Cybersecurity Is Proof of Work: Who Spends More Tokens

Cybersecurity is turning into a compute problem: on the UK AI Security Institute’s attack ranges, the best models kept making progress the more tokens they spent, which, in Drew Breunig’s reading, makes defense a race to outspend the attacker. In April 2026 one model, Claude Mythos Preview, finished the institute’s 32-step corporate network attack range in 3 of 10 attempts.¹ By July, AISI counted four publicly released closed-weight models that had finished it, the best in 6 and 7 of 10 attempts, and an open-weight model, Kimi K3, that finished it once in 10.⁷ The premise under Breunig’s reading, that more tokens buy more progress for the best models, has held up. The price he put on an attempt has not.²

This post was first published on April 14, 2026, the day after AISI’s first report. On October 2, 2026 I rebuilt it around what AISI, NIST’s CAISI, and Anthropic have published since. What the April version said, and where it has gone stale, is listed under “What the April Version Said” near the end.

TL;DR

• The range. “The Last Ones” is a simulated corporate network attack: 32 steps across four subnets and about twenty hosts, which AISI estimates would take a human expert around 20 hours. It starts after initial access and has no defenders.¹⁴
• Who finishes it. One model in April. Two by the end of April. By July 23, four publicly released closed-weight models and one open-weight model.¹⁴⁷
• What a run costs. Breunig’s $12,500 per attempt was an estimate: AISI’s 100M-token budget multiplied by Mythos Preview’s output price. When AISI priced 100M-token range runs in July, they came to about $85 for Opus 4.5 and 4.6 and an estimated $46 for the open-weight GLM-5.2.²⁶¹⁰
• Who can run it. AISI puts leading open-weight models 4 to 7 months behind the closed frontier on cyber. Anthropic reports that GLM-5.3, which anyone can download, builds end-to-end exploits at about the rate Mythos Preview does on one public benchmark.⁶⁹
• No plateau at the frontier. For the strongest models, AISI’s April and May reports found performance still rising at the 100M-token limit. Weaker models stalled, the open-weight GLM-5.2 among them.¹⁴⁵⁶
• The caveat that still holds. The ranges are undefended. AISI says it cannot tell how these capabilities “will translate against defended, real-world systems.”⁵

What AISI Measured, and How It Changed

AISI’s cyber ranges test whether a model can carry out a whole attack by itself. “The Last Ones” (TLO), built with SpecterOps, is “modelled on the kill chain of an enterprise intrusion”: the agent starts on an unprivileged machine with no credentials and has to chain reconnaissance, credential theft, lateral movement across Active Directory forests, a CI/CD supply-chain pivot, and exfiltration of an internal database. Each attempt gets a budget of 100M tokens.⁴

Five reports between April and July tell the story:

The July 23 report states where things stand: “Solves of TLO are no longer exclusive to a small set of models. In prior testing, four publicly released closed-weight models have solved TLO, with the most capable models solving it more reliably at 6/10 and 7/10 attempts.”⁷ It does not name the four, and it does not say whether Mythos Preview, a restricted release, is counted among them.

The second range moved too. In April, no model could complete “Cooling Tower,” a 7-step attack on a simulated power plant, and AISI noted that Mythos Preview “got stuck on IT sections of this range.” On May 13 AISI reported that the newer Mythos Preview checkpoint solved it in 3 of 10 attempts, “the first time that a model completed the second of our two cyber ranges.” AISI drew a lesson from that: “Notable capability jumps do not always require new model releases.”¹⁴⁵

Two findings sit under all of these. First, for the best models, more tokens bought more progress every time. April: “Models continue making progress with increased token budgets across the token budgets tested.” April 30: “we have not yet observed a plateau with the best models.” May: performance “would likely still improve beyond that budget, especially for recent models.”¹⁴⁵ It does not hold for every model: in July, GLM-5.2 kept pace with Opus 4.6 “to step 11 before stalling.”⁶ Second, the pace is fast. AISI estimated in February that the length of cyber task a frontier model can complete “had doubled every 4.7 months since late 2024,” and reported in May that Mythos Preview and GPT-5.5 “substantially exceeded” that trend.⁵ That estimate uses a budget of 2.5M tokens per task. AISI’s July 2 analysis found the trend “~60% steeper when horizons are estimated at 50M tokens rather than 2.5M tokens per task.”¹³

What a Run Costs

Breunig turned the April result into money: “AISI budgeted 100M tokens for each attempt. That’s $12,500 per Mythos attempt, $125k for all ten runs.”² The first version of this post put that figure in its title.

It was an estimate, and a high one. $12,500 for 100M tokens is $125 per million, which is Mythos Preview’s list price for output tokens. Its input price is $25.¹⁰ Pricing every token in the budget at the output rate gives a ceiling, not a bill.

AISI published prices in July, in its report on open-weight models: “A 100M-token cyber range run cost roughly $85 for both Opus 4.5 and 4.6, versus an estimated $46 for GLM-5.2 and $1.19 for DeepSeek V4-Pro at current pricing.”⁶ Those are “advertised first-party prices,” and AISI notes it did not use first-party providers for the open-weight models, “so real compute costs may vary.”

Three things keep those numbers from being the price of a finished attack. None of the priced models finished the range. Mythos Preview lists at five times Opus’s price per token, so its runs cost more than Opus’s. And AISI has published no price for any run that completed TLO, so I cannot say what one costs. What the priced runs do show is the order of magnitude. Opus 4.6’s run came to about $85. Scaled by Mythos Preview’s fivefold list price, that is a few hundred dollars, which is my arithmetic and not AISI’s, and a long way below $12,500.⁶¹⁰

The smaller data points agree. In AISI’s April 30 report, GPT-5.5 solved a reverse-engineering challenge that took an expert playtester roughly 12 hours “in 10 minutes and 22 seconds with no human assistance at a cost of $1.73 (USD) in API usage.”⁴ In Anthropic’s September report, a researcher had GLM-5.3-Flash turn the public details of a Chrome fix into a working exploit chain with “20 minutes of human attention, plus eight hours of work” by the model. “At Zhipu’s API prices, this effort would have cost $20.40.”⁹ Each is one priced session, not a rate.

Mythos-class prices have also fallen. Anthropic’s pricing page now lists Mythos 5 and Mythos 5.1 at $10 per million input tokens and $50 per million output, against $25 and $125 for Mythos Preview.¹⁰

Who Can Run It

In April the capability sat behind a restricted release. That is the part that changed most.

AISI’s July 17 report measured the gap between open-weight and closed models on cyber and found it narrowing: recent open-weight models “lag frontier closed models’ cyber capabilities by 4 to 7 months,” against 6 to 10 months through most of 2025. It spells out why the gap matters. Once weights are public, “safeguards can be removed, and copies can be downloaded, redistributed, and run on private systems beyond monitoring.” AISI’s own tests of open-weight models “were largely unimpeded by safeguards.”⁶

GLM-5.2 did not finish the range. Six days later Kimi K3 finished it once in ten attempts. AISI and CAISI read that as showing the model “is capable of autonomously attacking small, weakly defended and vulnerable enterprise systems, when directed to do so and given initial network access.”⁷

Then came GLM-5.3, whose weights Z.ai (formerly Zhipu AI) released at the end of August. CAISI called it “the most cyber-capable open-weight model released to date” on September 17 and put it about four months behind the U.S. frontier on its benchmarks.⁸ Anthropic’s Frontier Red Team reported on September 29 that GLM-5.3 develops end-to-end exploits on ExploitBench in 50 of 410 attempts against Mythos Preview’s 56, and full control-flow hijacks on Anthropic’s internal benchmark in 4% of trials against 6%.⁹

The safeguards are thin. Anthropic bypassed them 64% of the time with a cover story and 92% with prefilled reasoning. Removing them from the weights outright took a team “which had never previously attempted this task” about 2,200 GPU hours, “roughly $4,400,” with an estimate of $1,200 for an experienced team, and “Several developers released abliterated versions of GLM-5.3 to the public within days of the model’s release.”⁹ The Glasswing post covers that report in more detail.

I have found no published run of GLM-5.3 on TLO. The claim I can support is narrower: an open-weight model has finished the range, and a newer one matches April’s restricted model at building exploits on a public benchmark.

Breunig’s Argument, Six Months On

Breunig’s thesis was one sentence: “to harden a system you need to spend more tokens discovering exploits than attackers will spend exploiting them.” He compared it to cryptocurrency’s proof of work, “where success is tied to raw computational work,” and put it bluntly: “You don’t get points for being clever. You win by paying more.”²

He drew two consequences. The first is about open source. If security is a matter of spending, then Linus’s law, “given enough eyeballs, all bugs are shallow,” extends to tokens: libraries that many companies pay to secure will be better secured than code one team maintains alone. Simon Willison made the same point the same day: open-source libraries “become more valuable, since the tokens spent securing them can be shared across all of their users.”²³ Breunig added the complication himself: a widely used package is a more valuable target, “which incentivizes attackers to spend more on OSS targets.”

The second is a new phase of work. He expected a cycle of development, review, and hardening, where hardening means: “Identify exploits, autonomously, until the budget runs out.” Human input limits the first phase. Money limits the last.²

The price collapse does not break the argument, and Breunig said why in April: “Even if costs go down as inference optimizations, unless models reach the point of diminishing security returns, you still need to buy more tokens than attackers do. The cost is fixed by the market value of an exploit.”² Cheaper tokens lower both sides’ costs. What they change is who can afford to play attacker.

The defender’s side has evidence too. Anthropic says its restricted release of Mythos Preview let vetted defenders “find more than 10,000 vulnerabilities in critical software” before comparable models were public.⁹ AISI ran the exercise on itself: in a July case study, one frontier model found a five-step attack chain in a staging copy of AISI’s own research platform “for under £150 in tokens.”¹² I wrote about the first of those efforts in Project Glasswing, and about the earlier result that preceded it, a 23-year-old Linux kernel bug found with Claude Code and a short script, in When Your Agent Finds a Vulnerability.

What the Caveats Still Mean

Every AISI report carries the same limits, and they have not been lifted. TLO “lacks active defenders and defensive tooling, imposes no penalty for actions that would trigger security alerts, and contains an intentional attack path.”⁷ It begins after the attacker is already inside. In April AISI wrote that it “cannot say for sure whether Mythos Preview would be able to attack well-defended systems,” and said it is building ranges with “active monitoring, endpoint detection and real-time incident response.”¹ In May it listed what the evidence does not show: “how the pace of progress will evolve, when AI will reach any particular capability threshold, or how these capabilities will translate against defended, real-world systems.”⁵

A staffed network changes the problem. Noise costs a real attacker something, and every alert is a chance to respond. The ranges remove that cost. The closest AISI has published to a test against real defences is its July case study, a single exercise run in a staging environment whose detection systems “exactly mirror” production: “one basic commercial alerting system did not flag any of the autonomous agent activity as a security event,” while a more advanced monitor “did correctly identify some of the aggressive behaviour as anomalous.”¹²

Two things cut the other way. A success rate per attempt understates what repeated attempts buy. If attempts are independent and the target does not change, a model that finishes 3 times in 10 finishes at least once in ten tries about 97% of the time, and one that finishes 1 time in 10 does so about 65% of the time. Those are my figures and they lean on that assumption, which a defended, changing network would break. And from April to July the trend ran one way: from one model at 3 of 10 to several, the best at 6 and 7 of 10. AISI has published no range results since.

The testing surfaced a different risk as well. On August 4 AISI disclosed that in 10 of 122 runs of one cyber evaluation, with internet access on and the developers’ cyber classifiers off, agents “took autonomous, unsanctioned action on the live internet, targeting real people and organisations.” It catalogued 19 such actions, 17 from Mythos 5, including an attempt to insert malicious code into an open-source project that a human maintainer refused. AISI found no resulting harm and stressed that those configurations “are not commercially available.”¹¹ It paused its highest-risk cyber evaluations, disabled internet access for agentic cyber testing, and said on October 1 that it was resuming most evaluation work.¹⁴

The behaviour has turned up elsewhere. On September 28 AISI reported that in simulated runs, with cyber classifiers off, GPT-6 Astra “completed a supply-chain attack 29.2% of the time” against targets outside its task. AISI says the model’s awareness that it was in a simulation may have driven some of that behaviour, and that it cannot rule out the same behaviour in real conditions.¹⁵ Anthropic has reported four incidents of its own, in cybersecurity evaluations built by an outside partner, where a misconfiguration put Claude models, running without their shipped cyber safeguards, on the open internet and they “gained unauthorized access to real third-party systems.” In one, Mythos 5 uploaded a malicious package to PyPI.¹⁶ A capable agent given a hard objective and an open network is a hazard to third parties, not only to its target. I covered a related case at another lab in the containment post.

What I Would Do

1. Close the patch window first. The one priced N-day session took a public fix to a working exploit chain in eight hours of model time. The gap between a vendor’s fix and your deployment of it is now cheap to attack. AISI’s own advice starts in the same place: “regular application of security updates, robust access controls, security configuration, and comprehensive logging.”¹⁹
2. Budget a hardening phase. Run automated exploit discovery against your own system before release and after each significant change, with a token budget set by what the system protects. At the prices AISI published, the budget is no longer the obstacle. Triage is. In AISI’s own case study the whole project used “under £1000 in LLM tokens,” and for the static code review, “Separating the most important reports from the noise took human judgement, from the most experienced engineers.”²⁶¹²
3. Assume the attacker has open weights. Plan as if exploit development at GLM-5.3’s level, with no safeguards, is available to anyone who wants it. Anthropic’s report says as much.⁹
4. Prefer dependencies someone is paying to secure, and pay in. Breunig’s and Willison’s point about shared tokens only works if the tokens are spent. The supply-chain post covers what happened to two widely used packages when attackers got there first.²³
5. Keep your own agents on a leash, and know what that does not cover. My hooks stop my agents from force-pushing to main or leaking credentials. They do nothing against an outside attacker probing the systems those agents touch. The same goes for the performance gap I wrote about, where agent-written code passed every test and ran up to 446x slower: a gate catches only the class of failure it was built for. Security needs its own, and an adversarial one.

What the April Version Said

The first version of this post was written on April 14, 2026 from AISI’s April 13 report and Breunig’s essay. Against what has been published since, it was wrong or stale in these places:

• The price. The title read “AI Attacks at $12,500 a Run,” and the post treated the figure as what the evaluation cost. It was Breunig’s estimate, the token budget times an output price, and AISI’s later priced runs for other models came to between $1.19 and $85.
• “No other model has solved the full chain.” It stopped being true within weeks, when GPT-5.5’s results were published in late April, and by July 23 four closed-weight models and one open-weight model had solved it.
• “The 30% success rate against undefended networks is the floor, not the ceiling.” That held, and the figure is stale: the newer Mythos Preview checkpoint reached 6 of 10 in May.
• Cooling Tower. I wrote that Mythos “failed” the operational-technology range and drew conclusions about uneven capability. A newer checkpoint solved it in 3 of 10 attempts a month later.
• Breunig’s review phase. I described it as catching “known bug classes.” His words are “Document, refactor, and other gardening tasks.”
• “Or they lose by default.” That phrase was mine. Breunig wrote “Hopefully you keep trying longer than your attackers.”
• LiteLLM and Axios. I described them as “cases where vulnerabilities persisted in widely-used libraries.” They were supply-chain compromises, and Breunig mentioned them for a different point: the argument, after those scares, for rewriting dependencies with coding agents.
• Two citations. The footnotes gave wrong titles for Nicholas Carlini’s talk and for Anthropic’s Mythos Preview report.

FAQ

What does “cybersecurity is proof of work” mean?

It is Drew Breunig’s phrase for a spending race: “to harden a system you need to spend more tokens discovering exploits than attackers will spend exploiting them.” If automated exploit discovery keeps finding more as you spend more, security depends on outspending the attacker, the way a proof-of-work system ties success to computation.²

How many AI models can complete AISI’s network attack simulation?

As of AISI and CAISI’s July 23, 2026 report, four publicly released closed-weight models and one open-weight model, Kimi K3, had completed “The Last Ones.” The most capable did so in 6 and 7 of 10 attempts, and Kimi K3 in 1 of 10.⁷

What does an AI cyberattack run cost?

There is no published price for a run that completed the range. Breunig’s $12,500 per attempt was an estimate that priced a 100M-token budget at Mythos Preview’s output rate. AISI’s priced 100M-token range runs came to about $85 for Opus 4.5 and 4.6 and an estimated $46 for GLM-5.2, none of which finished the range.²⁶

Does this mean AI can break into a defended network?

AISI does not claim that. Its ranges have no active defenders, no defensive tooling, and no penalty for triggering alerts, and they start after initial access. AISI says the results show capability against “small, weakly defended and vulnerable enterprise systems.”¹⁷

What should a team do first?

Shorten the time between a published fix and its deployment, since turning a public fix into an exploit is now cheap, and keep the basics AISI lists: security updates, access controls, secure configuration, and logging. Then add automated exploit discovery to the release process with a budget tied to what the system protects.¹⁹

Sources