The Short Answer
By one investor's estimate, the compute cost of an AI-run corporate network break-in fell about 99% in five months, to roughly $90 per attempt on an open-weight model. For a bank, the defense has to be priced by usage too: with ibl.ai you own all the code and the data, and your security agents run on infrastructure you control.
The 99% figure comes from Tomasz Tunguz of Theory Ventures, in a post titled A $90 Key into Your Company's Secrets, published 6 November 2026.
It is an estimate built on public evaluations and public token prices, not a measured attack. This post traces it back to those sources, separates what is measured from what is modeled, and turns it into questions a financial services board can put to its CISO.
What does "the cost of an AI network break-in" actually measure?
The benchmark behind the number is "The Last Ones", a simulated corporate network attack built by the UK AI Security Institute (AISI).
AISI describes it as a 32-step attack simulation running from initial reconnaissance to full network takeover, which it estimates would take a human expert about 20 hours.
On 13 April 2026 AISI reported that Claude Mythos Preview was the first model to solve the range from start to finish, in 3 of 10 attempts, completing an average of 22 of the 32 steps. AISI ran the ranges with a 100 million token budget.
So "the cost of a break-in" in the circulating figure means the price of that 100M-token budget at a given model's API rates. It is the compute for one autonomous attempt against a simulated network, not the cost of a real intrusion.
How fast did the AI break-in cost fall in 2026?
For the two Claude models, Tunguz prices the 100M-token budget using a 7:2:1 split of cached input, uncached input and output tokens. We re-ran his arithmetic against Anthropic's published API prices and it matches for the two Claude models.
| Model (as dated by Tunguz) | $/MTok cached · uncached · output | Cost of a 100M-token attempt | Basis |
|---|---|---|---|
| Claude Mythos Preview (April release) | not published | $5,000–$10,000 | BIS Bulletin 129 (20 July 2026), at then-current cloud prices |
| Claude Mythos 5 (June) | $1 · $10 · $50 | $770 | Published prices, recomputed |
| Claude Opus 5 (July) | $0.50 · $5 · $25 | $385 | Published prices, recomputed |
| Zhipu GLM-5.3, open-weight (September) | $0.902 blended | ~$90 | Blended price Tunguz cites from Artificial Analysis |
The GLM-5.3 row uses a blended price, not the 7:2:1 split, so it is an approximation rather than a like-for-like figure.
From the $5,000–$10,000 range to about $90 is a fall of 98% to 99%, which is where the headline comes from.
The first row comes from BIS Bulletin No. 129, which priced a 100M-token attack on Claude Mythos Preview at $5,000–$10,000 "at current cloud prices" in July; the same bulletin already put cheaper models such as Grok or DeepSeek at $50–$100 per attack.
A cheap attempt is not new; what GLM-5.3 changes is the capability available at that price.
The circulating version of this story, "$10,000 in June, $100 now", gets both the month and the endpoints wrong. The high figure is BIS's July estimate for April's Mythos Preview, June's Mythos 5 attempt prices at $770, and the low figure is about $90.
Is a $90 attempt the same as a $90 breach?
No, and this is the distinction most retellings drop. Each row in the table is the compute for one attempt, and attempts fail.
Mythos Preview completed the range in 3 of 10 attempts in April. In its 13 May update, AISI reported that a newer Mythos Preview checkpoint solved it in 6 of 10 attempts, and GPT-5.5 in 3 of 10.
At a 30% success rate, the expected compute per successful run is about 3.3 times the cost of one attempt. At 60% it is about 1.7 times.
We found no public result showing GLM-5.3 completing The Last Ones. Its $90 is the price of the token budget, not a demonstrated takeover, so the cheapest row is also the least proven.
Why does the open-weight GLM-5.3 matter more than the price cut?
Price cuts on a closed model can be withdrawn and its use can be monitored. An open-weight model's weights, once released, cannot be recalled.
In a 29 September 2026 research post, Anthropic reported that GLM-5.3 built end-to-end V8 exploits in 50 of 410 attempts on ExploitBench, against 56 of 410 for Claude Mythos Preview.
The same post found simple techniques bypassed GLM-5.3's safeguards between 64% and 100% of the time in simulated tests, and that removing its refusals took about 2,200 GPU hours, roughly $4,400.
Anthropic also reported that a researcher using the smaller GLM-5.3-Flash built a working exploit chain for a known Chrome flaw with about eight hours of model work, which would have cost $20.40 at Zhipu's API prices.
Epoch AI's 16 October analysis places the open-weight cyber frontier roughly where the closed frontier stood 6 to 7 months earlier. Read together, the gap that once rationed this capability is now measured in months.
What do central banks say AI cyber capability means for financial institutions?
The Bank for International Settlements took up the question in BIS Bulletin No. 129, "A Mythos moment? Frontier AI and cyber risk", published 20 July 2026.
Its summary says frontier AI could "increase the speed, scale and complexity of cyber attacks" and that the balance may favour attackers. It adds that "swift adoption of frontier AI models to review code bases and fix vulnerabilities is essential."
That is the regulator-side version of the cost table above. When offensive compute costs tens or hundreds of dollars per attempt, the binding constraint on a bank's exposure is how quickly its own code and alerts get reviewed.
How should a financial institution pay for AI cyber defense?
Offense in the table above is priced by the token. A security stack priced by the seat scales with headcount instead of with the volume of alerts and code that needs reviewing.
Tunguz makes the same point in one line: "The CISO's job is no longer stacking per-seat insurance policies." He estimates autonomous alert investigation at about $2 of compute per alert, against a 70-minute manual review.
For a bank, the practical consequence is that defensive AI should be bought the way attackers buy it: by usage, on models you can switch, inside your own perimeter. We made the per-seat versus usage case for the sector in the AI cost math for financial services.
The other half is control of the agents themselves. Any agent that reviews code, reads alerts or touches production carries credentials, which is how the Binance and Allium breach became an agent security story.
Why are investors funding AI agent control planes now?
Money is following the same math. On 11 November 2026 SecurityWeek reported that Bay, a Tel Aviv startup founded in February 2026, emerged from stealth with $50 million.
The round combines a $37 million Series A led by Battery Ventures with a previously undisclosed $13 million seed led by YL Ventures and Striker Venture Partners. Its three founders are alumni of the Israeli military intelligence Unit 8200.
Bay describes a single control plane that inventories AI agents, coding assistants and MCP servers, follows each session, and permits, escalates, reroutes or blocks each proposed action. It is one of several funded answers to the same question: what are our agents allowed to do?
What should a bank board ask its CISO after this cost collapse?
Five questions follow directly from the sources above, and none needs a new technology to answer.
- What would an autonomous attempt against us cost? If the answer is still "too expensive to bother", it is out of date: the priced attempt in the table above fell from thousands of dollars to under $1,000 on Mythos 5.
- How much of our alert queue is actually reviewed? Tunguz cites teams facing more than 4,400 alerts a day. Ask what share gets an investigation, human or automated.
- Is our defensive AI priced by seat or by usage? Per-seat licensing caps how much review you can afford at exactly the moment review volume needs to grow.
- Can we switch the model under our defensive agents? Epoch AI puts the open-weight cyber frontier just 6 to 7 months behind the closed one. A defense locked to one vendor's model cannot follow it.
- Who holds the logs and permissions of every agent we run? If an agent is compromised, the inventory, session history and credentials need to be in systems you control. NIST's draft taxonomy makes the same architectural point, covered in what agencies should check before deploying AI agents.
How does ibl.ai fit a bank's AI security posture?
ibl.ai is an agentic AI platform for organizations that need to run AI agents on infrastructure they control. You own all the code and the data, under a perpetual source-code license, deployed in your cloud, on-premise or fully air-gapped.
It is model-agnostic, so the agents a security team builds on it can run a frontier API model today and a self-hosted open-weight model tomorrow without a rewrite. Hosting open-weight models yourself is covered in our note on GLM-5.3-Flash and self-hosting.
It carries no per-seat pricing: cost tracks the tokens and GPUs your workloads use. ibl.ai is family-owned and operated from New York, NY, and 1.6M+ users across 400+ organizations run the platform today.
ibl.ai is not a SOC product and does not replace one. It is the layer where an institution's own agents, models, logs and permissions live, which is the layer the cost collapse makes urgent to own.