Bugonomics: The Flip Side of Cheap Coding

When breaking software gets as cheap as writing it, cheaper offense means more offense.

In our companion piece we made one argument about the 2026 shift in AI coding: the price of a fixed level of coding capability has been falling roughly 5× to 10× per year, and that collapse coincided with agents learning to run autonomously for hours—so the two effects multiply, and you can now delegate entire milestones to hierarchies of agents.0 We also named the honest catch there: because that delegation is now viable, it becomes the new normal, and total spend on coding can rise even as the unit price falls. Cheaper coding means more coding, not less.

This is the flip side of the same curve, applied across to a different activity. The same price-performance collapse that is making coding cheaper is also making breaking code cheaper. Exploit chains that used to require months of senior security-researcher time are moving down the same cost ladder. And the cheap, ubiquitous coding agents we just celebrated are themselves a new attack surface.

The productivity dividend and the vulnerability dividend are the same curve. You cannot have one without the other.

Bugonomics

For most of the history of offensive security, exploit chains were scarce assets.

A full mobile, browser, or messenger compromise—the kind that combined a renderer sandbox escape with a kernel privilege escalation—required months of specialist effort from senior researchers. That scarcity is what made high-end chains worth millions of dollars in the exploit-broker market. The cost of producing one was the gate that kept the number of them low.

AI is removing that gate, and the clearest evidence comes from a frontier lab's own red-team evaluation. Testing Claude Mythos Preview in April 2026, Anthropic reported that the model surfaced thousands of additional high- and critical-severity vulnerabilities and then developed working exploits for them without human intervention. More pointedly, it chained vulnerabilities on its own: it "wrote a web browser exploit that chained together four vulnerabilities, writing a complex JIT heap spray that escaped both renderer and OS sandboxes"—a tier of exploitation that typically takes senior researchers months.0 Against a FreeBSD NFS vulnerability it split a twenty-gadget Return-Oriented Programming chain across multiple packets to reach remote code execution with full root access. The same evaluation notes the size of the jump: the previous generation had a near-zero success rate at autonomous exploit development.

The economic implication is the mirror image of the coding-cost story. AI drastically reduces the marginal cost of exploit generation. The window between vulnerability discovery and weaponization compresses from days to minutes. The asset that used to be scarce because it was expensive to produce becomes abundant because it is cheap to produce.

The relevant question for a defender stops being "is this single flaw severe?" and becomes "does this flaw sit on a path that reaches production through a trusted identity?" Isolated CVSS scores were always a poor proxy for systemic risk; in a world of cheap chaining they are actively misleading. In one customer environment, Praetorian ingested roughly 500,000 vulnerability findings and used contextual exploit-chain analysis to narrow them to fourteen endpoints where an attacker could realistically achieve full host compromise from a drive-by page visit—a signal-to-noise ratio of about 35,000 to 1.0

Volume is the threat

The consequence is not subtle, and it does not need an economic paradox to explain it. When exploit generation gets 10× cheaper, you get more attack attempts, more exploit variants, and continuous machine-speed probing of every exposed surface. Cheaper offense means more offense. Defense has to absorb that volume, and the volume is the threat.

The part that is easy to miss is which price fell. A cheaper offense curve does not just lower the cost of any single attack; it lowers the cost of trying. The economically rational attacker now runs thousands of cheap attempts for every expensive one, and those cheap attempts are good enough to compromise a lot of targets that were previously protected by nothing more than the cost of making the attempt.

That is the asymmetry defenders have to plan around. Attempts that were never worth an attacker's time are now worth automating, for the same reason your dependency upgrades are.

What got cheap was not breaking in. It was trying.

Agentjacking: the coding agent is the new attack surface

The most cutting-edge part of this story is also the most personal for the audience of the companion piece.

The cheap coding agents that the cost collapse made ubiquitous are not just productivity tools. They are trusted, non-human identities with access to your code, your secrets, your cloud, and your shell. And they ingest untrusted content—error logs, documentation, issues, web pages—on your behalf. That combination is a new attack surface, and it already has a name.

In a documented attack class called "Agentjacking," researchers chained an indirect prompt injection through untrusted tool output against AI coding assistants. The path is concrete, and it starts with a credential that is public by design: a Sentry DSN. An attacker sends a crafted error event into the project's Sentry—no breach, no authentication. When the developer later asks the agent to review or resolve Sentry issues, the agent queries the Sentry MCP server, which returns the poisoned event alongside legitimate ones as structured tool output. Claude Code, Cursor, and OpenAI Codex CLI did not distinguish data retrieved from an external source from operator instructions, and executed the injected Markdown as authoritative guidance—exfiltrating AWS access keys, GitHub personal access tokens, Kubernetes credentials, registry credentials from .npmrc and .docker/config.json, and CI/CD environment variables, without tripping an alert. Testing across the three tools yielded an 85% exploitation success rate.0

Nothing here is a memory-corruption bug. Every step is a feature working as designed.

The mechanism matters. Attackers no longer need to exploit memory corruption in compiled binaries. By poisoning the cognitive context of an autonomous agent, an adversary can coerce the AI into executing standard, benign administrative tools to complete the exploit chain. The agent does the work; the attacker just supplies the instructions.

The academic taxonomy calls these "LLM-in-the-Loop (LiL) vulnerabilities," and it sorts them into three structural roles:0

• LLM as the Source — the attack originates through the semantic interface (prompt injection), where the model's natural-language processing triggers a flaw in a connected component.
• LLM as the Actuator — the model serves as a propagation vector, using its reasoning or tool-routing to bridge the path to a vulnerable downstream system.
• LLM as the Target — the exploit subverts the model's own safety alignment or integrity.

The cheap-coding utopia is also an NHI-sprawl reality. The cheaper the agents get, the more of them we deploy, the more access we hand them, and the larger the surface for Agentjacking becomes. Empirical work on the LiLCVE benchmark shows these vulnerabilities are substantially harder to remediate with automated repair agents than other flaws—an average drop of 10.8 points in Pass@1 repair rate—and three categories, Generated Query Execution, Agent Action, and Model Output Rendering, frequently come back with 0% repair success.0

The real shift: from CVSS to blast radius

The research's punchline for defenders is a reframe, not a tool.

Stop prioritizing by CVSS severity in isolation. Start managing asset context, identity blast radii, and non-human identity (NHI) governance. The coding agent you just gave repository and cloud access to is a non-human identity. The question stops being "is this flaw severe on its own?" and becomes "does this flaw sit on a path that reaches production systems or sensitive data through a trusted identity—including the AI agent?"

This is the same reframe the cost-collapse story demands of buyers, applied to security. In 2024 you could afford to think about vulnerabilities one at a time because producing a chain was expensive. In 2026 you cannot, because producing a chain is cheap and the agents you deployed to save money are part of the path.

The defensive work that follows from this is unglamorous but durable: inventory your non-human identities, scope their access to the minimum they actually need, treat agent-ingested content as untrusted input to a privileged executor, and assume the offense curve is moving at least as fast as your adoption curve.

The frontier caveat, on both sides

The defensible claim is not "offense is universally 10× cheaper." The same caveat that applies to coding applies to breaking.

Holding a practical capability threshold fixed—chaining known CVEs, generating gadget chains, automated pentesting against well-scoped targets—price-performance has improved quickly, on the same order as the coding benchmarks.

The absolute frontier of offense is still expensive. Autonomous zero-day discovery at scale, full hypervisor escapes, and novel-architecture compromises require the most capable models running long reasoning traces, and those cost more per task, not less—exactly as MIT found for frontier coding.0

But the "good enough" tier is collapsing in price, and that is the tier that matters for most targets. The economically rational attacker now uses cheap models for the bulk of a chain and reserves frontier spend for the single hardest step. It is the same buying pattern as the rational coding buyer in the companion piece: tier your models, route the routine work down the ladder, keep the frontier for the work that actually needs it. Attackers have already figured this out. Many defenders have not.

What to do with this

If you build or buy AI coding tools, the security implication of the cost collapse is not optional.

Tier your agents the way you tier your models. A cheap agent with broad access is a cheap attacker entry point. Scope each agent's privileges to the minimum it needs for the task, and prefer worktree isolation and per-agent tool allowlists over a single privileged session.

Treat agent-ingested content as untrusted input. The error log, the docs page, and the issue body the agent reads on your behalf are now part of your threat model. Agentjacking works because the agent executes parsed instructions with your privileges. The most effective single control against it is unglamorous: deny-by-default network egress, which kills both the malicious fetch and the exfiltration beacon. Drop-in hardening configurations for Cursor and Claude Code have been open-sourced.0

Manage non-human identities, not just human ones. Inventory every agent, its owner, its access, and its blast radius. The same governance you apply to service accounts applies to coding agents, and most teams have not started.

Assume the offense curve moves as fast as yours. The same price-performance collapse that lets you ship faster lets attackers probe faster. Static, severity-based patching is a 2024 posture against a 2026 offense.

Keep the frontier for the hard part—on both sides. Reserve your expensive defensive analysis for the genuinely hard problems, and assume attackers are doing the symmetric thing on offense.

The shift in one sentence

In 2026, the security story is less "attackers got smarter" than "the cost of breaking code moved down the same curve as the cost of writing it." Exploit chains are approaching commodity, the coding agents we deployed for productivity are now part of the attack surface, and the economically rational posture shifted from patching isolated flaws to governing the identities—human and non-human—that sit on the paths to production.

The productivity dividend and the vulnerability dividend are the same curve. The teams that thrive will be the ones that took both halves of it seriously at the same time.

Companion pieces

• The Year Coding Became a Commodity — the productivity-dividend companion to this piece.
• Maximize Value, Not Intelligence — the practical half: which providers to buy, how to route between tiers, and which jobs just became worth automating.

References