01 · Recent AI evidenceThe workflow changes the economics
Two recent comparisons hold the task set and model constant while changing how the work is organized. One lowers execution spending; the other spends more for better coverage. They measure different outputs and use separate scales. Neither compares AI with human researchers.
AVRI: less spending, the same crash success
Model API bill across the same 20 CyberGym tasks · USD · bars start at zero
18% lower API spending. Includes failed selected runs and auxiliary model calls. Both configurations use GPT-5.5; AVRI helps retain and reuse analysis.
One selected run per task and configuration, with a supplied harness and known-vulnerable code. Engineering, hardware and human labor are unpriced. Crash success is broader than reproducing the known bug. Study, Table 3 · Full record.
AISLE: more calls buy a modest recall gain
Approximate list-price API cost per analyzed commit · USD · bars start at zero
About 5.7 times the API cost for 5 percentage points of recall. Same GPT 5.6 Luna model and retrospective 323-commit corpus; prices exclude cache discounts.
This identifies security patches rather than new vulnerabilities. Precision needs a larger clean sample, and engineering and adjudication are unpriced. Author’s comparison · Full record.
Novel discovery has useful observations too. Revelio reports about $300 in API charges for 19 author-validated findings across seven OSS-Fuzz projects; ten had been fixed by maintainers at reporting. Human triage, existing harnesses and engineering remain outside that bill. Mozilla’s March account confirms 22 security bugs and 90 other bugs. Its April follow-up reports 271 vulnerabilities fixed after a different model evaluation. Different scope, time and spending prevent a productivity ratio.
Other studies locate the remaining work. Generated CodeQL queries cost $12.99 and matched ground-truth files for 50 of 112 known CVEs, versus 19 for the default suite, but average file-level false discovery remained 89.92%. Drishti separates candidate sites, reachable message types and impact tests. Those are different units, not one conversion funnel; operator-time accounting is incomplete. Mastermind improves known-bug reproduction through planning and reuse, while its dollar figures are subscription-use estimates, not bills.
02 · Binchomp$183 in API spend per chain
Valentina Palmiotti’s Binchomp presentation reports 17 reproductions and six full low-privilege-to-SYSTEM chains from 21 known Windows kernel CVEs. Total experiment API spending was $1,098, including failed CVEs and chain attempts: $183 per verified chain. The targets were January–February 2026 vulnerabilities. Supplied deck, slides 13 and 30–34.
That is a material result in n-day redevelopment: starting with known vulnerabilities. Preparation, infrastructure and monitoring labor remain unpriced. The prototype used reusable libraries, expert guidance and manual monitoring. It ran through a CVP-verified organization account with safeguards enabled; its outputs were minimum viable capabilities, without evaluation as stealthy, maintained operational products.
The supported inference: affordable model execution can contribute to chain development. The $183 figure does not measure zero-day discovery, the full cost of a chain, or its sale price.
The deck’s Anthropic comparison uses different safeguards and trial conditions, with uncertainty about failed-attempt spending. It cannot supply a controlled efficiency ratio. The source note preserves those boundaries.
03 · Conference foundationsLower costs and harder problems can coexist
Thomas Dullien at BSides Zurich 2017 and Mark Dowd at HITB Singapore 2021 explain why initial target learning and transferable expertise matter. Dowd’s practitioner example contrasts months of preparation with much faster subsequent research. These illustrate reuse, rather than establish an industry labor average.
A competing force appears in Böhme and Falk’s ESEC/FSE 2020 fuzzing study: finding additional bugs can require sharply increasing compute, even when more resources find reachable bugs faster. Moussouris and Siegel’s RSA 2015 model connects discovery, stockpiling, remediation and reusable investment. Its simulated outcomes are not measured market forecasts.
| Conference contribution | Result and boundary |
|---|---|
| BinWhisper Black Hat USA 2025 | Illustrated successful runs cost roughly $11–$40. The full comparison includes failures at lower and higher spending; some models also failed on repeat runs. Human selection and verification remain. |
| Buttercup DEF CON 33 AIxCC stage, 2025 | About $39,600 in LLM and compute spending accompanied 28 findings and 19 patches. It combines discovery and repair, excluding system-engineering cost. |
| OSS-CRS WOOT 2026 | Seven findings in a selected deployment study. The paper specifies a $50 LLM budget per campaign, and separately reports days of integration work. |
| Rogers and Camastra Offensive AI Con 2026 | About $5 per generated PoC. Manual review and threat-model checks distinguish reproduced sanitizer crashes from security vulnerabilities. |
Two earlier studies clarify whose costs count. Finifter and colleagues, USENIX Security 2013, report $579,605 in Chrome rewards and estimate about $570,000 for Firefox by assuming $3,000 for each of 190 rewards. Those are historical buyer expenditures, with Firefox’s figure explicitly estimated; they do not reveal researchers’ unpaid attempts or all program overhead. Alomar and colleagues, SOUPS 2020, document validation, prioritization, staffing and remediation through interviews, without putting a unit price on triage.
The expanded inventory also includes recent conference work on harness design, firmware research and specialized agent-security testing. Ta-Lun Yen’s Device B engagement narrows 156 findings to 50 reports and 25 viable reports; those are not automatically vendor acceptances. Different acceptance gates explain why counting generated findings alone can mislead.
Full speakers, titles, dates and source locators: conference source index.
04 · Explore the evidence23 sources. 88 observations. Keep the units attached.
Browse 15 conference contributions, five preprints and three maintainer or industry accounts. The six historical conference sources remain in the inventory as foundations for learning, scaling, incentives and validation. Each record distinguishes what was measured, what was omitted and what the result can support.
Loading the study inventory…
No studies match these filters. Try a broader search or reset the filters.
05 · A measurement ruleCount every attempt; name the accepted output
A useful future observation would report:
+ in-scope delivery and upkeep Accepted outputs
This is an accounting specification, not a fitted model. Missing costs remain unknown. With no accepted outputs, unit cost is undefined. Record attempted targets, reproduced failures, accepted security findings and reliable end-to-end capabilities separately. Keep researcher hours, compute time and elapsed time distinct. A budget cap is not an observed bill.
06 · Implications for the visualizationsThree mechanisms worth showing
Make the acceptance steps visible.
Add candidate → reproduced failure → security-relevant finding before primitive → chain → access. Show expertise and reusable tooling feeding multiple stages. Proving relevance and delivering reliability may capture value; these talks do not measure where profits accrue.
Show competing pressures, with constraints at both ends.
Setup and verification can limit useful output even as execution accelerates. Reuse and learning reduce repeated work; depleted easy bugs, mitigations and new targets can increase it. Verification can also automate, so the bottleneck need not move permanently to triage.
Branch by what each buyer accepts.
Defensive buyers need relevant, deduplicated findings or patches. Capability buyers need reliable delivery under specified conditions. Tool suppliers spread engineering across users. Access, expertise and infrastructure affect participation alongside runtime spending. This is a mechanism, not evidence of market collapse.
07 · Evidence limitsThe missing bridge is accepted cost to market price
This curated review combines conference materials, empirical preprints and first-party accounts. It is not a systematic census or comparable time series. Matched workflow experiments support narrow comparisons; uncontrolled discovery campaigns show outcomes without isolating AI’s causal contribution. Publication dates do not establish when the research costs were incurred.
Google’s September industry analysis reports a different outcome mix for AI-attributed findings, but attribution and target-selection biases remain. No new broker-price survey was conducted. These results do not justify changing the calculator’s price multipliers.
The next useful study would disclose setup and supervision hours, every failed attempt, repeated runs and buyer-accepted outputs against a declared target sample. Independent reuse of the same harness would help separate transferable capability from its author’s expertise. Methods, implications and open questions.