XBOW says the offensive-AI problem is the cheap seats, not the frontier

XBOW published testing this week arguing that the models most relevant to offensive security are not the most capable ones but the cheap ones that recently became good enough ^[1]. According to Albert Ziegler, the company's head of AI, the change is not that open-weight and near-frontier models are catching up to frontier systems as such, but that they have crossed a threshold where they suddenly provide net value at a cheaper price ^[2].

The models XBOW puts in this class include Z.ai's open-weight GLM-5.2, xAI's Grok 4.5, Anthropic's Opus 4.7 and Meta's Muse Spark 1.1, all of which the company says still perform very strongly on many of the hacking and exploitation tasks that worry policymakers ^[3]. Six months ago, XBOW's testing showed this tier struggled to complete moderately complex agentic tasks; today it largely can ^[4]. That is the entire argument, and it is an economic one: because the models are cheap, a user can spend many times more resources running them repeatedly against the same challenge ^[5]. Ziegler's version is blunter. Cheaper models can be given more time, and they "come from behind and leapfrog the big frontier model," which did not work half a year ago because a long-horizon agentic run on an open-source model "would just get lost" ^[6].

The near-frontier tier is moving too. XBOW recorded one of its best-ever exploitation benchmark performances from GPT 5.5 ^[7], and the report calls the gap between GPT 5 and 5.5 one of the clearest 2026 leaps in autonomous web application testing ^[8]. The number that matters is the miss rate: 10 percent for GPT 5.5 against 40 percent for GPT 5 ^[9], a 30 point spread ^[10]. More usefully for defenders, GPT 5.5 scored higher in tests without source code access, while GPT 5 leaned heavily on the code ^[11]. XBOW's read is that working without the code, as an attacker would, the newer model beat a version that could read it, and that what produced findings was reaching and proving a vulnerability against the running system rather than inferring it from a pattern in source ^[12]. Live interaction with the target mattered more than code access ^[13].

The cost side of the ledger comes from Anthropic, which tested Mythos Preview, used in Project Glasswing, and Opus 4.8 on how fast multi-agent swarms could find bugs across 15 open-source projects ^[14]. Agents working individually against assigned core directories found 21 vulnerabilities; the coordinating swarm found 266 ^[15], roughly 12.7 times as many ^[16]. The runs consumed 6.5 million and 27 million tokens ^[17], and Anthropic notes that few individuals or organisations can underwrite that ^[18]. Frontier models such as Mythos and GPT 5.6 are more capable on individual security tasks, but at exponentially higher token cost ^[19]. That is the trade the middle class exploits.

One caveat on the swarm result: the coordination was not human-like. Anthropic's separate video game experiment saw Opus 4.6 fail to coordinate and produce bad results, while Mythos and Opus 4.8 got better results by barely coordinating at all, siloing themselves and largely failing to merge their work ^[20]. Anthropic also observes that agents are more homogeneous than humans ^[21].

What to watch: whether policy attention aimed at frontier model gating survives the finding that an open-weight model plus patience does comparable work, and whether XBOW's benchmarks start reporting cost per confirmed finding rather than capability per task. Also watch the miss rate as a defensive metric. A 10 percent miss rate on a cheap model run five times is a different threat model than one expensive pass.