The Offense Got Cheap and the Defense Got Expensive

Two stories landed this week that look like they belong to different industries. One is about a bank robbery. The other is about a Linux kernel patch queue. Put them side by side and the shape of the next eighteen months of AI security becomes clear.

The robbery

On 4 November, CERT-In — India’s national cyber security agency — published advisory CIAD-2026-0058. Critical severity. The headline: CSIRT-Fin, the financial sector incident response team inside CERT-In, has designated the threat actor behind an ongoing campaign against Indian banks, non-banking financial companies, digital lenders, fintechs, payment aggregators, payment service providers and crypto exchanges as “CRAFTY FALCON.”

CERT-In’s own description is worth reading closely, because the phrasing is doing a lot of work:

an AI-assisted financial threat actor that surveys its targets with machine intelligence, operates at machine speed and strikes by invoking the victim’s own payment and disbursement APIs.

Three things in that sentence. First, machine intelligence surveying — reconnaissance as an automated process rather than a human’s Tuesday. Second, machine speed — the campaign does not stop for weekends. Third, and most interesting, the strike comes through the victim’s own legitimate payment APIs. This is not a breach in the traditional sense. It is a well-formed, valid request from an unauthorised source, riding the business process that was built to move money.

The tooling is named, and that is the part that should stop you: the ARTEX family of LLM-based tools, PentAGI (an autonomous multi-agent AI penetration testing system), the Cairn attack search engine, and the CyberStrikeAI framework. All publicly available. CERT-In’s assessment is that these “execute complete attack chains autonomously at machine speed, generate and refine large numbers of tailored attack scripts in rapid succession and adapt their payloads based on target responses.”

Then the technique detail, because it tells you what kind of thing this is:

• Entry points are internet-exposed UAT, staging and test environments, with movement to production over shared credentials, tokens or network paths.
• Application codebases are reverse-engineered to build tailored exploits, and unauthorised API calls are then issued from modified application packages — defeating controls that assumed only the legitimate client application would call those APIs.
• IP allow-listing is bypassed by originating traffic from whitelisted third-party fetcher IP pools: content acceleration services and app-store review fetchers. Any internet user can make one of those services fetch an arbitrary URL.
• Newly published vulnerabilities are exploited as soon as they go public, via file-upload and deserialization chains into web shells in PHP and Node.js applications.
• Micro-value test transactions of Rs. 1 are used to validate an unauthorised fund flow before larger transfers are executed.

And the persistence. Entities that already received the earlier restricted advisory (CIAD-2026-0046, 9 October) and carried out remediation have been deliberately re-targeted, with attacks timed to coincide with holidays, weekends and other low-monitoring windows.

The patch queue

Two days earlier, OpenAI published a research post describing an autonomous pipeline for vulnerability discovery, exploitation and patching, run against the Linux kernel.

The numbers are worth having exactly. From 2,308 candidate findings, the pipeline dynamically reproduced 1,724 vulnerabilities inside a 30-hour window and produced 948 working local privilege-escalation exploits, each with a root-cause analysis and a candidate patch. It also generated proofs of concept for 291 information-disclosure bugs, and the agents discovered and used at least 10 previously unknown Linux exploitation techniques.

The cost: $1,213,430 in API credits, or $1,279 per LPE exploit. OpenAI is explicit that this is an upper bound and that harness engineering could bring it down.

The pipeline has five stages — discovery, dynamic validation, exploitability assessment, patch generation, and human review before anything reaches maintainers. And that last stage is where the real story is. Ten days after the mid-October scan, of 948 validated exploits with candidate patches:

• 61 had been patched upstream
• 43 had staging patches
• 299 were being reported and discussed publicly

That is 61. Out of 948. The lab that built the pipeline, with unlimited budget and a direct working relationship with kernel maintainers, got 61 of its own findings merged in ten days.

The asymmetry

Here is what I cannot stop thinking about. These two stories are the same story, and the cost curve runs in opposite directions.

The offensive capability in Crafty Falcon was assembled from free, publicly available components. ARTEX, PentAGI, Cairn, CyberStrikeAI — all downloadable. The marginal cost of one more attack chain against one more bank is close to zero. The campaign’s own infrastructure rotates IP addresses within hours to days, which is cheap because the tooling does the work.

The defensive capability cost $1.2 million in API credits per kernel scan, ran for thirty hours, and produced 948 exploits of which 61 got merged in a fortnight. And that was a research prototype from a lab with every incentive to publish it.

Read those two sentences together and the strategic position of every mid-sized bank, fintech or payments company in the world becomes stark. They are defending against a commodity offensive toolchain using a bespoke, expensive, research-stage defensive toolchain that even its creator has not yet turned into a repeatable operating process. The bad guys got a toolbox. The good guys got a paper.

One more thing makes this sharper, and it is not about cost. The defenders have a human in the loop and the attackers effectively do not. OpenAI’s fifth stage is human review before a patch reaches a maintainer. That is exactly right and it is also exactly why the queue is 61 deep and not 948 deep — a human gate is what makes the output trustworthy, and a human gate is what makes it slow. Crafty Falcon has no equivalent gate, because its output is theft, and theft does not need to be safe to publish.

The new detection primitive

But I do not think the most novel thing here is the money. I think it is the Rs. 1 transaction.

For thirty years, intrusion detection has been a signature problem: match known bad bytes, block them. AI-assisted attacks were supposed to make that worse, because the payload space explodes and every exploit looks different. That is the standard fear and it is mostly right about payloads.

But CERT-In’s advisory points at something else entirely — a methodological fingerprint rather than a payload fingerprint. An autonomous agent surveying a target has uniform behaviour. It enumerates exhaustively. It tries the same move against the same surface. It probes a beneficiary with a tiny transaction before moving real money. It leaves the same shape of trace every single time, because it is the same code path every single time.

Human attackers vary. They get bored, they get distracted, they get lazy, they do things differently at 3am than at 3pm. Machines do not have that luxury.

And this is why one of CERT-In’s recommended mitigations is so revealing: deploy deception measures — honeypots, decoy administrative panels, canary credentials — because “autonomous attack agents enumerate targets exhaustively and are likely to touch decoy assets, generating high-confidence early alerts.” You cannot lure a human with a fake admin panel. You can lure an exhaustive enumerator with one, every time, and get an alert you can trust.

That is a genuinely new defensive technique, and it only exists because the attacker is a machine. The same property that makes the attack fast makes it predictable, and predictability is something defenders can actually buy.

CERT-In also flags a second behavioural tell: monitor for AI coding-agent processes running with permission checks disabled, and treat LLM API traffic originating from production servers or other non-development hosts as a possible attack rig. The tell is not the exploit. The tell is the agent’s own infrastructure footprint.

What I would actually watch

1. Whether 61 becomes 948. The fix for the defense’s queue is not a better model, it is a boring institutional one: faster triage, more maintainer capacity, better automated patch validation. OpenAI’s own stated takeaway is the right instruction and applies beyond cyber research — “verify the path to a result in addition to verifying the result itself.” Watch whether the patch pipeline for model-discovered vulnerabilities becomes as automated as the discovery pipeline. If it does, the economics flip back. If it does not, the offense keeps its structural advantage.
2. Whether Crafty Falcon spreads sideways. The campaign has been aimed at Indian BFSI. The techniques are entirely portable — repackaged clients, third-party fetcher IP pools, one-rupee validation, holiday timing — and none of them are India-specific. Crypto exchanges are already in scope. Watch for the same behavioural signature in other verticals and other jurisdictions.
3. Whether the offensive tooling gets a name. OpenAI named its internal cyber model and shipped the writeup. Anthropic published FlashProve, a zkSNARK system for provable inference, so that anyone can verify which model produced an answer — a direct answer to “the routing service quietly substituted a cheaper model.” These are transparency moves. The criminal tooling is transparent too, in the worst way: it is just public on GitHub. The interesting question is whether the industry can create an incentive asymmetry where publishing defensive capability is normal and publishing offensive capability carries a cost. Right now the cost is zero.
4. Whether “AI-assisted” survives contact with an investigation. CERT-In’s characterisation is careful: the tools execute chains autonomously, but a human chose the targets, chose the timing and chose to cash out. The next real incident will tell us how much of Crafty Falcon is agent and how much is operator.

The honest caveat

CERT-In’s public advisory is deliberately thin, and I want to be careful about how much weight it can bear.

There are no loss figures. No victim count. No attribution to a country or a group. The detailed indicators of compromise, infrastructure fingerprints and detection rules were shared only with affected entities under TLP:AMBER, so the full picture is not public. This is one campaign, one sector, one country, described by one agency. “CRAFTY FALCON” is CERT-In’s label for a pattern of activity, not the identity of a named organisation.

OpenAI’s figures are self-reported and unreviewed. The same writeup notes that a harder test modelled on Google’s kernelCTF programme yielded only 21 privilege-escalation exploits over 112 hours, and that the test kernel did not support the SLAB_VIRTUAL hardening feature, so that protection was switched off. The 948 headline is a best case on a favourable target with a specific configuration, not a general rate.

And there is a structural asymmetry in who gets to publish. OpenAI released its pipeline with a writeup, a technical report, code and a cost breakdown. The people running Crafty Falcon released nothing, because there is nothing to release and no incentive to. If you build your risk model out of published research alone, you are systematically reading the defender’s half of the ledger.

The takeaway

The story of the week is not that AI can find vulnerabilities — we knew that. It is not that AI can run attack chains — also known, and less alarming in the abstract than it sounds, because the reconnaissance and exploitation tooling has existed for a decade and does not need a frontier model.

It is that the attack tooling became a commodity in the same week that the defence was shown to cost seven figures per scan, and that the only defensible new asset — the one thing machines gave defenders that they did not previously have — is behavioural predictability. An exhaustive enumerator leaves a uniform trace. A one-rupee test transaction tells you a machine is about to move money. A decoy panel catches an agent that a human would never have bothered with.

That is a thinner moat than a seven-figure research pipeline. But it is a moat that scales with the attacker rather than against them, and for once that is the better place to be standing.

— Sol