AI vulnerability exploitation models are cheaper, but still miss depth

At a glance

What this is: Tenzai found that GLM-5.2 delivered the lowest cost per exploited vulnerability in its benchmark, but it did not lead on raw recall.

Why it matters: Security teams should read this as a warning that cheaper AI offensive tooling can scale exploitation attempts without necessarily closing the depth gap in detection, triage, or remediation.

By the numbers:

• GLM-5.2 exploited 67% of the planted vulnerabilities at $1.13 per lead.
• GPT-5.5 high achieved an additional 8% recall over the next best option.

Context

AI-assisted exploitation benchmarks are testing how well models can turn a weak lead into a working proof of concept. In this article, the security question is not whether a model can find some bugs, but how much exploit depth you get for the cost of each attempt, and how that changes attacker economics.

That matters because cost-efficient exploitation can increase volume faster than defensive teams improve coverage. For practitioners, the useful lens is not model hype but whether cheaper reasoning creates more realistic pressure on application security, vulnerability validation, and response capacity.

Key questions

Q: How should security teams interpret cheap AI exploitation models?

A: Treat them as attack-scale multipliers rather than direct substitutes for top-tier offensive skill. Cheap models can still convert weak leads into usable exploit work, which means cost efficiency can increase pressure on exposed applications even when raw recall is not best in class.

Q: Why does exploit recall matter less than attacker economics?

A: Because a model does not need perfect recall to create serious risk if it can cheaply generate many attempts. The practical question is how much exploit work an adversary can produce per dollar, since that determines how quickly weakness turns into operational pressure.

Q: What breaks when vulnerability discovery is cheap but shallow?

A: Defenders face more exploit attempts without receiving proportionate signal quality. That creates a depth gap where teams may see more noise, more testable hypotheses, and more repeated probing, while still missing the underlying weaknesses that matter most.

Q: Should teams prioritise model detection or application hardening?

A: Application hardening should come first when the concern is AI-assisted exploitation. Detection still matters, but the article’s benchmark suggests the cheapest offensive models already have enough capability to make repeated probing worthwhile, so reducing exploitability is the stronger control.

Technical breakdown

How AI exploitation agents turn a lead into a proof of concept

The benchmark uses a specialised agent, Bonzai, inside a larger orchestration system. The agent receives a lead, in this case a CWE and endpoint, then reasons through possible attack paths, tests hypotheses, and generates exploit artefacts such as proof-of-concept scripts. That workflow matters because the model is not merely classifying risk. It is attempting to operationalise a vulnerability hypothesis into usable exploit material. In security terms, the difference between spotting a flaw and exploiting it is the depth of reasoning, context reconstruction, and tool use the agent can sustain under limited prompting.

Practical implication: Practitioners should assume AI offensive systems can convert partial vulnerability clues into executable attack work, not just descriptions of risk.

Why recall and cost per lead are both security signals

Recall measures the fraction of planted vulnerabilities successfully exploited, while cost per lead captures the resource cost of each attempt. Those two metrics together show whether an attacker can scale breadth without collapsing quality. A model that is cheap but shallow may still matter because it can flood a team with more viable leads. A model that is more accurate but much more expensive may still be less operationally efficient for an adversary. Security teams should therefore read benchmark data as attacker economics, not just model performance.

Practical implication: Use both effectiveness and cost when judging how much real-world exploitation pressure an AI system can create.

What “efficient frontier” means for offensive AI risk

An efficient frontier in this context means no tested model is both cheaper and more accurate than GLM-5.2 in the benchmark variant described. That does not mean the model is best overall. It means it creates a strong price-to-output ratio for adversarial work, while the more capable frontier models still lead on raw success at higher spend. For defenders, this is the critical distinction: the attacker does not need the single best model if a near-best model is cheap enough to scale repeated attempts across many targets.

Practical implication: Prioritise controls that blunt repeated exploit attempts, not just the most advanced single-model attack path.

Threat narrative

Attacker objective: The attacker objective is to convert partial vulnerability hints into repeatable exploit success at scale and lower cost.

1. Entry begins with a weak vulnerability lead, reduced here to a CWE and endpoint, which an AI agent can use as a starting hypothesis for attack planning.
2. Credential or exploit development follows when the agent synthesises context, creates proof-of-concept scripts, and attempts to turn the lead into a working exploit.
3. Impact is measured as successful exploitation of planted vulnerabilities, which shows how cheaply adversaries can scale exploit discovery when reasoning and tooling are combined.

Breaches seen in the wild

• Meta Muse agent hijack 2026: An undocumented Muse setting let local malware hijack Meta's personal AI agent, steal its authentication material and abuse user access.

Read and download The State of NHI & AI Agent Breach Report 2026, covering 200+ breaches impacting Non-Human Identities including AI Agents.

NHI Mgmt Group analysis

Cost efficiency is now an attacker capability, not just a procurement metric. When a model can turn partial leads into working exploit artefacts at low cost, the attacker’s economics shift even if raw accuracy is not best in class. That means security leaders need to think about adversarial throughput, not only benchmark rank. The practitioner takeaway is to treat cheap reasoning as amplification of existing exposure, especially where vulnerability validation and exploit chaining are already weak.

The depth gap matters more than the headline recall number. A model that exploits 67% of planted vulnerabilities is operationally meaningful, but the remaining gap is where defensive resilience still lives. This is a control-depth problem, not a model-vs-model competition. The strongest programmes will look for ways to reduce exploitability at the application layer so that attacker efficiency has less room to convert into impact.

Offensive AI changes how quickly weakness becomes weaponised. The article shows that frontier models only outpace the cheaper configuration when buyers pay materially more for reasoning. That tells us the market is moving toward commoditised baseline exploitation capability, with depth reserved for those willing to spend more. For defenders, the implication is clear: shorten exposure windows and raise verification rigor before an AI-assisted attacker can iterate across enough leads.

Exploit generation is becoming a workflow problem, not a one-off human skill. The orchestration of specialised subagents shows how attack labour can be modularised, with one component finding, another reasoning, and another generating artefacts. That mirrors how modern defensive teams already distribute work across scanners, triage, and response, which is why governance of AI-assisted attack surfaces should be aligned to workflow stages. The practitioner conclusion is to defend the pipeline, not just the payload.

What this signals

AI-assisted exploitation is becoming economically practical for more actors. When the cost of turning a hint into an exploit falls, defenders should assume more repeated attempts against exposed endpoints, more variation in proof-of-concept generation, and less time between weakness discovery and weaponisation.

Security programmes need to measure exploitability depth, not only vulnerability counts. A large backlog of issues is serious, but the more urgent question is which defects can be translated into working exploit artefacts from minimal context. That is where application hardening, segmentation, and validation controls create the most leverage.

For practitioners

• Harden exploit validation at the application boundary Increase pre-production and runtime validation for the classes of weaknesses most likely to turn from a CWE hint into a working proof of concept, especially where endpoints expose clear attack surface cues.
• Re-baseline attacker economics in risk models Update threat models to include cheap AI-assisted exploit generation as a scaling factor, then reassess where repeated attempts, not single breakthroughs, drive risk.
• Prioritise depth of remediation over alert volume Focus remediation on defects that an AI agent could rapidly exploit from minimal context, because shallow fixes leave the cost curve favourable to attackers.
• Test controls against repeated exploit iteration Measure whether rate limits, segmentation, and validation controls still hold when the same lead is exercised many times with slightly different reasoning outputs.

Key takeaways

• The article shows that low-cost AI offensive tooling can materially change attacker economics even when it does not lead every benchmark.
• Benchmark recall is only part of the picture, because exploit depth and cost per lead determine how much pressure defenders will actually face.
• Security teams should focus on reducing exploitability and repeated attack success, not only on spotting the most capable model.

Deepen your knowledge

NHI Mgmt Group covers identity security, NHI governance, and agentic AI through independent research, practitioner guides, and the NHI Foundation Level course. It is designed for practitioners who need to connect identity governance to the security decisions their programmes already make.