--- title: "AI Network Break-In Costs Fell About 99% in Five Months: What Bank Boards Should Ask" slug: "ai-network-break-in-cost-fell-99-percent-financial-services" author: "Mikel Amigot" date: "2026-11-13 14:00:00" category: "Premium" topics: "AI cyber attacks, cost of AI hacking, autonomous network intrusion, UK AISI The Last Ones, Claude Mythos Preview cyber, GLM-5.3 cyber capability, open-weight model risk, financial services cybersecurity, bank board cyber risk, AI SOC, AI agent security, Bay AI agent control plane" summary: "One investor's estimate puts the compute cost of an AI-run corporate network break-in down about 99% in five months, from thousands of dollars to about $90 per attempt, as open-weight models caught up; here is what the primary sources show and what financial services boards should ask." banner: "" thumbnail: "" linkedin: | The compute bill for an AI-run corporate network break-in fell about 99% in five months, by one investor's estimate. The primary sources behind that number are worth reading carefully. → April 2026: the UK AI Security Institute reported the first model to complete its 32-step simulated corporate network attack end to end, a range it estimates takes a human expert 20 hours. It succeeded in 3 of 10 attempts, on a 100M-token budget. → September 2026: Anthropic reported that GLM-5.3, an open-weight model, built end-to-end V8 exploits in 50 of 410 attempts, against 56 of 410 for the frontier model that cleared the range. → October 2026: Epoch AI put the open-weight cyber frontier 6 to 7 months behind the closed one. Price that 100M-token budget at published per-token rates and it runs from $770 to about $90. That is a cost per attempt, not per breach, and no public result shows the cheapest model completing the range. For financial services boards the shape matters more than the exact figure: offense is now priced by the token. Defense priced by the seat is the wrong shape for that fight. With ibl.ai you own all the code and the data, model-agnostic across any LLM, with no per-seat pricing, deployable anywhere from your own cloud to a fully air-gapped network. #iblai #AgenticAI #EnterpriseAI #Cybersecurity #FinancialServices #AISecurity --- ## The Short Answer **By one investor's estimate, the compute cost of an AI-run corporate network break-in fell about 99% in five months, to roughly $90 per attempt on an open-weight model. For a bank, the defense has to be priced by usage too: with ibl.ai you own all the code and the data, and your security agents run on infrastructure you control.** The 99% figure comes from Tomasz Tunguz of Theory Ventures, in a post titled [A $90 Key into Your Company's Secrets](https://tomtunguz.com/a-90-dollar-key-into-your-companys-secrets), published 6 November 2026. It is an estimate built on public evaluations and public token prices, not a measured attack. This post traces it back to those sources, separates what is measured from what is modeled, and turns it into questions a financial services board can put to its CISO. ## What does "the cost of an AI network break-in" actually measure? The benchmark behind the number is "The Last Ones", a simulated corporate network attack built by the UK AI Security Institute (AISI). AISI describes it as [a 32-step attack simulation](https://www.aisi.gov.uk/blog/our-evaluation-of-claude-mythos-previews-cyber-capabilities) running from initial reconnaissance to full network takeover, which it estimates would take a human expert about 20 hours. On 13 April 2026 AISI reported that Claude Mythos Preview was the first model to solve the range from start to finish, in 3 of 10 attempts, completing an average of 22 of the 32 steps. AISI ran the ranges with a 100 million token budget. So "the cost of a break-in" in the circulating figure means the price of that 100M-token budget at a given model's API rates. It is the compute for one autonomous attempt against a simulated network, not the cost of a real intrusion. ## How fast did the AI break-in cost fall in 2026? For the two Claude models, Tunguz prices the 100M-token budget using a 7:2:1 split of cached input, uncached input and output tokens. We re-ran his arithmetic against [Anthropic's published API prices](https://platform.claude.com/docs/en/about-claude/pricing) and it matches for the two Claude models.
Model (as dated by Tunguz) $/MTok cached · uncached · output Cost of a 100M-token attempt Basis
Claude Mythos Preview (April release) not published $5,000–$10,000 BIS Bulletin 129 (20 July 2026), at then-current cloud prices
Claude Mythos 5 (June) $1 · $10 · $50 $770 Published prices, recomputed
Claude Opus 5 (July) $0.50 · $5 · $25 $385 Published prices, recomputed
Zhipu GLM-5.3, open-weight (September) $0.902 blended ~$90 Blended price Tunguz cites from Artificial Analysis
The GLM-5.3 row uses a blended price, not the 7:2:1 split, so it is an approximation rather than a like-for-like figure. From the $5,000–$10,000 range to about $90 is a fall of 98% to 99%, which is where the headline comes from. The first row comes from [BIS Bulletin No. 129](https://www.bis.org/publ/bisbull129.htm), which priced a 100M-token attack on Claude Mythos Preview at $5,000–$10,000 "at current cloud prices" in July; the same bulletin already put cheaper models such as Grok or DeepSeek at $50–$100 per attack. A cheap attempt is not new; what GLM-5.3 changes is the capability available at that price. The circulating version of this story, "$10,000 in June, $100 now", gets both the month and the endpoints wrong. The high figure is BIS's July estimate for April's Mythos Preview, June's Mythos 5 attempt prices at $770, and the low figure is about $90. ## Is a $90 attempt the same as a $90 breach? No, and this is the distinction most retellings drop. Each row in the table is the compute for one attempt, and attempts fail. Mythos Preview completed the range in 3 of 10 attempts in April. In its [13 May update](https://www.aisi.gov.uk/blog/how-fast-is-autonomous-ai-cyber-capability-advancing), AISI reported that a newer Mythos Preview checkpoint solved it in 6 of 10 attempts, and GPT-5.5 in 3 of 10. At a 30% success rate, the expected compute per successful run is about 3.3 times the cost of one attempt. At 60% it is about 1.7 times. We found no public result showing GLM-5.3 completing The Last Ones. Its $90 is the price of the token budget, not a demonstrated takeover, so the cheapest row is also the least proven. ## Why does the open-weight GLM-5.3 matter more than the price cut? Price cuts on a closed model can be withdrawn and its use can be monitored. An open-weight model's weights, once released, cannot be recalled. In a [29 September 2026 research post](https://www.anthropic.com/research/glm-5-3-and-the-spread-of-advanced-cyber-capabilities), Anthropic reported that GLM-5.3 built end-to-end V8 exploits in 50 of 410 attempts on ExploitBench, against 56 of 410 for Claude Mythos Preview. The same post found simple techniques bypassed GLM-5.3's safeguards between 64% and 100% of the time in simulated tests, and that removing its refusals took about 2,200 GPU hours, roughly $4,400. Anthropic also reported that a researcher using the smaller GLM-5.3-Flash built a working exploit chain for a known Chrome flaw with about eight hours of model work, which would have cost $20.40 at Zhipu's API prices. [Epoch AI's 16 October analysis](https://epoch.ai/data-insights/open-closed-cyber-eci-gap) places the open-weight cyber frontier roughly where the closed frontier stood 6 to 7 months earlier. Read together, the gap that once rationed this capability is now measured in months. ## What do central banks say AI cyber capability means for financial institutions? The Bank for International Settlements took up the question in [BIS Bulletin No. 129, "A Mythos moment? Frontier AI and cyber risk"](https://www.bis.org/publ/bisbull129.htm), published 20 July 2026. Its summary says frontier AI could "increase the speed, scale and complexity of cyber attacks" and that the balance may favour attackers. It adds that "swift adoption of frontier AI models to review code bases and fix vulnerabilities is essential." That is the regulator-side version of the cost table above. When offensive compute costs tens or hundreds of dollars per attempt, the binding constraint on a bank's exposure is how quickly its own code and alerts get reviewed. ## How should a financial institution pay for AI cyber defense? Offense in the table above is priced by the token. A security stack priced by the seat scales with headcount instead of with the volume of alerts and code that needs reviewing. Tunguz makes the same point in one line: "The CISO's job is no longer stacking per-seat insurance policies." He estimates autonomous alert investigation at about $2 of compute per alert, against a 70-minute manual review. For a bank, the practical consequence is that defensive AI should be bought the way attackers buy it: by usage, on models you can switch, inside your own perimeter. We made the per-seat versus usage case for the sector in [the AI cost math for financial services](/blog/ai-cost-math-for-financial-services-per-seat-vs-usage). The other half is control of the agents themselves. Any agent that reviews code, reads alerts or touches production carries credentials, which is how the [Binance and Allium breach](/blog/binance-allium-breach-credentials-agent-security-financial-services) became an agent security story. ## Why are investors funding AI agent control planes now? Money is following the same math. On 11 November 2026 [SecurityWeek reported](https://www.securityweek.com/bay-raises-50-million-to-control-what-enterprise-ai-agents-can-do/) that Bay, a Tel Aviv startup founded in February 2026, emerged from stealth with $50 million. The round combines a $37 million Series A led by Battery Ventures with a previously undisclosed $13 million seed led by YL Ventures and Striker Venture Partners. Its three founders are alumni of the Israeli military intelligence Unit 8200. Bay describes a single control plane that inventories AI agents, coding assistants and MCP servers, follows each session, and permits, escalates, reroutes or blocks each proposed action. It is one of several funded answers to the same question: what are our agents allowed to do? ## What should a bank board ask its CISO after this cost collapse? Five questions follow directly from the sources above, and none needs a new technology to answer. 1. **What would an autonomous attempt against us cost?** If the answer is still "too expensive to bother", it is out of date: the priced attempt in the table above fell from thousands of dollars to under $1,000 on Mythos 5. 2. **How much of our alert queue is actually reviewed?** Tunguz cites teams facing more than 4,400 alerts a day. Ask what share gets an investigation, human or automated. 3. **Is our defensive AI priced by seat or by usage?** Per-seat licensing caps how much review you can afford at exactly the moment review volume needs to grow. 4. **Can we switch the model under our defensive agents?** Epoch AI puts the open-weight cyber frontier just 6 to 7 months behind the closed one. A defense locked to one vendor's model cannot follow it. 5. **Who holds the logs and permissions of every agent we run?** If an agent is compromised, the inventory, session history and credentials need to be in systems you control. NIST's draft taxonomy makes the same architectural point, covered in [what agencies should check before deploying AI agents](/blog/nist-agentic-ai-attack-taxonomy-government-agencies). ## How does ibl.ai fit a bank's AI security posture? ibl.ai is an agentic AI platform for organizations that need to run AI agents on infrastructure they control. You own all the code and the data, under a perpetual source-code license, deployed in your cloud, on-premise or fully air-gapped. It is model-agnostic, so the agents a security team builds on it can run a frontier API model today and a self-hosted open-weight model tomorrow without a rewrite. Hosting open-weight models yourself is covered in our note on [GLM-5.3-Flash and self-hosting](/blog/glm-53-flash-hybrid-attention-kv-cache-self-hosting). It carries no per-seat pricing: cost tracks the tokens and GPUs your workloads use. ibl.ai is family-owned and operated from New York, NY, and 1.6M+ users across 400+ organizations run the platform today. ibl.ai is not a SOC product and does not replace one. It is the layer where an institution's own agents, models, logs and permissions live, which is the layer the cost collapse makes urgent to own. ## Why does owning the AI stack matter? **ibl.ai is the agentic AI platform where you own all the code and the data. You self-host the entire stack inside your own perimeter, run it model-agnostic across any LLM and switch anytime, and pay by usage with no per-seat pricing — so you can deploy anywhere: your cloud, on-premise, GovCloud, or fully air-gapped.** - **You own all the code and the data.** Full source code under a perpetual license, running on your infrastructure. Not API access to someone else's platform — the stack itself is yours. - **Model-agnostic.** Run any LLM — Claude, GPT, Gemini, Llama, Command, or your own fine-tune — and switch providers without rewriting the platform. - **No per-seat pricing.** Usage-based billing against a budget cap you set. Cost tracks what your organization actually uses, not how many people you employ. - **Deploy anywhere.** Your cloud, your VPC, on-premise, GovCloud, or a fully air-gapped network with no outbound connectivity. 1.6M+ users across 400+ organizations run the platform this way, including NVIDIA, MIT, and Syracuse University. ibl.ai is family-owned and operated from New York, NY — a U.S.-headquartered, domestically-owned long-term partner, not a vendor that sells licenses and moves on.