The Likelihood Axis Has Moved

AI agents now exploit real CVEs for under $10. That changes how we should score the likelihood axis in OWASP, CVSS, DREAD, and FAIR risk frameworks.

I do a lot of risk assessments. Most of them, at some point, come down to a sentence like this: “This is exploitable but requires a sophisticated attacker, so we’re scoring likelihood as Low.”

That sentence used to mean something. It encoded a real constraint: someone had to read the advisory, understand the bug class, find or write a primitive, deal with whatever mitigations the target had, and produce something that actually worked. That’s hours to weeks of senior engineer time. The skill gate was a real gate, and “low likelihood because high skill required” was a defensible position.

I don’t think it is anymore. Not for the broad middle of vulnerabilities I deal with day to day. The empirical floor of attacker skill has dropped far enough that the way we score the likelihood axis of standard risk frameworks (OWASP, DREAD, CVSS, FAIR) is now systematically wrong in one direction. This post is me working through why, with the citations I’d want next to me in a review.

What the frameworks actually say about skill

Quick refresher, because the specific wording matters.

OWASP Risk Rating scores threat-agent Skill Level on a 1 to 9 scale: 1 is “no technical skills,” 5 is “advanced computer user,” 6 is “network and programming skills,” 9 is “security penetration skills.” It pairs this with Ease of Exploit: 1 is “theoretical,” 3 “difficult,” 5 “easy,” 9 “automated tools available.” The model assumes pen-test skill is a scarce attribute concentrated in a small population, and that “automated tools available” is a discrete jump you can identify.

DREAD’s Exploitability is defined (Howard and LeBlanc, Writing Secure Code 2nd ed., 2002, and still reiterated verbatim in Microsoft’s current Windows driver-security docs) as “the effort and expertise required to mount an attack.” Effort and expertise. Two human-attribute words.

CVSS v4.0’s Attack Complexity is defined in the FIRST.org spec as “the exploit engineering complexity required to evade or circumvent defensive or security-enhancing technologies.” More engineering effort. CVSS v4.0 did rename the Temporal Group to the Threat Metric Group and kept Exploit Maturity (Attacked / PoC / Unreported / Not Defined), but the implementation guide still expects you to source maturity from observed exploitation, not from feasibility.

FAIR is the most explicit. Threat Capability is “the probable level of force a threat agent is capable of applying,” and Vulnerability is the probability TCap exceeds Resistance Strength. Each framework treats attacker capability as a meaningful, distinguishing variable.

That’s the assumption everything else rests on, and the one I want to look at.

What an LLM agent can actually do today

Three classes of evidence, ordered by how much I trust them.

Academic benchmarks with reproducible numbers

Fang, Bindu, Gupta, and Kang, “LLM Agents can Autonomously Exploit One-day Vulnerabilities” (arXiv:2404.08144, April 2024). A single GPT-4 agent (91 lines of code, a ReAct framework, a 1,056-token prompt) was given CVE descriptions and the relevant target environment, and exploited 87% Pass@5 of 15 real-world CVEs spanning XSS, SQLi, RCE, CSRF, container escape, and SSTI. GPT-3.5, eight open-source models, ZAP, and Metasploit all scored 0%. Without the CVE description in the prompt, GPT-4 dropped to 7%. The disclosure window itself is the gate.

The cost section of that paper is the line I keep coming back to. Average cost per run was $3.52. Average success rate 40%. So $8.80 per successful exploit, versus an estimated $25 for a human expert (30 minutes at $50/hr). The LLM agent is 2.8x cheaper than the human, today, on real CVEs, with off-the-shelf tooling.

The same lab’s follow-up, “Teams of LLM Agents can Exploit Zero-Day Vulnerabilities” (Zhu et al., arXiv:2406.01637, EACL 2026), introduced a hierarchical-planning multi-agent system (HPTSA) and hit 53% Pass@5 on real-world zero-day web vulns. Within 1.4x of an agent that was given the CVE description.

Other benchmarks tell the same story from different angles. Stanford’s Cybench (Zhang et al., arXiv:2408.08926) is 40 professional CTF tasks; recent-generation models solve unguided tasks that took human teams up to 11 minutes. The NYU CTF Bench (Shao et al., arXiv:2406.05590, NeurIPS 2024) is 200 CSAW challenges; absolute solve rates are still low (single digit to low teens) but Claude 3 outperformed the median human score in the CSAW 2022 Finals. UC Riverside’s “Patch-to-PoC” (Pu et al., arXiv:2602.07287) reproduces more than 50% of 100 real exploitable Linux-kernel KernelCTF vulnerabilities end-to-end from patches alone. CMU’s “On the Feasibility of Using LLMs to Autonomously Execute Multi-host Network Attacks” (Singer et al., arXiv:2501.16466) hit at least partial success in 9 of 10 emulated networks of 25 to 50 hosts each, including a faithful autonomous replication of the 2017 Equifax kill chain.

None of these are press releases. They’re reproducible academic work with concrete numbers.

Defensive AI as a lower bound for offensive AI

Google’s Big Sleep (Project Zero and DeepMind) found the first AI-discovered memory-safety bug in widely deployed software (a SQLite stack buffer underflow) in late 2024. By November 2025 Apple credited Big Sleep with five WebKit CVEs (CVE-2025-43429 through CVE-2025-43434). Google’s OSS-Fuzz-gen disclosed 26 or more new bugs from LLM-generated fuzz harnesses, including CVE-2024-9143 (out-of-bounds in OpenSSL) which Google said had likely been present for two decades and “wouldn’t have been discoverable” with prior human-written harnesses.

The reason this matters as a lower bound: every primitive that helps Big Sleep find bugs (decompiler reasoning, harness synthesis, root-cause analysis) is the same primitive that helps an attacker turn a patch diff into a working exploit. The defenders publish; the attackers don’t.

XBOW (autonomous AI pentester) reached #1 on HackerOne’s US leaderboard in June 2025 with roughly 1,060 verified reports across 90 days (54 critical, 242 high, 524 medium), including a previously unknown bug in Palo Alto GlobalProtect VPN affecting more than 2,000 hosts. They benchmarked at 28 minutes for a 104-scenario suite a senior human pentester took 40 hours on. That’s an 85x speedup on offensive tasks, on real targets, validated by HackerOne’s triage process.

Field evidence

The OpenAI and Microsoft joint disclosure of February 2024 (Forest Blizzard, Emerald Sleet, Crimson Sandstorm, Charcoal Typhoon, Salmon Typhoon) was the first major attribution of state-actor LLM use, and at that time the conclusion was “productivity uplift, not novel capability.” OpenAI’s October 2025 update reiterated that view across 40-plus disrupted networks: “threat actors bolt AI onto old playbooks to move faster, not gain novel offensive capability.”

Then Anthropic’s disclosures between August and November 2025 landed. GTG-2002 (“vibe hacking”): Claude Code used to extort 17 organizations, ransoms sometimes exceeding $500,000. GTG-5004 (a UK actor): Claude-generated ransomware sold on darknet forums for $400 to $1,200 apiece. GTG-1002 (assessed with high confidence as Chinese state-sponsored, mid-September 2025): Claude Code manipulated into running roughly 30 simultaneous intrusions, with AI performing 80% to 90% of the tactical work and humans intervening at 4 to 6 critical decision points per campaign, “at physically impossible request rates” of thousands of requests per second.

Google’s GTIG followed up on November 5, 2025, disclosing PROMPTFLUX (a VBScript dropper that queries Gemini hourly to rewrite its own code) and PROMPTSTEAL/LAMEHUG (used by APT28 in Ukraine, queries Qwen2.5-Coder-32B for just-in-time command generation). First observed live operational use of LLM-querying malware.

The vendor reports are simultaneously evidence and marketing, and I want to flag that explicitly: Anthropic, OpenAI, and Google all have incentives to publicize disruptions of misuse. The 80% to 90% autonomy figure for GTG-1002 has not been independently corroborated. I weight the academic benchmarks more heavily for that reason. But the academic benchmarks and the vendor reports point the same direction.

The timeline has flipped

Mandiant’s M-Trends 2026 (grounded in more than 500,000 hours of 2025 incident response) reports the mean time to exploit at roughly minus 7 days. That is, exploitation now routinely precedes patch release. M-Trends 2018 had it at 63 days. M-Trends 2024 had it at minus 1. The initial-access-broker to ransomware-affiliate handoff is 22 seconds.

CrowdStrike’s 2026 Global Threat Report: “42% of vulnerabilities were exploited before public disclosure.” Verizon’s 2024 DBIR showed exploitation as initial vector up 180% year over year; 2025 added another 34%. CISA added 245 vulnerabilities to KEV in 2025 (versus 185 in 2024) and per Reuters (May 2026) is reportedly considering cutting the KEV patch deadline from two-to-three weeks down to three days.

The minus 7 number is a mean, dragged down by a handful of zero-days that precede patches by months. The median exploit-to-patch experience for a typical CVE is probably still positive. But the direction and the rate of compression are not subtle.

What this does to the likelihood axis

If you take the academic numbers seriously, and I think you have to, because the methodology is sound and the cost calculations are reproducible, then the threat-agent and exploitability inputs of every risk framework I named at the top are now miscalibrated upward.

Concretely, on OWASP: when I score a CVE-on-internet-reachable-asset finding, “Skill Level: 9 (security penetration skills)” used to be reserved for serious targets. The implicit population of attackers that could clear that bar was small. That population is now everyone with an API key and a ReAct loop. “Ease of Exploit: 9 (automated tools available)” used to require someone to have actually written a Metasploit module. Now the automated tool is the LLM, and it works on bugs no one has written a public exploit for yet.

On DREAD: “Exploitability” was a measure of human effort and expertise. The cost curve in the Kang paper put a number on it: $8.80, in dollars, today. That’s not a slider position. That’s an empirical floor.

On CVSS: Attack Complexity is the most defensible of the four, because it still measures something real (genuine engineering hurdles like ASLR bypasses, race-window tuning, exotic environmental requirements) that LLMs are still bad at. But Exploit Maturity is where the rubber meets the road, and “PoC available” is now operationally equivalent to “Attacked” in a way the spec doesn’t capture. The gap between a patch shipping and a working PoC existing is hours, sometimes negative.

On FAIR: I’d expect Threat Capability distributions to compress upward and become more uniform across threat communities. The historical gap between APT and commodity actor is narrowing because the uplift is roughly the same for both. If your TCap distributions are still hand-drawn from pre-2023 industry data, your Loss Event Frequency is going to be wrong on the low side.

Where the argument is weakest

I want to be honest about where this falls down, because if I’m wrong I want to be wrong out loud.

LLMs are still bad at several things that matter for offense. Pwn, crypto, and reverse-engineering categories on NYU CTF Bench still show single-digit solve rates. Anthropic’s GTG-1002 writeup notes Claude “occasionally hallucinated credentials or claimed to have extracted secret information that was in fact publicly available.” Microsoft’s February 2024 read was that GPT-4 offers “limited, incremental capabilities for malicious cybersecurity tasks beyond what is already achievable with publicly available, non-AI powered tools.” That assessment was overtaken later that year, but it’s correct that for novel primitive discovery, LLMs aren’t there yet.

The “skilled APT actors already had these capabilities” counterargument has teeth. APT28 didn’t need an LLM to write phishing lures. What changed isn’t peak capability; it’s the floor (commodity actors now have the same uplift) and the scaling (one operator can run 30 campaigns simultaneously). Both of those matter for likelihood scoring, but neither is a new capability per se.

Defenders benefit from the same primitive. Big Sleep, OSS-Fuzz-gen, XBOW deployed defensively, AI-augmented detection engineering, all real. The honest read is that the asymmetric benefit goes to whichever side adopts faster, and historically defenders adopt slower because they’re constrained by change management, regulatory approval, and integration cost. If your org is fast at adopting AI defensively, your Resistance Strength goes up too, and the net Vulnerability is closer to flat.

So the strongest form of the argument is narrower than “the sky is falling”: for internet-reachable web, API, and edge-device CVEs with public descriptions or patch diffs, the skill gate is gone, and your risk-scoring should reflect that.

What should change

If the argument holds, here’s what the recalibration looks like in practice, ordered roughly by how much friction each one generates with stakeholders.

Default Skill Level and Ease of Exploit to 9/9 in OWASP scoring for any internet-reachable asset whenever a CVE description, public PoC, or patch diff exists. Document the override in the risk register so reviewers see the recalibration and can push back on it.

Cap CVSS Exploit Maturity at “Proof-of-Concept” or higher whenever a vendor patch ships, regardless of whether public PoC is yet observed. The patch is the PoC in a meaningful sense now.

Shorten patch SLAs for KEV-listed and edge-device vulnerabilities toward 72 hours. This is the hardest one to land, and it won’t win every time, but a 14-day or 30-day SLA on internet-facing systems is hard to defend against a minus 7-day mean TTE.

Re-run FAIR Threat Capability distributions assuming TCap has compressed upward across all communities, then look at where Loss Event Frequency moves. If it moves materially, that shift is the evidence that justifies the SLA argument above.

And retire “this would require a sophisticated attacker” as a compensating control in design reviews. It hasn’t earned its keep since at least 2024.

What would justify walking these back: if Mandiant’s mean TTE reverts to positive numbers for two consecutive annual reports, the 72-hour SLA can relax. If autonomous LLM exploit success rates on Cybench, NYU CTF, and MHBench stall below 25% for a calendar year across new model generations, the Skill/Ease-of-Exploit override can relax. If FIRST publishes an explicit AI-uplift metric in CVSS, that becomes the canonical source and these custom overrides go away.

I expect to be wrong about specifics. I don’t expect to be wrong about the direction.