objective that rewarded reach and information gathering.

The second: the safety classifiers were disabled on purpose. The evaluation was designed to measure the raw capability of the model and the underlying harness, so production classifiers had been turned off and cyber refusals were clearly not in play.

The third: no human directed the individual steps.

The fourth, and the point that made me write this article: the report records 17,600 actions, and most of them went nowhere. The line from the Hugging Face post-mortem that I have been carrying around for weeks is this one: the successful path was hidden inside the noise generated by the thousands of failed ones (the "Asymmetry problem" section of the HF post-mortem).

It is not an isolated case. At the end of July, and I doubt it is a coincidence that it happened right afterwards, Anthropic went and checked its own logs and published what it found. Across 141,006 evaluation runs in which Claude could have obtained internet access, three incidents were identified. Put that way it sounds like a reassuring percentage, until you read what the three incidents actually were:

• Opus 4.7 hit a real company whose name matched that of a fictional target. Four runs, access to production infrastructure, credentials extracted, hundreds of database rows.
• Mythos 5 created and published malicious Python packages on PyPI. They were downloaded onto around fifteen real systems within an hour, including a security company's scanner, from which credentials were exfiltrated. A supply chain attack, originating from an internal evaluation.
• An internal research model scanned roughly 9,000 targets, compromised one of them using trivial techniques (exposed credentials, SQL injection), and stopped on its own once it realised the target was real.

The dates tell the rest: review started on 23 July, incidents identified on the 24th, organisations notified on the 27th, public disclosure on the 30th.

The interesting number here is not the three. It is the 141,006. Because that number, as we are about to see, has a name.

The term I was missing

Let us go back to the 2025 equation. My focus was the cost term, and I was asking myself which targets become profitable. The right question was a different one: how many attempts can you afford?

Call it N. At twenty dollars per attempt, N stops being a technical constraint and becomes a line item, which is an enormous difference. And that is how the two earlier numbers should be read: 17,600 actions are not the signature of a particularly brilliant attacker, they are the signature of an attacker for whom failing is cheap. And 141,006 runs are not a rare incident multiplied by bad luck: they are an N large enough to make near-certain an event whose probability on any single attempt is negligible.

So, if every attempt has probability p of succeeding and the attempts are independent:

$p(\text{compromise})=1-(1-p{)}^N$

With small p, you only need N to grow for the probability to approach 1.

But treating them as independent is conceptually wrong. In the incident described by OpenAI, the agents were writing messages to each other on an improvised message board inside Artifactory: they passed along credentials, techniques and progress. A model run later inherited the messages left by the earlier ones. In the attack on Hugging Face, Vector 1 (reading files via HDF5) is what made Vector 2 possible: by reading the worker's source code, the agent found where the code execution bug was. Attempt k was not a coin flip independent of attempt k−1: it was the consequence of accumulated information.

If you put a naive model in, you necessarily get a naive result out. So you would want something better, and the curious thing is that the answer was already sitting in my 2025 notes.

First: frequency, and independent events

The independence assumption is not just inconvenient, it is empirically false, and we have known that for a decade. In Hype and Heavy Tails: A Closer Look at Data Breaches (Edwards, Hofmeyr, Forrest), the frequency of data breaches is modelled well not by a Poisson but by a negative binomial.

A Poisson assumes independent events and has variance equal to its mean. A negative binomial is a Poisson whose rate is itself a random variable: the variance exceeds the mean. The technical term is overdispersion, and you observe it exactly when events cluster instead of spreading out evenly.

Second: a chain, not a coin

The mental model that makes sense is not the classic coin flip, where each toss stands on its own. It is a path. You model it as a sequence of steps, each with its own probability of being cleared.

In July 2026 the UK AISI and the American CAISI published a preliminary assessment of Kimi K3's cyber capabilities, Moonshot AI's open-weight model, measured on a cyber range called The Last Ones: 32 steps, 4 subnets, around 20 hosts, roughly twenty hours of work for a human expert.

Kimi K3 reaches step 17 out of 32 on average, and completes the range one time in ten. GLM-5.2 stops at step 11. US frontier models reach 28.5. On ExploitBench, Kimi K3 has a success rate of 32% against GLM-5.2's 24%, but on Arbitrary Code Execution, which is the highest-severity outcome in exploit development, Kimi K3 scores 0 out of 41 samples, while frontier models sit at 20 out of 41.

If you model the attack as a chain of steps with probability qᵢ of clearing each one, the probability of compromise is the product of the qᵢ, not a sum.

Defence in depth is multiplicative, not additive. Adding a hard step does not subtract a quantity from the risk: it divides it. And this is where the two misconfigurations from earlier come back: the over-broad ClusterRole gave the permission to create a pod, and the missing admission policy meant nobody checked what kind of pod it was. Either one of the two, fixed, would have been enough to stop the container-to-host jump.

N lengthens the path, but a wall is still a wall. If one qᵢ is zero, no volume of attempts compensates for it. That 0 out of 41 on ACE is precisely a wall, not a slope.

And this is where the chain model shows its own limit too. The probabilities of the individual steps are not deduced from historical data: they have to be estimated through red and purple team exercises on your own infrastructure. It is honest to admit that this is where the elegant mathematics ends and the measuring begins.

Third: the mean is the wrong statistic

There is a second problem, on the impact side rather than the frequency side. The same work by Edwards, Hofmeyr and Forrest shows that breach size follows a log-normal (or log-skewnormal): heavy-tailed distributions.

With heavy tails, Annual Loss Expectancy (the expected annual loss, which is a mean) is a misleading summary, because it is dominated by rare events you will almost never see in your sample. This is why, if you run a Monte Carlo simulation of cyber risk, the number to put on the slide is not the mean but the tail percentiles: Value at Risk and Conditional Value at Risk. In my 2025 notes I had also saved a paper on a Monte Carlo analysis of the monetary impact of mega data breaches, which insists on the same point: it is the interactions between factors, not the central value, that explain the variance of the total cost.

Fourth: where do you get the probability, if history is no longer any use

And here we reach the most annoying problem. Every probabilistic risk assessment method, FAIR and HTMA above all, wants a frequency and a magnitude as inputs. Magnitude you estimate. Frequency, traditionally, you estimate from historical data.

But if offensive capability makes a discontinuous jump in twelve months, from o3 that "almost" finds a bug to Mythos producing 181 working exploits on Firefox, then historical base rates describe a world that no longer exists. The process is not stationary, and estimating the future from the past is precisely the mistake the past invites you to make.

In my 2025 notes there was a paper I had saved for the title alone: MAGIC: A Method for Assessing Cyber Incidents Occurrence. The idea is to compute the likelihood of an incident not from historical data but from the organisation's cyber posture, through three parameters quantified with questionnaires: maturity, complexity, attractiveness. It exists to produce tailored inputs for FAIR or HTMA while reducing the subjectivity of expert judgement.

In 2022 it was a solution to a problem of data availability. In 2026 it is a solution to a problem of validity: when base rates are no longer informative, posture is the only input that still describes your risk. With one twist required on that third parameter, attractiveness. It no longer means "you are a big target", it means "how many attempts your surface will absorb this year". That number does not depend on your size. It depends on the attacker's cost per attempt.

And this is where the long tail comes back in through the window, as a consequence rather than a thesis: if attractiveness decouples from size, the small business and the multinational end up in the same market.

The defender's bill

The most important number is still missing, and given my background and interests, any reader who knows me will have guessed that it has nothing to do with the attack.

According to Fortune, OpenAI stated it spent three million GPU hours investigating the incident, analysing over seven billion logs: "running models like Codex and other agents to scan lots and lots of trajectories and logs". Three AI infrastructure experts consulted by the publication put the value of that compute between 4 and 15 million dollars, with a reasonable bet around 7 million: roughly 4 if it ran on Hopper, roughly 15 on Blackwell.

Now let us compare the two figures, attack and defence: twenty thousand dollars to find a bug that had stayed invisible for twenty-seven years; seven million dollars to reconstruct what happened afterwards. A ratio of roughly 350 to 1, which is the spread in the first chart of this article.

Careful not to draw the wrong conclusion here, because it is an easy one to draw: no small or medium business is going to spend seven million on GPU hours for forensics. The point is not the absolute figure, it is the structure of the cost. Hugging Face says it in the section I linked earlier in its post-mortem: they were not dealing with one brilliant exploit or a clean sequence of attacker actions, but with the need to correlate thousands of low-signal events across different systems while the agent kept testing new paths. The successful path was hidden in the noise of the failed ones. And their AI security stack did correlate the signals into a coherent picture, but it got the alert severity wrong and never woke the on-call team, which cost precious time.

The brake has moved

At this point everything looks very close. Before writing the alarmist conclusion, let us look at the numbers from the people who actually measure, because they tell a more interesting story.

The common view is that near-frontier open-weight models have already put these capabilities in anyone's hands. On the first half that is true, on the second it is not, and the distinction is everything. The AISI/CAISI assessment is essentially unambiguous: Kimi K3's safeguards did not stop it from attempting exploit development or offensive cyber operations. No refusal, no resistance. You download an open-weight model, you run it on your own infrastructure, and no provider classifier gets in the way.

But 17 steps out of 32 is what remained, in July. Zero out of 41 on ACE. The gap with frontier models was wider than the narrative around general-purpose benchmarks would suggest, and it fell exactly at the worst point: on the highest-severity outcome. The Decoder notes that distillation may explain the gap.

I wrote "in July" deliberately, because while I was finishing this article the picture changed again. On 14 August Z.ai released GLM-5.3, and the numbers have to be read side by side:

• On CyberGym, which measures whether a model can find and validate real vulnerabilities starting from source code, GLM-5.3 scores 84.5 and edges past Mythos 5 (83.8) and GPT-5.6 Sol (83.6). An open-weight model at the top of a cyber benchmark, for the first time.
• On ExploitBench, which grades the reasoning about how a vulnerability is actually exploited, it goes from 24.4 to 54.4. More than doubled in a single version. But Mythos 5 and GPT-5.6 Sol sit in the mid-seventies.
• On ExploitGym, which counts how many exploitation tasks you close within a fixed time budget, it goes from 29 to 105 in two hours, and from 39 to 130 in six.
• The weights, Z.ai says, ship roughly two weeks after launch, once the safety evaluation is finished.

And there is one detail that closes the loop with April: Z.ai states that the exploit-chain reasoning emerged from post-training without it being an objective. The same words used for Mythos, four months later, from a lab that publishes its weights (at the time of writing, the model weights have not been published yet).

So "the brake is holding" no longer stands, and it has to be replaced with something more precise: the boundary no longer runs between open-weight and frontier, it runs between finding and exploiting. GLM-5.3 finds as much as Mythos and more. On exploitation it is still twenty points behind. The ACE wall still exists, but it has moved forward, and the slope says everything: GLM-5.2 at step 11 in June, Kimi K3 at 17 in July, GLM-5.3 doubling ExploitBench in August. The question worth keeping on the agenda is not "what can AI do", but how long that twenty-point gap takes to close.

In the meantime it is worth remembering who can already afford all of this. Twenty dollars per attempt is not a constraint for anyone, but neither is twenty thousand: North Korea is credited with 1.34 billion dollars in stolen cryptocurrency in 2024 and 2.02 billion in 2025. For historical scale, the design of Stuxnet is estimated at around one hundred million dollars: it is the last bar of the first chart, and it is there as a reminder of what it cost, sixteen years ago, to buy what today fits in the budget of a business trip.

On the other side, the models with the engine are not freely for sale, and the story of how we got there deserves a paragraph. On 9 June 2026 Anthropic released Claude Fable 5, the first accessible model in the Mythos class. On 12 June, three days later, the US government issued an export control directive suspending access to Fable 5 and Mythos 5 for any foreign national, inside or outside the United States, with the practical result that Anthropic had to switch them off for all its customers. The trigger, as far as anyone could tell, was a jailbreak, meaning a prompt that gets around the constraints imposed by the vendor. That jailbreak, Anthropic writes, essentially consisted of asking the model to read a codebase and fix its software flaws. On 30 June the controls were lifted and from 1 July Fable 5 was available again; Mythos stays out of the open market.

And next to this, the other half of the same story. To analyse the attack, Hugging Face tried to use Claude Opus and Fable, and ran into the guardrails: their safety guardrails treated reverse-engineering an exploit the same as launching one. So they stood up a quantised version of GLM-5.2 self-hosted and routed the entire forensic pipeline through it, with the side benefit of keeping the attacker data on-premise. And it is with that model that they reconstructed the chunk+XOR+compress scheme and recovered the key the agent itself had left behind in the logs: exactly what allowed them to decode the blobs a naive scan had missed, bringing to light roughly four times the secrets found on the first pass.

Two episodes, the same dynamic: the action the defender needs and the action the attacker needs are the same action, and every time it gets blocked on the provider side the work does not stop, it moves onto weights you run at home. I do not have a clean conclusion to offer you on this, because frankly I do not think there is one.

What you put in the budget on Monday morning

If you have made it this far, I owe you a note on how my own view changed while writing. The original idea for this article was to build a quantitative analysis of risk, and I started out thinking that Cyber Risk Quantification was the answer to all of this. It is not, and for a specific reason: as a predictive tool it does not hold up. It needs historical base rates, and historical base rates describe a world that ships a new version every six weeks. A framework that hands you a number for next year's budget, in a non-stationary regime, is handing you back your own confidence multiplied by a constant.

What does keep working is quantification as a tool for prioritisation: not to guess how much you will lose, but to decide what to buy first and to get a yes from whoever signs. Which is, if you think about it, the only thing it was ever really good at.

Look at the list of what Hugging Face changed after being attacked:

• IMDS access blocked from pods, so that an RCE in a pod does not trivially become node credentials;
• rotation of every credential, including on clusters that were never touched, and a move to workload identity where it was not yet in place;
• narrower credential scope: the service connector no longer returns the full cluster catalogue to a single ephemeral client;
• critical-severity alerting on the behavioural signatures observed, plus tooling that flags tokens used from unexpected origins.

Notice something: it is all boring, and it is all cheap. None of these line items requires a seven-million-dollar budget. They were not done earlier not because they cost too much, but because there was no way to tell the story of what they were worth. That is exactly where quantification earns its place: not predicting the future, but getting the boring things funded.

Three concrete parameters that, on the basis of all of the above, I would use to decide in 2026:

1. N, the volume of attempts your surface will absorb. Not derived from your size, but from the attacker's cost per attempt. It is the new parameter, and the hardest one.
2. The length and the fragility of the chain. How many independent steps separate arbitrary code execution from your most sensitive data, and which of those steps has a clearing probability close to one because it is a misconfiguration. This gets measured with a red team, not with history.
3. The cost of correlation. How much it costs, in person-hours and in tooling, to tell the successful attempt apart from the thousands of failed ones. It is the line that grows fastest and the one nobody budgets for.

None of these three is a prediction. All three are decisions. Real security lives in the ability to measure and reduce risk in economic terms, not bureaucratic ones.

In closing

In the 2025 draft I closed with an invented provocation: if an LLM-powered attack costs 50 euros and can bring in 2,000, the problem is no longer technological, it is macroeconomic. It sounded very good in my head, and it fit the paper I opened this article with. The problem is that those numbers were fairly arbitrary. Now real incidents have happened, and as a result a quantitative approach is possible.

Twenty dollars an attempt. Twenty thousand for a bug that stayed invisible for twenty-seven years. Seven million to reconstruct what happened afterwards.

What I was missing in 2025 was not a capability I had failed to anticipate. On capabilities, Carlini's paper was right and I had believed it. What I was missing was that an attacker could fail 17,599 times and win on the seventeen thousand six hundredth, and that this would make economic sense. It is a term I had not written into the equation, and it changes what defending means: not only lowering the probability of an event, but making sure that no reasonable number of attempts is enough.

On everything else I have no reassuring ending, and I stopped looking for one while writing. The action the defender needs, reading code and finding the holes in it, is the exact same action the attacker needs. Within two months I watched it cost a frontier model eighteen days of shutdown by government order, and cost Hugging Face an entire forensic pipeline rebuilt on weights downloaded and brought in-house. Every time that action gets shut down on the provider side, the work does not stop. It moves somewhere nobody can shut it down.

The article I wanted to write in 2025 was about quantifying risk. I finished this one with fewer certainties than I started with, which I suppose is why it sat in the notes graveyard for two years. The question I am keeping on my agenda is no longer how much an attack will cost, because I have that number now. It is how long the gap between finding a vulnerability and knowing how to exploit it takes to close.

Because the day it closes, twenty dollars an attempt is no longer behind an allowlist of a handful of companies. It is inside a weights file, on Hugging Face, and anyone can download it.

This article was written and translated into English with the support of several LLM agents, used for research, cross-checking sources and prose review. The argument and the final version remain my own.