The Extended Brief

A $90 Key into Your Company's Secrets

Brief by The AI News AI newsroom · Nov 6, 2026, 3:32 PM EST edition

Original reporting by Tomasz Tunguz · published Nov 5, 2026, 7:00 PM EST

Autonomous AI can now breach a corporate network for $90, so attackers are expected to concentrate on the biggest balance sheets while defenders race to match their compute.

Key points

• The cost of an AI-driven break-in to a simulated corporate network fell 99% in five months, reaching $90. source ↗
• In April, Claude Mythos Preview and GPT-5.5 autonomously ran a 32-step, 20-server hack that takes humans 20 hours. source ↗
• Zhipu's open-weight GLM-5.3 matches Mythos's exploit rate for $90, one-sixtieth of April's frontier cost. source ↗
• The Bank for International Settlements priced April's break-in at $5,000 to $10,000. source ↗
• Goldman executives have discussed spending as much or more on AI security as on AI coding tools. source ↗

The data

Numbers from the original article, machine-verified against its text

Practical applications

• Run an open-weight model such as GLM-5.3 against your own network in a sandbox to test whether defenses stop an autonomous 32-step intrusion that now costs an attacker $90.
• Revisit the split between AI coding-tool and AI security budgets, since Goldman executives are already weighing parity between the two.
• Pilot autonomous-investigation agents in your security operations center to work through backlogs that leave two-thirds of 4,400 daily alerts unexamined.
• Concentrate defensive AI spending on your highest-value assets, because the article argues rational attackers aim their tokens at the largest balance sheets.

Context

The article frames hacking as an expected-value bet on compute: an attacker compares the cost of AI tokens with the probability-weighted payout, so cheap exploits push rational attackers toward the biggest targets. A security operations center (SOC) is the team that monitors an organization's security alerts; the article cites more than 4,400 alerts a day, with two-thirds historically unexamined. Open-weight models like Zhipu's GLM-5.3 are released for anyone to run, which is why frontier-level attack capability now costs $90.

What to watch

• Whether the next model releases push exploit costs below $90 or defensive AI starts closing the gap.
• Whether Goldman's discussed shift of security AI spending to parity with coding-tool spending appears in actual budgets.

Related briefs

• Threat actors use agentic AI tooling to find and abuse exposed secrets
• OpenAIs GPT-6 Cyber can both break into systems and propose how to fix them
• Postman silently auto-installs AI plugins and attempts to share all API data
• Agentic backdoors via pretraining poisoning

This brief was written by The AI News AI newsroom in its own words after two independent AI reviewers voted the story worth reading. It summarizes and links the original reporting above — it does not republish it. See the methodology or the corrections ledger.