# Research synthesis, 2026-10-17: what does discovery cost?

Source document for [the discovery-cost edition](../../2026-discovery-costs.html), [the conference index](CONFERENCE-SOURCES.md), and [the typed cost observations](../../data/discovery-cost-evidence-2026-10.json).

**Question.** What does Binchomp add to the report, what do the other talks actually measure, and what recent evidence shows AI changing vulnerability-research workflows?

**Method.** Targeted primary-source review through October 17, 2026: **23 source records, 88 typed observations**. The inventory covers 15 conference contributions, five empirical preprints and three first-party maintainer/industry reports. All 11 originally discussed talks now have records, including the six historical baselines. The expanded search prioritized July–October AI results with costs, time, accepted outcomes or matched comparisons. Primary PDFs, author accounts and official programs were inspected; key tables were visually checked. This remains a curated set, not a systematic census or comparable longitudinal series. Publication dates, event dates and experiment windows are distinct. [Recent-source selection and exclusions](RECENT-AI-SOURCES.md).

## 1. Revised reading

Cheap model execution can coexist with expensive research capability. A reusable system may lower the cash needed for another attempt while depending on accumulated expertise, harnesses, infrastructure and human judgment. The relevant question is **which cost fell, for which output, under which conditions?**

The evidence expands the report's four pricing objects rather than replacing them. A candidate finding and a reproduced crash are intermediate research outputs; they do not automatically qualify as a security-relevant defect, a usable primitive, a reliable chain or operational access. Likewise, an API invoice measures a production input, not a buyer's willingness to pay.

## 2. Binchomp: a material result with a specific denominator

The [supplied deck](https://www.beautiful.ai/player/-P2q0r-B7nGYGGK3-32Z/Binchomp-N-Day-Pipeline-Pres), slides 13 and 30–34, describes redevelopment from known Windows kernel CVEs. It reports 17 reproductions and six full low-privilege-to-SYSTEM chains from 21 January–February 2026 CVEs. Total experiment API spending was $1,098, including failed CVEs and chain attempts: $183 per verified chain. Researcher preparation, infrastructure and monitoring labor are unpriced.

The prototype was manually monitored, used reusable libraries and expert guidance, and ran through a CVP-verified organization account with safeguards enabled. Minimum viable outputs were not evaluated as stealthy, maintained operational products. The deck compares against Anthropic results with different safeguards and trial conditions, and explicitly leaves uncertainty about the comparator's failed-attempt spending. This is not a controlled efficiency ratio or a $183 zero-day discovery estimate. Its rerun evidence about time and retries is qualitative.

The inference for this report is narrower and useful: **automation can reduce marginal costs beyond candidate generation, while expert preparation and verification remain consequential.** It weakens any blanket claim that affordable models stop at bug finding. It does not establish a generally available, reliable zero-day chain service. [Detailed source pointer](../../sources/2026-valentina-palmiotti-binchomp.md).

## 3. Additional conference evidence

The full titles, speakers, dates, locators and exclusions are in the [conference source index](CONFERENCE-SOURCES.md). These observations are deliberately kept in their original units.

| Contribution | What it adds | What it cannot establish |
|---|---|---|
| Dullien, BSides Zurich 2017 | Upfront target learning and transferable knowledge change the cost of subsequent research. | A measured universal decline in discovery costs. |
| Dowd, HITB Singapore 2021 | A practitioner example separates months of initial learning from much faster later discoveries and exploit development. | A representative industry labor-cost estimate. |
| Böhme and Falk, ESEC/FSE 2020 | Fuzzing experiments distinguish finding known-reachable bugs faster from finding additional bugs; the latter can have sharply increasing compute requirements. | Dollar costs including labor, or the same law for all research methods. |
| Moussouris and Siegel, RSA 2015 | Feedback among discovery, stockpiling, remediation and reusable research investment. | Empirical market forecasts from simulation outputs. |
| Finifter et al., USENIX Security 2013 | Chrome payout records and an explicitly estimated Firefox payout measure the buyer's expenditure. | The supplier's full discovery cost; unpaid attempts and program overhead are not thereby priced. |
| Alomar et al., SOUPS 2020 | Interviews expose validation, prioritization, staffing and remediation work after discovery. | A numerical triage cost or proof of a temporal bottleneck shift. |
| Dai and Xie, Black Hat USA 2025 — BinWhisper | Illustrated successful runs cost roughly $11–$40; failures occur at lower and higher spending, and some models fail on repeat runs. | A common cost per successful zero-day across models or targets. |
| Brown, DEF CON 33 AIxCC stage 2025 — Buttercup | Roughly $39,600 in LLM and compute spending accompanies 28 findings and 19 patches. | Discovery-only cost, or an all-in cost including system engineering. |
| Chin et al., WOOT 2026 — OSS-CRS | Seven findings in a selected deployment study; paper specifies a $50 LLM budget per campaign and separately reports days of integration labor. | That every accepted vulnerability costs less than $50 in total. |
| Rogers and Camastra, Offensive AI Con 2026 | Approximately $5 per generated PoC, but manual review and threat-model checks reject simplistic crash-to-vulnerability equivalence. | That 79 reproduced sanitizer crashes are 79 confirmed security vulnerabilities. |

Sources: [Dullien](https://thomasdullien.github.io/about/index.html), [Dowd slides](https://conference.hitb.org/files/hitbsecconf2021sin/materials/KEYNOTE%201%20-%20Security%20Technology%20Arms%20Race%20-%20Mark%20Dowd.pdf), [fuzzing paper](https://mboehme.github.io/paper/FSE20.EmpiricalLaw.pdf), [RSA slides](https://cams.mit.edu/wp-content/uploads/2017/12/The-Wolves-of-Vuln-Street-The-1st-System-Dynamics-Model-of-the-0day-Market.pdf), [USENIX Security paper](https://www.usenix.org/system/files/conference/usenixsecurity13/sec13-paper_finifter.pdf), [SOUPS paper](https://www.usenix.org/system/files/soups2020-alomar.pdf), [BinWhisper slides](https://i.blackhat.com/BH-USA-25/Presentations/US-25-Dai-BinWhisper.pdf), [Buttercup accounting](https://blog.trailofbits.com/2025/08/09/trail-of-bits-buttercup-wins-2nd-place-in-aixcc-challenge/), [OSS-CRS paper](https://www.usenix.org/system/files/woot26-chin.pdf), [sanitizer talk](https://joshua.hu/files/sanitizers/oaic-2026-slides.pdf).

## 4. What the deeper recent search adds

The strongest new evidence concerns **workflow choices within a task**, rather than a universal percentage by which AI made discovery cheaper.

| Record | Observation | Interpretation boundary |
|---|---|---|
| DC19 — [AVRI, October 8](https://arxiv.org/html/2610.11602v1), Table 3 | On the same 20 tasks, Codex API spend falls from $132.65 to $108.75; crash success remains 85%, and stricter recall rises from 65% to 75%. | One selected run per configuration/task; known-vulnerable repositories with supplied harnesses. No repeat-run uncertainty or all-in cost. |
| DC12 — [AISLE, October 2 talk adaptation](https://aisle.com/blog/before-the-cve-mining-open-source-commits-for-negative-day-vulnerabilities), Figures 6–7 | Same-model patch classifier: about $0.001/commit and 90% recall for a single call, versus $0.0057 and 95% with an agent. | 323 commits in 40 retrospective windows; clean-sample precision unresolved. A patch-classification cost is not a new-vulnerability cost. |
| DC21 — [Reusable query generation, September 9](https://arxiv.org/html/2609.10412v1), Tables 3–4 | $12.99 synthesizes 96 queries; known-CVE file detections rise from 19 to 50 of 112. | Average file-level false-discovery rate remains 89.92%. These are queries and file matches, not 50 accepted discoveries. |
| DC20 — [Revelio, June 20](https://arxiv.org/html/2606.22263v1), §V-A | About $300 API spend yields 19 author-validated findings across seven projects; 10 were fixed by maintainers at reporting. | Manual triage and existing OSS-Fuzz harnesses matter; novel-discovery campaign has no matched baseline. |
| DC23 — [Mastermind, July 2](https://arxiv.org/html/2607.01764v1), Tables VI–VII | Same 200-task reproduction evaluation: 126 versus 169 passes; coarse execution equivalents of $3,600 versus $1,300. | Runs used subscriptions; dollars are estimated pay-as-you-go equivalents. Planner training is excluded. |

The three additional conference records reinforce the acceptance boundary. **Harness & Hunt (DC16)** reports 630 adjudicated findings; the cheaper model produces fewer candidates and fewer false positives on a shared static target, without a dollar ledger. **Yen (DC17)** reports 156 Device B findings, 50 reports and 25 viable reports across three days; viability is not vendor acceptance. **AgentBreaker (DC18)** supplies a scan-cost comparison for a specialized agent-security testbed, adjacent to conventional software discovery. Its training and hardware costs remain incomplete. Their primary locators are in the [conference index](CONFERENCE-SOURCES.md).

**Drishti (DC22)** makes an additional measurement issue visible: its audit progresses from raw matches to code sites, reachable information-element types and representative runtime tests. Those are different units. They illustrate validation work, but their ratios cannot be interpreted as an ordinary candidate-to-vulnerability conversion funnel.

Maintainer evidence also matters. Mozilla confirms **22 security bugs** from the February Opus 4.6 collaboration (DC13) and reports **271 vulnerabilities fixed in Firefox 150** following an initial Mythos Preview evaluation (DC14). The two counts lack comparable scope, duration and spending: they establish useful output, not a model-productivity multiplier. Anthropic's separate $4,000 exploit-development expense must not be attached to discovery. [Mozilla March report](https://blog.mozilla.org/en/firefox/hardening-firefox-anthropic-red-team/), [April follow-up](https://blog.mozilla.org/en/firefox/ai-security-zero-day-vulnerabilities/).

The September 30 [GTIG analysis](https://cloud.google.com/blog/topics/threat-intelligence/vulnerability-discovery-and-exploitation-trends-in-the-ai-era) (DC15) provides industry context: AI-attributed disclosures have a 50% RCE share versus 26% in the comparison cohort. Attribution gaps, target selection and unknown cohort sizes prevent a causal inference. Rising aggregate disclosure counts also include reporting-policy effects. We do not label that rise an AI effect.

## 5. Accounting framework for future observations

For a stated target class and time window, record:

1. **Setup:** target learning, harnesses, tool engineering and reusable research libraries. State how these fixed costs are allocated across runs.
2. **Execution:** model charges, compute and human intervention for every attempted target, including failures.
3. **Acceptance:** reproduction, deduplication, reachability and security-impact verification, followed by the buyer's acceptance decision where available.
4. **Delivery and upkeep:** reliability, version coverage, integration and maintenance, only when those outputs are within the experiment's scope.

A proposed accounting identity is `(allocated setup + all-attempt execution + verification + in-scope delivery/upkeep) / accepted outputs`. It is a measurement specification, not a fitted model. With no accepted outputs the unit cost is undefined. Missing components must remain missing, never silently zero.

Record at least four denominators separately: attempted targets, reproduced failures, accepted security vulnerabilities, and reliable end-to-end capabilities. Keep wall-clock time distinct from researcher hours and compute time. Record privileges, source access, known-CVE hints, safeguards, model access and existing harnesses alongside each result. A budget cap is not an observed bill. A confidence score is not a repeated-trial success rate.

## 6. What changes in the three conceptual visualizations

These are hypotheses about mechanisms, not observed market-share or time-series estimates.

### Where value moves

Add candidate → reproduced failure → security-relevant finding before the report's primitive → chain → access progression. Show reusable expertise and tooling feeding several stages. Value may accrue to proving relevance, delivering reliability and reaching buyers even when an individual generation step becomes cheap. The talks do not establish the distribution of profits across those stages.

### Where the bottleneck moves

Show both a setup constraint and an acceptance constraint. Automation can speed analysis, reproduction and some chain development; its usefulness still depends on usable target environments and trustworthy verification. Draw competing pressures: reuse and learning reduce repeated effort, while easy-bug depletion, mitigations and new target classes can increase it. This prevents a misleading one-way march from expensive discovery to permanently expensive triage: verification can also automate.

### How the market branches

Branch by the output and acceptance conditions. Defensive buyers need valid, relevant, deduplicated findings or patches. Capability buyers need reliability and delivery under specific conditions. Tooling suppliers can amortize engineering across users. Participation depends on access, expertise and reusable infrastructure as well as runtime spending. These talks support the mechanism; they do not establish shrinking middle-market share, falling broker prices, or the end of independent research.

## 7. Implications for existing editions and the model

- Preserve earlier dated editions as point-in-time arguments; link this update from the main evidence edition and landing page.
- Qualify the July claim that discovery costs roughly $48 per bug on open-source C: such a figure needs its experiment, cost boundary and accepted-output definition attached. This research does not independently re-audit that original estimate.
- Treat September's access thesis as one constraint among several. Binchomp has accessible-model relevance, but its verified-account condition and substantial preparation prevent an unrestricted-access inference.
- Keep this evidence file separate from transaction and bounty-offer corpora. Do not change the calculator's price multipliers on the basis of runtime spending. No new broker-price survey was performed in this pass.

## 8. Evidence that would improve the conclusion

The strongest next study would report repeated comparable runs, all failed attempts, setup and supervision hours, and buyer-accepted output against a declared target sample. A portable harness tested by an independent team would help distinguish reusable capability from author-specific expertise. A measured fall in buyer-accepted unit cost could then be compared with actual payouts or transactions; these talks alone cannot supply that causal bridge.

## 9. Data and graphing contract

The [JSON inventory](../../data/discovery-cost-evidence-2026-10.json) is canonical. The [observation CSV](../../data/discovery-cost-observations-2026-10.csv) contains one row per typed observation, with source, units, cost scope and exclusions. Compound observations retain their complete fields in `observation_json`; blank scalar cells mean unknown or not applicable, never zero. All historical talks are included, even where they supply mechanisms or interview counts rather than dollar measurements.

The [comparison CSV](../../data/discovery-cost-comparisons-2026-10.csv) is narrower: seven numeric configuration points from AVRI and AISLE. Plot only within `comparison_group`, retaining `cost_denominator` and the study-specific endpoint. AVRI's time field sums task durations; it is not a parallel campaign's wall time. The AISLE multi-agent cost is blank because it is unreported. There is deliberately no pooled cost-per-bug estimate.

Regenerate both exports with `python3 tools/export-discovery-evidence.py`; verify them with the same command plus `--check`. The public-facing article loads the same JSON for its searchable inventory. A source date is metadata, not a measurement of a market trend.

## Provenance and limits

Prepared against GitHub main commit `96bc79a5d0637f2971be49a9c8a9ca482e511667`, downloaded 2026-10-17. This pass adds a research layer; it does not revalidate all historical claims elsewhere in the repository. Conference materials remain author-reported evidence, with varied task definitions and incomplete labor accounting. The linked index documents date precision and source locators; unverified archival URLs are left absent.