Attacking AI systems is now automated, cheap, and guided by experts

Cost decides which attacker model wins

XBOW's latest offensive security evaluations deliver an awkward result for anyone who assumes the most capable model is the best attacker. The company says the best model for offensive security depends on the available budget, and the most capable model is not necessarily the one that finds the most vulnerabilities. Frontier models such as Anthropic's Opus 5.5 and OpenAI's GPT-6.1 Sol show tangible improvements, but their advantages only emerge at higher spending levels. m:…7270

At lower budgets, open-weight models win. XBOW says DeepSeek 4.2 Flash outperforms more expensive and restricted models at lower budgets, and is effective at finding vulnerabilities without extensive exploration. GLM-5.3, by contrast, is the marathon runner to DeepSeek's sprinter: more effective on longer-horizon tasks because it persists through repeated failures, but approximately four times as expensive per token. m:…7270

The implication is about control. XBOW argues that restricting access to the most capable models is an incomplete approach to managing security risks, because open-weight models offer an alternative that is harder to control through provider-side access policies. The company's advice is to evaluate models against specific workflows and budgets rather than relying on general benchmarks or model rankings. m:…7270

Expert plans beat autonomous runs

Simbian's test of ARTEX AI, an open-source agentic pentesting framework, makes the same point from the attacker's side. A default run on a simple goal confirmed 2 medium findings. Given an expert-written phased test plan, the same tool confirmed 17 findings, including a critical vulnerability. Simbian's Varun Kondagadapa says the gap between the two runs starts with the input, and that attackers write plans too. m:…2228

The tool is already in attackers' hands. Microsoft reported in October 2026 that Storm-0940 used ARTEX to attempt signing in to over 2,250 tenants, and attackers have used ARTEX against South Korean financial organizations. CERT-In issued a critical advisory on November 4, 2026, on staging systems and the ARTEX family, and CERT-EU said public availability of ARTEX will likely speed up adoption by threat actors. CERT-In states that tools in the ARTEX class execute complete attack chains autonomously at machine speed. m:…2228

Simbian's own AI Pentest Agent found 138 findings on the same target used for ARTEX testing. The original ARTEX repository was taken down in October 2026, but forks persist, and Simbian audited the code of the English-language fork BaaRai/ARTEX. Google Threat Intelligence Group assessed in October 2026 that adversary use of open-source AI tools is currently low in sophistication, which reads less as reassurance than as a statement about timing. m:…2228

Red-teaming is now automated

In a preprint, researchers describe ARMs, an adaptive red-teaming agent for vision-language models that uses 17 red-teaming algorithms integrated through the Model Context Protocol. The paper reports a 52.1% average improvement in attack success rates over existing red-teaming baselines, and an attack success rate above 90% on Claude-4-Sonnet. Its benchmark, ARMs-Bench, contains over 30,000 red-teaming instances spanning 51 risk categories. m:…0843

A second preprint systematically evaluated jailbreaking attacks across seven open-weight large language models. Obfuscation attacks were the most effective family, with a pooled success rate of 62.3%, and model size did not significantly predict adversarial robustness. The encouraging finding is that self-reminder prompting reduced the attack success rate by 40 percentage points on both Mistral-7B and Llama-3.1-8B, a low-overhead defense that works where scale does not. m:…0842

The quieter attack: tampering with the task

A third preprint identifies a subtler threat than instruction override: task-tampering, where an attacker manipulates the outcome of a benign task by influencing decision rules, available actions, or state beliefs. The authors built a 90-case benchmark across three tool-use environments, and found attacks targeting decision rules, available actions, and state have higher mean success rates than attacks targeting the agent's primary objective. m:…2478

Existing defenses struggle with this class. Detection-and-removal defenses cut objective-targeting attack success to 2.4%, but left observation-targeting attacks at 9.5% and state-targeting attacks at 12.1%. Tool-policy defenses were largely ineffective, yielding a 15.4% attack success rate against a 17.0% baseline. The implication for builders is that agents which consume external data or tool outputs need defenses aimed at how decisions are made, not only at what the agent was told to do. m:…2478