This Month, a Breach Cost $50. Patching Took Weeks.
Attacks got cheaper this month. Patching did not get faster.
|
FENCIO BRIEF · ISSUE 15
|
This Month, a Breach Cost $50. Patching Took Weeks.
|
|
Security has always been an economics problem.
Attackers spend time and money. Defenders make that spend not worth it.
This month, the attacker's side of that equation changed.
|
|
THE GOING RATE
$50 per breach
A researcher at NorForge watched a single hacker direct AI agents with instructions under 100 Chinese characters long.
The agents attempted more than 1,200 websites and breached over 100, including sites belonging to Deere and SharkNinja. They spent roughly a day on each target before succeeding or moving on.
Total cost: about $5,000 in tokens. Around $50 per breach.
Many controls quietly assume the attacker will lose interest. These agents don't.
|
|
🔐 YOUR TURN
What would a day of that persistence find in your agents?
Point Fencio at your own agent and find out before someone with a token budget does.
Test your agent →
|
|
|
53 MINUTES TO ROOT
From old bug to working exploit
Anthropic says an unreleased Claude model wrote a working exploit for a Linux kernel flaw rated 9.8. No credentials, no user interaction, root access on affected servers.
From initial foothold to root took 53 minutes.
The flaw itself has existed for years. Finding it was never the bottleneck. Weaponising it was.
|
|
STILL COUNTING
The fix existed. Shipping it took weeks.
The upstream fix was public by 15 October. Red Hat shipped patched kernels for RHEL 8, 9 and 10 on 1 November. As of 3 November, Ubuntu still has none.
| TO EXPLOIT |
53 minutes |
| RHEL PATCH |
17 days |
| UBUNTU PATCH |
19 days and counting |
|
|
|
None of this is AI failing. It is AI working exactly as designed, on the wrong side.
The question is no longer whether attackers can afford to try. It's whether your response timeline was built for attackers who can.
|
|
THE SANDBOX
Our community for people who build, break, and defend AI agents. Members share what their agents actually did, findings like these included, before they make it into the Brief.
Join The Sandbox →
|
|
|
That's this week. Reply and tell us: what is the longest step between a patch being available and it being deployed in your environment?
|
|
