Technical Summary: Demystifying the Mythos or Disrupting Bugonomics?

Problem Statement

Recent demonstrations of Large Language Models (LLMs), such as Anthropic's "Mythos Preview," have generated narratives suggesting AI will fundamentally reshape cybersecurity by automating vulnerability discovery. However, these narratives often focus on capability milestones (e.g., number of bugs found) while neglecting the underlying economic realities. The paper argues that the security community lacks a framework to analyze the operational economics of vulnerability discovery, validation, and remediation.

The core problem is a potential shift in the "bugonomics" landscape: while LLMs may drastically reduce the cost of generating candidate vulnerability reports (low-signal artifacts), they do not automatically reduce the costs associated with validation, impact assessment, triage, and patch integration. This creates a risk where the volume of reports overwhelms the scarce human capacity required to process them, particularly in open-source ecosystems. The paper seeks to move the debate from "AI finds more bugs" to "How do LLMs change the cost structure of producing actionable security outcomes?"

Methodology

The authors employ a bugonomics lens, defined as the study of how the value of vulnerability artifacts changes as the cost of producing them changes. The methodology involves:

1. Economic Modeling: The paper constructs a cost model separating the vulnerability lifecycle into distinct stages:

   • $C_G$: Cost of generating candidate reports.
   • $C_V$: Cost of validating, reproducing, and deduplicating reports.
   • $C_I$: Cost of establishing impact or exploitability.
   • $C_R$: Cost of packaging remediation (tests, patches, rationale).
   • $C_T$: Cost of maintainer triage, review, and shipping.
   • The total cost is modeled as $C_{total} = C_G + C_V + C_I + C_R + C_T$.

2. Public Data Analysis: The authors analyze public data from:

   • Anthropic's Mythos Preview: Examining campaign-level costs and finding rates.
   • Mozilla Firefox Collaboration: Analyzing the ratio of submitted reports to accepted vulnerabilities (112 reports yielding 22 accepted vulnerabilities, a ~19.6% acceptance rate).
   • Exploit Markets & VRPs: Using public exploit broker prices (e.g., Crowdfense's multi-million dollar payouts for zero-days) and Vulnerability Reward Program (VRP) data (e.g., Google's 2025 payouts) as baselines for offensive and defensive value.

3. Terminological Refinement: The paper rigorously distinguishes between:

   • Candidate Report: A model-generated suspicion.
   • Accepted Vulnerability: A confirmed security issue.
   • Exploitable Vulnerability: An issue with a credible attack path.
   • Exploit Chain: A composition of techniques for operational access.
   • Actionable Security Outcome: A validated finding, proof of impact, or shipped fix.

Key Contributions

The paper makes four primary contributions:

1. Reframing Bugonomics: It shifts the narrative from "zero-day asymmetry" (where offense holds the advantage due to scarce, high-value exploits) to "defender-side remediation throughput." The argument posits that the near-term shift is not a collapse in exploit prices, but a change in where the bottleneck lies: moving from finding bugs to absorbing and fixing them.
2. Connecting Market Signals: It connects public exploit-market prices, VRP data, and incident baselines to demonstrate that LLMs reprice defender workflows. While candidate generation becomes cheaper, the value of evidence-rich remediation packages increases, and scarce maintainer capacity becomes the primary constraint.
3. A Cost Model for LLM Workflows: The authors introduce a quantitative model that separates candidate generation costs from the costs of validation, impact evidence, and remediation packaging. This model highlights that "cheap" candidate generation can lead to high total costs if validation and triage burdens are not accounted for.
4. Differentiation of Outputs: It separates the economics of defender-led hardening (e.g., technical debt remediation) from unconstrained zero-day hunting, arguing that candidate reports, impact proofs, and operational exploit chains are not interchangeable economic outputs.

Results and Observations

Based on the analysis of public data, the paper draws several specific conclusions:

• Campaign-Level Economics: In the Mythos Preview, a campaign cost under $20,000 yielded "several dozen" findings. This implies a cost per reported finding of roughly $417–$833, but the cost per actionable vulnerability is higher due to unknown validation and triage costs.
• The Validation Bottleneck: In the Firefox collaboration, 112 reports resulted in 22 accepted vulnerabilities (19.6% acceptance). The paper estimates that if validation takes 0.5–2 hours per report at expert rates, the validation cost alone ($5,600–$56,000) can exceed the model inference costs. This suggests that as $C_G$ drops, $C_V$ and $C_T$ become the dominant constraints.
• Exploit Development Costs: While Anthropic reported ~$4,000 for several hundred attempts yielding two "crude" browser exploits in a sandboxed environment, the paper notes this does not equate to the cost of a production-grade exploit chain, which requires stealth, reliability, and bypassing defense-in-depth.
• Open Source Asymmetry: LLM-assisted discovery can generate reports at machine speed, but maintainer capacity for validation and release does not scale automatically. This creates an asymmetry where open-source maintainers may absorb a larger stream of low-quality reports without the budget to process them.
• VRP Repricing: Vulnerability Reward Programs are beginning to adjust incentives. As candidate generation becomes cheaper, programs are shifting rewards toward reports that include reproducers, exploitability reasoning, and patch guidance, effectively paying for "review-package quality" rather than raw suspicion.

Significance and Claims

The paper claims that the significance of LLMs in security is not the elimination of the zero-day market, but the demystification of the vulnerability discovery pipeline and a shift in the economic bottleneck.

• Demystification: LLMs are lowering the floor for producing plausible, evidence-backed findings, making the process of "finding bugs" less of a boutique specialist activity and more of a throughput problem.
• Bottleneck Shift: The critical constraint is shifting from discovery to remediation. The scarce resource is no longer the ability to find a bug, but the capacity to validate it, prioritize it, and ship a fix.
• Strategic Direction: The paper advocates for orchestration over substitution. Frontier models should be combined with static analysis, fuzzing, and symbolic execution. The goal is to produce "review packages" (patches, tests, rationale) that reduce the cognitive burden on maintainers.
• Technical Debt: A high-leverage application for LLMs is not just hunting zero-days, but remediating technical debt (e.g., inconsistent input validation, deprecated APIs) where the output maps directly to work defenders can ship.
• Metrics for the Future: The paper argues that the field must move beyond counting "bugs found." Future reports should measure precision, cost per accepted vulnerability, cost per high-severity vulnerability, and accepted fixes per maintainer-hour.

The authors conclude that while LLMs are strategically important, they do not render defenders economically obsolete. Instead, they raise the floor for routine security review and shift the strategic focus toward converting scalable vulnerability reasoning into durable, accepted security improvements, particularly within the open-source ecosystem.