Corporate security budgets are racing to catch up as the cost of breaking into a corporate network with AI has fallen 99% in five months. The shift in economics means that traditional, static defense models are becoming financially unsustainable. Goldman executives have discussed how the firm could soon be on track to spend as much or more on AI for security than it spends on AI coding tools, illustrating how deeply defensive compute requirements are weighing on enterprise balance sheets.
How much does it now cost to defend a corporate network against autonomous AI attacks? The answer lies in a fundamental asymmetry: defenders must pay to investigate every incoming threat, whereas rational attackers optimize their compute spend to target high-value targets. Because cheap defensive filters block low-effort noise, attackers no longer spray small targets. Instead, they concentrate their tokens where the expected financial payout far outweighs their minimal computational outlay.
The Fall of Autonomous Attack Costs
In April, Anthropic and OpenAI tested whether Claude Mythos Preview and GPT-5.5 could break into a simulated British corporate network—a 32-step hack across 20 servers that takes a human expert 20 hours. Both models took over the network without human help, and the Bank for International Settlements priced the break-in at $5k to $10k.
Five months later, that cost structure collapsed. Claude Mythos 5 dropped the cost to $770 in June, and Claude Opus 5 to $385 in July. By August, Zhipu’s open-weight GLM-5.3 matches Mythos’s exploit rate for $90—one-sixtieth of April’s frontier cost.
Zhipu’s open-weight GLM-5.3 matches Mythos’s exploit rate for $90 : one-sixtieth of April’s frontier cost.
This drastic reduction in token expenditure equips attackers with advanced capabilities at a fraction of past pricing. Consequently, enterprise security teams must rethink how they assign resources against cheap, automated exploit runs.
Compounding Multipliers on the Security Operations Center
Security defenders could argue that automated detection tools and AI SOC agents already handle high volumes of alerts efficiently, mitigating the threat of cheap attacks. In the security operations center, AI agents relieve overwhelmed human teams who face more than 4,400 alerts a day and historically lacked the hours to examine two-thirds of them. Autonomous investigations compress a 70-minute manual review into minutes for about $2 of compute per alert, freeing analysts to focus on real intrusions.
Yet the cost ratio still starts tilted toward the attacker, because the SOC must inspect every alert, every hour. Three multipliers compound that defensive compute requirement.
First, intrusion speed has accelerated dramatically. As Glean CISO Sunil Agrawal noted, AI compresses intrusion response from months to minutes, while CrowdStrike records average breakout times of 29 minutes and a fastest of 27 seconds.
Second, parallel swarms present scale challenges. In the July 2026 intrusion at Hugging Face, a swarm of 700 AI agents coordinated across four and a half days, exchanging 70,000 messages and executing 17,600 actions until they harvested 136 production keys. As Cogent Research found, 76% of new monthly enterprise attack paths (up 386% year over year) are viable only for parallel AI swarms.
Cogent Research finds 76% of new monthly enterprise attack paths (up 386% year over year) are viable only for parallel AI swarms.
Third, non-human identities expand the attack surface. Non-human identities already outnumber employees 82 to 1, and as enterprise agent fleets scale to 100x headcount, every new agent expands the surface area to defend.
A Strategy Driven by Expected Value
The CISO’s job is no longer stacking per-seat insurance policies. It is maximizing the efficiency and effectiveness of the security stack : buying enough compute, and converting it into enough defensive tokens, to drive the attacker’s expected value below zero.
With open-weight models conducting full network takeovers for $90, defensive systems are forced to process continuous streams of agentic threats where every manual check adds expense, leaving enterprise defenses tethered to the price of a single $2 investigation token.
What it signals
Rational attackers stopped burning tokens on indiscriminate sweeps and now concentrate inference strictly on high-value targets. A corporate security operations center must continuously verify thousands of inbound warnings, while the adversary pays purely for the single exploit path that works. That financial asymmetry grows harsher as network intrusion speeds plunge down to a recorded 27 seconds.