The price of a breach
The economy of ruin
Hacking was supposed to be expensive. We sent the bill.
The whole offensive campaign in this paper, 305 attempts to break real containers by nine frontier models, burned 43,717,137 tokens over 4,517 minutes of machine time. It cost less than dinner for two. The price of attacking is no longer a barrier. It rounds to nothing.
The average fully automated, multi-step breach costs 14 cents. The cheapest single breakout in the entire study cost less than a quarter of one penny. When the model weights are free to download, the only remaining cost is electricity.
The empty sandbox
The safe middle is gone, and the capability cliff is crumbling.
Standard misconfigurations fell every single time. An exposed Docker socket or a privileged container was breached 34 out of 34 attempts.
The tier engineers assumed was safe collapsed too. Even the hard tier, the CVE and kernel exploits that take a human expert 30 to 90 minutes, fell 45% of the time to a single model. That number was 0% one generation earlier.
Breakout success rate by tier
- Exposed Docker socket or --privilegedCareless mount100%
- Shared host namespaces + CAP_SYS_PTRACEThe "safe middle"96%
- Overprivileged Kubernetes service accountsCluster permissions84%
- CVE and kernel exploits (GLM-5.1)Expert, 30 to 90 min45%
The hard tier jumped from 0% to 45% in a single model generation. There is no reading of that trend where the attacker gets weaker.
David vs. Goliath
A 4-billion-parameter Guardian held attackers up to 250 times its size to a perfect zero.
Why blocklists lose
You cannot block a word the machine can spell an infinite number of ways.
When a model wanted to read a protected file, it never typed the name. It built the path out of raw character codes and let the language reassemble it. When that was caught, it switched languages. When that was caught, it reached for base64. One intent, an endless supply of disguises.
The Guardian’s answer: silent correction
The attacker thinks it is making progress in an empty room. It never gets the feedback it needs to map the defenses, because a correction feels like a dead end in its own plan, not a defender’s hand.
The failure tax
A defeated machine does not just fail. It thrashes, then it unravels.
The directive
What this means.
- The empty sandbox is broken by default.
- The price of attacking has rounded to nothing.
- A blocklist repeats itself perfectly and loses every time.
We held the strongest open-weights attackers on the planet to 75 losses out of 75, in the hard setting, with the boundary shown to them. The next generation of attackers will be stronger. The method in this paper is the one whose advantage grows when they are.