10/ What holds never depends on catching the attacker's code: behavioral invariants plus other signals, rollback, immutable backups, pre-authorized containment. The attacker automated the intrusion and is now working on the invoice. 🔗 ben-livshits.org/blog/ransom…

9/ Gaps: I found no public dataset of agentic intrusions to fit any spread, forecasting or economics model. Key-release designs (RansomClave, zkRansomware) exist only as proofs of concept. Entropy detection weakens when only part of each file is encrypted.

8/ Black Hat 2025: a 7B model trained for about $1,350 against Microsoft Defender produced loaders that evaded it roughly 8% of the time, for that one vendor. A BSidesLV talk reached the same verdict on agentic malware: not yet decisive.

7/ Field data is more modest. Of 405 AI-related malware samples, Unit 42 saw only 12 on endpoints it protects, and its products blocked every sample that tried to reach a customer. FunkSec's seven ransomware variants were compiled in six days.

6/ I started from a long research report and checked it against primary sources. The "80.83% of ransomware is AI-driven" statistic came from an MIT Sloan paper that was withdrawn. A "25-minute full lifecycle" ended at exfiltration, before any encryption.

5/ It goes after AI models. Sysdig puts recovery for a fine-tuned enterprise model at $75,000 to $500,000, and a checkpoint is often not backed up at all. Where no immutable copy exists, the usual "backups decide outcomes" argument has nothing to say.

4/ Within three weeks of Sysdig's first report the operator was back at the same Langflow instance with ENCFORGE, a compiled Go payload: AES-256-CTR with an embedded RSA public key, a unique key per victim, and about 180 target extensions.

3/ It encrypted 1,342 configuration items with the database's own AES_ENCRYPT(), then dropped the tables underneath. The key was printed to stdout once and never stored. Paying would have restored nothing. The intrusion was automated. The invoice wasn't.

2/ Twelve seconds after the failure it was testing two fixes at once. Nineteen seconds later it deleted the broken record, regenerated the password hash and inserted it again. No binary on disk, no hand on a keyboard.

1/ 19:34:36 UTC. An AI agent's backdoor admin login fails on a production server. A human would stop, swear, or ask a colleague. This one reads the error, guesses two causes and tests both. The login works at 19:35:18. From Sysdig's JADEPUFFER log. 🧵

10/ Full post, with the case studies, the intake design and the bounty-economics research: 🔗 ben-livshits.org/blog/bounti…

9/ The post argues for a sandbox-first intake stack, rewards for verified fixes and triage labor, and cost following benefit: platforms and vendors fund the verification volunteers carry for free.

8/ The payouts agree. Google paid a record $17M in 2025; the Internet Bug Bounty cut rates 76-89% in May and GitHub cut its top reward from $30,000 to $10,000. Money follows verified findings.

7/ What holds is checking the claim, not the reporter. Immunefi wants a working PoC, Chromium a PoC or ASan trace, the kernel a reproducer and a tested fix. Submissions are cheap; PoCs are valuable.

6/ Blunt filters fail: real zero-days from the same models arrive in the same format, through the same channels, as the slop. A filter strict enough to drop the slop drops them too.

5/ The CVE program is on track for 66,000+ entries in 2026, 46.3% above forecast. Only about 1.4% of indexed CVEs have ever been confirmed exploited. A CVE is not an exploit.

4/ OpenSSL got about nine reports and enquiries a month in 2025, and as many as 70 now. The pool of skilled people to handle them is not growing at the same rate.

3/ The Linux kernel's security list went from 2-3 reports a week to 5-10 a day. Torvalds called it "almost entirely unmanageable," mostly because many people run the same tools and file the same bug.

2/ curl closed its bounty on January 31, 2026. The share of confirmed vulnerabilities fell from north of 15% to below 5%. Not even one in twenty was real.

1/ For about two decades bug bounties were a bargain: finding was slow, so a report meant real work. Models broke that. Discovery costs cents; judging a report still costs a human afternoon.