Cyberattacks Are Becoming Compute Wars

In September 2025, a Chinese state-linked group ran AI agents against roughly thirty targets. The model handled 80 to 90 percent of the tactical work; humans selected targets and intervened at four to six decisions per campaign.

One operator can now run many agents against the same target in parallel. Compute determines how many attempts run at once and how long they continue.

I saw The Matrix when I was about twelve and thought hard about whether it was possible. What terrified me was that it was all math, and I was studying mathematics in school that same year, while the movie was still in the theater.

The movie gets old like a good wine, and it seems more real now than ever. If it is all math, and we unlocked intelligence into math, and compute is computing math, then compute is what attacks and what defends.

A cyber operator can put an agent behind a cloud account and let it research targets, test exposed systems, write tools, and check results before retrying across many paths. The orchestrator copies it across the cluster the way Agent Smith copies himself; each copy hunts the same target down its own path, a field of Sentinels searching in parallel.

What the measurements show

In March 2026, the UK AI Security Institute published results from a 32-step simulated corporate-network attack. The same 10 million-token budget took GPT-4o (August 2024) through 1.7 steps on average and Claude Opus 4.6 through 9.8. A tenfold increase in that budget improved performance by as much as 59 percent, with no plateau inside the tested range. These benchmarks used controlled environments without active defenders; real-world reporting shows growing autonomy, while full end-to-end attacks remain disputed.

A 100 million-token Opus 4.6 attempt cost about $80 with prompt caching. An operator can spend that budget on one long trajectory or many independent attempts; a long trajectory can recover from mistakes, while parallel attempts explore more paths at the same time. Tokens don't convert cleanly to megawatts; serving details dominate.

AISI also tracks a cyber time horizon, measuring how long an agent can work at 80 percent reliability under a fixed token limit. As of February 2026, that horizon was doubling roughly every 4.7 months.

In May, Google reported high confidence that a criminal actor had used AI to help discover and weaponize a zero-day. It also documented malware that used a model to interpret system state and generate commands dynamically.

On July 1, Sysdig reported what it assessed as the first documented end-to-end agentic ransomware operation. The agent adapted to errors, established persistence, reached a production database, and destroyed data. Sysdig did not observe where the root credentials for the final server came from and could not independently verify the agent's exfiltration claim. Six days later, the UK NCSC said it had still not seen a fully autonomous attack across the complete intrusion lifecycle; the Sysdig case is important evidence, though not yet settled consensus.

Across these cases, the entry points remain ordinary: exposed software, missing patches, reusable credentials, and reachable internal services.

The model is only one part of the attacker

Provider telemetry can reveal activity outside researchers cannot see. In the September 2025 case, Anthropic's logs showed the model performing 80 to 90 percent of the tactical work while humans selected targets and intervened at four to six critical decisions per campaign. Only a handful of intrusions succeeded. The public report does not let outsiders reconstruct the attribution, degree of autonomy, or full denominator independently.

The system around the model decides which tools it can call, how much and how long it can run in parallel, which results are checked, and what survives into the next session. AISI improved one scaffold and reached the same success level on a cyber development set at roughly one-eighth the token cost.

What the orchestrator preserves between sessions is target state: working credentials, network topology, software versions, and how the target responded to prior attempts, including which paths already failed. Accurate state is what converts isolated attempts into a campaign; stale or wrong state sends future attempts down paths that already failed.

A service response, working credential, changed permission, or successful database query gives the agent a machine-readable result it can act on. Ambiguous logs, deceptive banners, honeypots, and stale or intermittent credentials send it down the wrong path, and stored memory can preserve those errors across sessions. Verification is therefore part of the attack capability, alongside the model and the scaffold.

A June 2026 AgentCyberRange preprint found frontier agents missing hidden surfaces, triggering honeypots, and leaving warning logs alongside the vulnerabilities they found. Compute produces more evidence for both sides.

A June 2026 preprint tested a proof-of-concept worm in a deliberately vulnerable 33-host isolated network. Across fifteen seven-day runs it exploited roughly 74 percent of hosts and replicated to about 62 percent, with no endpoint detection or active firewall defense present. The result shows autonomous propagation under controlled conditions, not propagation across a defended enterprise.

The gates

What actually has to go right for an intrusion to succeed? Three linked requirements: access, a path to the target plus a working identity; progress, enough privilege to move plus feedback on what's working; and payoff, a route to the intended data or physical effect before detection catches up.

Correctly implemented 128-bit symmetric cryptography remains beyond conventional brute force. Agents instead hunt for stolen keys, weak random numbers, protocol and side-channel weaknesses, and flawed implementations. Physical controls such as hardware security modules, one-way data links, and approval interlocks can force the operation through a boundary that compute alone cannot cross.

Segmentation limits the value of one foothold, phishing-resistant authentication limits stolen-password attacks, and good telemetry gives defenders a view the attacker has to reconstruct from the outside. Reaching an industrial effect adds engineering work, proprietary protocols, correctly timed safety systems, and often a human or physical interlock.

Parallel scans and unusual cloud requests, failed logins, and new processes or repeated tool errors all make an intrusion louder. More compute may improve the search while shortening the defender's time to notice it. Provider controls also matter for hosted models: identity checks, rate limits, abuse detection, and account bans add friction. Open-weight models and stolen infrastructure reduce that visibility, but leave the attacker responsible for operating and hiding the system.

Long chains also compound unreliability. As a toy illustration, if thirty-two independent steps each succeeded 90 percent of the time, end-to-end success would be about 3.4 percent. Real attack steps are neither fully independent nor strictly one-shot. Agents can recover from some failures, while each retry consumes time and leaves logs.

Defense scales too

The defender is an operational system too. Human review alone will not scale to thousands of coordinated attempts, so defense has to correlate what's authorized (code, identity), where it runs (endpoint, network, cloud), and what exists (asset data) through machine-speed workflows.

The UK National Cyber Security Centre's Cyber Shield blueprint describes this model at national scale: federated agents that scan and discover vulnerabilities nationally, coordinate detection, and mitigate rapidly under the authority of system owners. Agents move fast; system owners keep the veto over production changes.

Defenders may start with source code, an asset inventory, endpoint and identity telemetry, and authority to deploy one repair across a fleet. Attackers have to discover those facts from the outside.

DARPA's 2025 AI Cyber Challenge put autonomous systems against 54 million lines of real software. Across seven finalists, the systems found 54 of 63 planted vulnerabilities, patched 43, and identified 18 real vulnerabilities the organizers had not planted. Teams submitted patches in an average of 45 minutes and spent about $152 per competition task.

When BountyBench gave agents the vulnerability information rather than asking them to find it blindly, the best agents produced patches accepted by the verifier in about 90 percent of tasks. A defender working in their own codebase may start with that exact advantage.

How fast do we need to scale compute?

The two compute budgets are coupled. More offensive compute means more agents, more paths, and more retries, which gives defenders more activity to process; more defensive compute means faster discovery, patching, isolation, and deception, which forces attackers to spend more compute finding a path that still works. Each side raises the other side's minimum operating budget.

Defenders may hold the data advantage, but using it costs compute too. Code and identity records, infrastructure inventory, and network telemetry have to be connected and analyzed continuously to act on it. More context makes an individual decision better, but analyzing that context across the whole environment is what drives up the compute bill. Data gives defenders an information advantage; compute determines whether they can apply it at the speed and scale of the attack.

An adversary with a significantly larger inference budget can probe any software surface continuously, synthesize new exploits from each result, and restart after every failure. More budget converts to more attempts; the gap between sides is an infrastructure problem.

An attacker with weeks and budget can also run the improvement loop: benchmark prompting strategies, rewrite its own scaffold and tools, fine-tune on its own failures, and launch again. Each run feeds the next. Compute is paying for evolution, not inference.

The same logic runs in the other direction. A defender already holds what an attacker spends most of its budget reconstructing from outside: source code, asset inventory, telemetry, and the authority to deploy a fix. DARPA's AIxCC patched real vulnerabilities in 45 minutes on average; BountyBench found 90 percent patch acceptance when agents start with code access. That advantage only exists if the compute to run those agents is there. The actions that matter most on the defense side are irreversible: revoking credentials, isolating a segment, patching production. The compute needs a control room behind it.

For nations and large enterprises, the preparation question reduces to infrastructure: energy, chips, and model capacity sufficient to field agents that continuously attack their own systems before someone else does, and repair what they find.

The compute also runs inference the rest of the week. The fleet that processes research, logistics, and code during ordinary hours is the same fleet that redirects to defensive agents on demand. Agent Smith copies himself in either direction. A nation building this for economic output already has the defensive capacity. One waiting for a security threat to justify the investment will find it isn't there when needed.

When I was twelve I assumed that if any of this ever came true, there would be a Neo in it. There is no Neo in any of this, or at least not yet, only operators with budgets on both sides. Whether the defense ever gets something better than more compute pointed the other way, I do not know.

---

Shai Magzimof

---