# The economics of an exploit has officially collapsed Vishal Santharam, Product Manager, ManageEngine ![date](https://www.manageengine.com/ems/images/icon/calender-icon-1.svg) Aug 27, 2026 ![Collapsed exploit economics as AI lowers the cost of finding and weaponizing vulnerabilities.](https://cdn.manageengine.com/sites/meweb/images/desktop-central/images/zero-cost-exploit-economics-banner-image.png) Ever since the announcement of Mythos in April, we’ve been waiting for the apocalypse: for the exploit count to explode. If we consider CVE count an indicator of vulnerability discovery capacity, last year's trend shows a clear increase. ![cve-releases-chart-editable](https://cdn.manageengine.com/sites/meweb/images/desktop-central/images/cve-releases-chart-editable.svg) Despite this, I’d argue that the floodgates haven’t actually opened yet. The reason: economics. Finding a genuinely exploitable vulnerability in a complex, real-world codebase using AI depends on how advanced the reasoning models are. Until recently, the models capable of reasoning through complex code and identifying high-severity vulnerabilities at a meaningful scale were primarily accessible through a small number of frontier AI providers. Accessing those capabilities through metered APIs is expensive, while running comparable models locally required substantial compute infrastructure. This created a practical barrier to widespread use. The surge you see in the above chart is driven by well-funded labs, nation-states, or well-capitalized attackers with API budget to burn and the infrastructure to support it. ## The changing tide > Qwen 3.8-27B, an open-weight model released in early August, is small enough to run comfortably on a consumer machine yet capable enough to reason through real-world code: the kind of work that, until recently, meant paying for a frontier-lab API. To test its capability, I asked the model simply to identify vulnerabilities in the current codebase of a widely used open-source agentic coding harness with more than 200K GitHub stars. I left it running unattended overnight, about twelve hours, on my own Mac. It surfaced three security-relevant findings. The most significant wasn't new: the model independently rediscovered an unauthenticated command-execution exposure in the tool's server mode—a class of issue already publicly documented. I further asked the model to build an exploit. By lunch, it had handed me a working one. When the server is run without authentication, its API accepts commands from anyone able to reach it. This isn't a product flaw. It's a user-side configuration issue, and the maintainers correctly classify it as outside their security-fixing scope. The point isn't the misconfiguration. It's that the advisory has been public for months, and Shodan, a search engine for internet-connected devices, still shows over 60 hosts exposed in exactly this way. And even if a fix is made available now, nothing changes for machines already deployed and forgotten. And the cost to identify this exposure? Effectively zero. From an attacker’s perspective, the math suddenly tilts in their favor. With the model hosted locally—and community-released uncensored variants also available—the incremental cost of the exercise can be effectively zero. There’s no API bill, per-token charge, or rented GPU infrastructure to pay for. ## What the future looks like This model has removed one of the remaining economic barriers to automated exploit hunting at scale. Today, a technically capable attacker with a sufficiently powerful consumer machine and an evening to spare can now automate something that, until recently, required access to expensive frontier models. This means the economics of this setup favors the attackers more than the defenders and vendors, at least for the next couple of years. You can expect the number of CVEs and exploits to sky rocket. In the meantime, vendors will work on fixing their own vulnerabilities. Eventually, vendors will reach a state where the backlog of known vulnerabilities gets worked down and the count drops to a manageable number again. So the graph will look something like this. ![cve_spike_curve_time_vs_vulnerability_count](https://cdn.manageengine.com/sites/meweb/images/desktop-central/images/cve_spike_curve_time_vs_vulnerability_count.png) ## What this means for defenders The time to rebuild your security stack against the resulting surge of exploits should have begun a couple of months back. But it's better to begin late than never. So start now. Your security stack should run in three directions: depth, containment, and machine-speed response. 1. ### Attack surface reduction Patching remains foundational, but the priority changes to closing vulnerabilities faster. And [autonomous patch management](https://www.manageengine.com/products/desktop-central/endpoint-edge/levelling-up-autonomous-patch-management.html?from-zero) brings speed to the picture. Considering the volume and variety, patches should be complemented by compensating controls such as virtual patching, misconfiguration monitoring and control, dynamic segmentation, and runtime defense. These controls reduce your organization's attack surface and manages exposure without waiting for updates or change windows. 2. ### Blast radius containment AI-enabled identification of exploitable paths demands an assume-breach model. Zero Trust architecture becomes foundational; it should operate as a continuous validation system across identity, device, network, and session context, critical to arresting lateral movement under AI-assisted exploitation. The outcome is containment: Even if a vulnerability is exploited, the blast radius is limited by what the compromised system can reach. Movement is restricted, access is bounded, and impact is localized. 3. ### Machine-speed response When attacks can unfold in minutes, containment must happen at machine speed. While humans remain on a critical response path, they are not the only one. Autonomous endpoint detection and response (EDR) removes the bottleneck issue, enabling much quicker response. Together, these layers create a continuous control system: reduce exploitable paths, constrain movement, and break execution in real time. [Here's my deeper take on what needs to be restructured, and how to approach it from scratch.](https://www.manageengine.com/products/desktop-central/endpoint-edge/machine-speed-exploits-security-architecture.html) ## Related Stories - Endpoint Security: [The Tenth Man's guide to modern security architecture](https://www.manageengine.com/products/desktop-central/endpoint-edge/machine-speed-exploits-security-architecture.html) - Autonomous Endpoint Management: [Autonomous endpoint management starts with operational readiness](https://www.manageengine.com/products/desktop-central/endpoint-edge/operational-readiness-for-autonomous-endpoint-management.html)