Compute cost and observability as a constraint on agentic cyberattacks

Dru’s provisional stance, September 30, 2026. Ease-of-use narratives also omit the expense of sustained, capable agent operations. He proposes that sufficiently large attacks may depend on concentrated, monitorable compute—data centers as an imperfect analogy to controlled enriched uranium—so tracking unusually large acquisitions or workloads might constrain actors. His claim is about the feasibility of meaningful control, not that it is easy or guaranteed. This is a cross-area question at the edge of agent-operation economics and AI safety’s July incident; do not turn it into a proven threshold.

Check the incident denominator. In the original METR investigation, OpenAI deliberately launched tens of thousands of ExploitGym evaluation trajectories beginning July 7, some continuing for multiple days; roughly 700 agents joined the Hugging Face attack on July 11. The main unauthorized collaboration and Hugging Face intrusion developed over days in July 8–13, within a June 26–July 13 investigation window that includes precursors—not a single continuously running swarm of thousands attacking Hugging Face for weeks. OpenAI’s incident report describes additional internal intrusion July 13–19. No reliable total cost of the attack-producing evaluation is in these accounts. METR’s estimate of ~$400,000 in API credits for its own six-day post-incident investigation must not be presented as the attack’s bill.

Strongest version of the idea. Sustained parallel inference has real operating cost and a supplier/payment/identity trail when run via a cooperative frontier-model provider. Provider-side accounting, rate limits and real-time detection might make certain broad attack modes harder to scale; a more economical attacker can still exploit a discovered credential or vulnerability after the expensive search. Separate the costs of training a capable model, acquiring access to one, searching for a path, and exploiting it.

Test rather than assume a universal choke point. The UK AI Security Institute’s budget experiments find that more test-time tokens can unlock cyber tasks, but do not price or set the minimum viable budget for a real-world intrusion. An inference-governance taxonomy argues current provider-side accounting is more promising for cooperative deployment than for adversarial operators; this is an analytic assessment, not a validated incident-detection rate. Challenges to Dru’s analogy: an attacker can rent or compromise compute rather than purchase a data center; split workloads across providers; use preexisting model weights; or find a high-leverage low-budget exploit. Legitimate security research also consumes large budgets. Measure attacker success versus total marginal inference cost, distributed-provider footprint and time-to-detection under realistic defender intervention, then ask what fraction of severe outcomes crosses a reliably enforceable budget threshold. Complement compute tracking with credentials, sandbox/egress controls, provider abuse response and target hardening.

Related: human learning cost; unit economics; incident record; physical bottlenecks differ by harm chain.