The Attacker's Verifier: Offense-Defense Balance Under a Shared Vulnerability Finder

Abstract

A model that finds software vulnerabilities far below human cost - Anthropic's gated Mythos being the first to cross that line - is widely read as a gift to attackers. We argue the reverse, and make the argument precise. Model security as a race: a target holds $N$ latent defects; a shared finder discovers them one by one; whoever reaches a defect first either patches it (the defender, permanently) or exploits it (the attacker, once). Four results follow. First, a finder shared symmetrically is offense-neutral: with equal access each side captures exactly half the expected damage, so raw capability, held by both, cancels (Proposition 1). Second, the attacker's captured share is $φ_{A} = e^{- β_{D} τ} / (g + 1)$ , the coin-flip baseline discounted by a capability gap $g$ and an access lag $τ$ ; and because patching is permanent while exploitation is consumed, cumulative offense is bounded by the finite defect stock and decays exponentially in the defender's head start (Theorem 1). Third, the ecosystem is defense-dominant - the attacker's share held below a tolerance $ε$ - exactly when $τ \geq τ^{⋆} = (\ln (1 / ε) - \ln (g + 1)) / β_{D}$ , a frontier on which release policy is the joint choice of capability gap and head start; open weights sit at its worst point, and a large enough gap secures dominance with no head start at all (Theorem 2). Fourth, because a patch to a component protects all its deployments while an exploit is spent against one, defender effort on shared infrastructure carries a deployment-multiplied return (Proposition 2). Each quantitative claim is checked against a seeded race simulation, included and linked. The thesis: superhuman bug-finding does not decide the offense-defense balance; the asymmetries a release engineers around it do - which is exactly the calculus behind gating Mythos, shipping the weaker Fable, and deploying defender-first.

The obvious reading of a machine that finds software vulnerabilities faster than any human is that the attackers just won. The obvious reading is wrong, and the reason fits on a napkin.

The machine is real now. In the spring of 2026 Anthropic disclosed a model, Mythos, that was good enough at finding exploitable bugs that they declined to release it - shipping a deliberately weaker public model, Fable, in its place, and standing up Project Glasswing to put the strong model in the hands of defenders of critical software first.[1][2][3] The instinct this provokes is dread: if a model can read a codebase and hand back a working exploit, every unpatched system in the world is now a sitting duck, and the balance of power has tipped hard toward whoever points the model at other people's software.

The instinct mistakes a capability for an advantage. The finder is not a weapon that belongs to attackers; it is a technology that both sides hold. The defender can read the same codebase, and can read its own before anyone ships it. So the question is not whether the finder is powerful - it plainly is - but what a powerful finder, available symmetrically, does to a contest whose two sides do different things with what they find. The thesis of this essay is that the answer favors the defender, structurally, for a reason with nothing to do with how smart the model is: a patch is permanent and an exploit is spent. Superhuman finding does not decide the balance. The asymmetries a release policy builds around it do, and gated release is the deliberate construction of those asymmetries.

Contributions. We (i) model security under a shared finder as a race over a target's latent defects, with the defender patching (permanently) and the attacker exploiting (once); (ii) show that a symmetrically shared finder is offense-neutral, a coin flip, so raw capability held by both sides cancels (Proposition 1); (iii) derive the attacker's captured share in closed form and show that monotone patching bounds cumulative offense by the finite defect stock and decays it exponentially in the defender's head start (Theorem 1); (iv) give the exact defense-dominance threshold, a frontier in capability-gap and access-lag space on which release policy is a point (Theorem 2), and read Mythos, Fable, and Glasswing off it; and (v) validate the quantitative claims against a seeded simulation whose code is included and runnable - the simulated attacker share tracks the closed form to within sampling error, and the critical lag lands exactly where the theory puts it.

Finding is verifying, and a race decides who wins

Start with what the finder is. A vulnerability is a witness that code violates an implicit specification - a crash, a leaked secret, a privilege it should not grant - and a finder is an engine that searches for such witnesses. That makes it a verifier, the object of the third essay in this series, pointed at an adversarial target rather than at an agent's own output.¹ Everything the earlier essay established about the cheapness and composability of verification transfers; what changes is that the code being checked belongs to an opponent, and the checker is available to both opponents at once.

Strip the contest to its core. A target - a codebase, a deployed service, a widely used library - contains a stock of $N$ latent defects. Two parties search it with finders: a defender $D$ and an attacker $A$ . Searching is a Poisson process: each defect is discovered after an exponentially distributed waiting time, at a hazard rate set by the finder's throughput. The two parties do opposite things with a discovery, and that is the whole game.

Definition 1 (The security race). For each latent defect the defender's discovery time is

T_{D} \sim Exp (β_{D})

and the attacker's is

T_{A} = τ + Exp (β_{A})

, independent across defects, where

τ \geq 0

is the attacker's access lag - the head start the defender holds before the attacker wields a comparable finder. If the defender reaches a defect first it is patched and leaves the pool permanently; if the attacker reaches it first it is exploited, realizing damage

d_{i}

. The capability gap is

g = β_{D} / β_{A} \geq 1

, the ratio of the finder the defender wields to the one the attacker holds.

The two levers a release policy controls are named in the definition. The access lag $τ$ is bought by gating the model and disclosing to defenders first; the capability gap $g$ is bought by handing defenders the strong model while the public gets a weaker one. Set both to their trivial values - $τ = 0$ , $g = 1$ , the world of open weights and simultaneous access - and ask what the race looks like.

Proposition 1 (A shared finder is offense-neutral). With symmetric access (

β_{A} = β_{D}

τ = 0

) the attacker captures each defect with probability exactly

1 / 2

. A finder held equally by both sides is a coin flip: it does not, by itself, favor offense.

For a single defect the attacker wins iff

T_{A} < T_{D}

. For independent exponentials the probability the attacker's fires first is

β_{A} / (β_{A} + β_{D})

; at

β_{A} = β_{D}

this is

1 / 2

. □

This is the napkin. It is worth pausing on how much of the dread it dissolves. The fear that a bug-finding model hands the world to attackers treats the model as though only attackers could hold it. But the defender holds it too, and against a fixed target the two are drawing from the same well of latent defects. Raising both hazard rates in lockstep - a better finder for everyone - does not move the odds off a coin flip; it just resolves the same coin faster. Capability that both sides possess cancels. What is left, once it cancels, is the asymmetry in what a discovery is worth to each side, and the asymmetry in when each side gets to look. Figure 1 draws the mechanism those two asymmetries live in.

The security race. A shared finder draws latent defects from a target; whichever side reaches a defect first acts. The defender patches - the defect leaves the pool permanently and, if the target is shared infrastructure, protects every deployment of it. The attacker exploits - once, against one target, and only after clearing the access-lag gate

τ

. Equal finders make it a coin flip; the two asymmetries decide the rest.

The attacker's share, and why offense cannot compound

Turn the levers back on. Give the defender a head start $τ$ and a capability edge $g$ , and compute the fraction of expected damage the attacker captures.

Theorem 1 (Captured share; monotonicity bounds offense). The probability the attacker captures a given defect, and hence its expected share of total damage, is

φ_{A}

below. Because patching is permanent and the defect pool depletes without replacement, the attacker's expected cumulative damage is bounded by the finite stock

\bar{d} N

and decays exponentially in the defender's head start

τ

φ_{A} = e^{- β_{D} τ} \cdot \frac{β_{A}}{β_{A} + β_{D}} = e^{- β_{D} τ} \cdot \frac{1}{g + 1} .

The attacker wins a defect iff

τ + E_{A} < E_{D}

with

E_{A} \sim Exp (β_{A})

E_{D} \sim Exp (β_{D})

. Conditioning on

E_{A}

and using memorylessness,

P (E_{D} > τ + E_{A}) = e^{- β_{D} τ} E [e^{- β_{D} E_{A}}] = e^{- β_{D} τ} β_{A} / (β_{A} + β_{D})

. Substituting

β_{A} = β_{D} / g

gives

β_{A} / (β_{A} + β_{D}) = 1 / (g + 1)

. Damages are independent of the winner, so expected captured damage is

\bar{d} N φ_{A}

; since each defect leaves the pool once claimed and none return, the sum runs over a finite stock and is bounded by

\bar{d} N

. □

Read the formula as the coin flip of Proposition 1 hit by two discounts. The factor $1 / (g + 1)$ is the capability discount: at $g = 1$ it is the neutral $1 / 2$ , and as the defender's finder outclasses the attacker's it drives the share toward zero. The factor $e^{- β_{D} τ}$ is the head-start discount: every unit of lead the defender holds, measured in defender find-times, multiplies the attacker's take by a constant fraction. Both discounts are exactly what a gated release manufactures.

The monotonicity clause is the deeper half, and it is easy to skate past. Patching is a one-way valve: a fixed defect stays fixed, and the pool it came from is smaller forever after. Exploitation is not - an exploit is consumed in the using, and the defect it rode is, sooner or later, observed and closed. So the two sides are not symmetric ledgers. The defender's account only accrues; the attacker's is drawn against a balance that only falls. Offense cannot compound, because there is a finite amount of it to spend and every dollar spent is gone. Defense compounds, because every patch is permanent and, on shared infrastructure, replicated across every deployment. The head start does not merely delay the attacker; it converts the front of the race - the defects easiest to find - into patches before the attacker is even in the room.²

The gated-release frontier

Fix a tolerance $ε \in (0, 1 / 2]$ , the largest attacker share the ecosystem will accept. Call the ecosystem defense-dominant when $φ_{A} \leq ε$ . Taking logs of the share formula turns the condition into a straight line in the two policy levers.

β_{D} τ + \ln (g + 1) \geq \ln (1 / ε) .

Theorem 2 (Critical access lag). The ecosystem is defense-dominant iff the access lag exceeds the critical value

τ^{⋆}

below.

τ^{⋆}

is decreasing in the capability gap

g

and reaches zero at

g^{⋆} = 1 / ε - 1

: beyond that gap the capability moat alone secures dominance with no head start at all. Release policy is the joint choice of

(g, τ)

on or above this frontier.

τ^{⋆} = \frac{\ln (1 / ε) - \ln (g + 1)}{β_{D}} .

Rearranging

e^{- β_{D} τ} / (g + 1) \leq ε

and taking logs gives the displayed condition; solving for

τ

gives

τ^{⋆}

. It is decreasing in

g

and hits zero when

\ln (g + 1) = \ln (1 / ε)

, i.e.

g = 1 / ε - 1

. □

The two levers substitute. A wider capability moat lowers the head start you need; a longer head start covers for a narrower moat. Push the moat past $g^{⋆}$ and you need no head start at all - the public model is so much weaker that the ecosystem is safe the instant it ships. At the other corner sits the worst point on the whole plane: open weights at $g = 1$ , $τ = 0$ , where the share is the coin flip and defense holds nothing. Every release decision is a choice of where to stand relative to the curve $τ^{⋆} (g)$ .

Two questions remain: does a real race actually track the closed form, and does the threshold land where the theory says. Figure 2 runs the race. We draw random targets of $N$ defects, race a defender at rate $β_{D}$ against an attacker lagged by $τ$ and weakened by $g$ , and score the attacker's realized damage share as the lag grows - once ungated ( $g = 1$ , the coin flip decaying only through the head start) and once gated ( $g = 4$ ). The simulated share sits on the closed-form curve, and each crosses the tolerance exactly at its $τ^{⋆}$ .

The race against the closed form. Markers are Monte-Carlo attacker shares over random targets; solid lines are

φ_{A} = e^{- β_{D} τ} / (g + 1)

. Widening the capability gap from

g = 1

g = 4

collapses the head start needed to hold the tolerance

ε = 0.1

from

\ln 5 \approx 1.61

\ln 2 \approx 0.69

defender find-times. Bands are 10th-90th percentiles (

N = 40

, 4,000 targets per point).

Figure 3 is the map release policy is actually navigating. It plots the frontier $τ^{⋆} (g)$ in the plane of capability gap and access lag. Above the curve the ecosystem holds the attacker below tolerance; below it, offense wins the window. The named points are the real decisions. Open weights fall at the origin corner, deep in the offense region. A gated release that hands defenders a strong model and the public a weak one - Mythos private, Fable public - buys both a gap and, through defender-first deployment, a lead, and lands in the defense-dominant region. The vertical line marks $g^{⋆}$ , past which the moat alone suffices.

The defense-dominance frontier. The curve is

τ^{⋆} (g) = (\ln (1 / ε) - \ln (g + 1)) / β_{D}

ε = 0.1

. Open weights sit at the worst point; a gated Mythos with a public Fable and defender-first deployment sits above the curve. The moat alone suffices past

g^{⋆} = 1 / ε - 1 = 9

Patch the shared substrate

One asymmetry has been kept in reserve, and it is the one that names Glasswing's target list. A patch and an exploit are not scoped the same way. An exploit is aimed - it is spent against a single target, and a second victim requires a second firing. A patch to a component is broadcast - it protects every system that ships that component, all at once.

Proposition 2 (Deployment multiplicity). If a defect lies in a component deployed across

K

systems, a defender patch removes the expected damage from all

K

, while an attacker find yields damage against one at a time. The ecosystem value of defender effort on a shared component therefore scales with its deployment breadth

K

; concentrating finder capacity on high-multiplicity infrastructure maximizes dominance per unit of compute.

This is the formal content of “secure the world's most critical software.” A finite budget of finder compute buys the most ecosystem safety when it is aimed at the components with the largest $K$ - the shared libraries, the ubiquitous runtimes, the protocol implementations everything else is built on. The same defect found there and patched is worth $K$ exploits an attacker would have to mount one at a time, each one burning the element of surprise. Defender-first deployment against high-multiplicity targets is not charity; it is the allocation that puts the most distance between the ecosystem and the frontier.

The core of the race is a few lines. A single target, both sides drawing from the same finder:

# A security race. A shared finder is wielded by both sides; per defect,
# whoever's discovery time is smaller acts first. The defender patches
# (permanent); the attacker exploits (once). Returns the attacker's damage share.

def race(n_defects, tau, g, beta_D, rng):
    beta_A = beta_D / g                             # attacker's weaker, lagged finder
    t_def  = rng.exponential(1 / beta_D, n_defects)     # defender find times
    t_atk  = tau + rng.exponential(1 / beta_A, n_defects)  # attacker, behind by tau
    dmg    = rng.exponential(1.0, n_defects)          # per-defect damage, iid

    won = t_atk < t_def                          # attacker reaches it first
    return dmg[won].sum() / dmg.sum()             # captured share phi_A

One target's race. Both sides draw from the same finder, scaled by the capability gap and offset by the access lag; a defender-first defect is patched and leaves the pool, an attacker-first defect is exploited. Averaged over targets the share converges to the closed form.

Reproducibility

Figures 2 and 3 come from a single seeded script with no inputs beyond its parameters; the simulated attacker share is scored against the closed form so the reader can see the two agree. The full script is available here; the core of the race experiment, which sweeps the defender's head start and checks the Monte Carlo against $φ_{A}$ , is:

# attacker share vs access lag, Monte Carlo against the closed form
for tau in taus:                                 # sweep the defender head start
    shares = [race(N, tau, g, 1.0, RNG) for _ in range(trials)]
    mc = np.mean(shares)                        # simulated captured share
    cf = np.exp(-tau) / (g + 1)                # closed form (beta_D = 1)
    # mc tracks cf to within sampling error; tau_star solves cf = epsilon

The access-lag sweep behind Figure 2. Running the full script regenerates both figures deterministically.

Related work

The offense-defense balance is a borrowed idea; Slayton gives the careful modern account of what it means and how to assess it for cyber.[9] The claim that a shared finder is offense-neutral rests on vulnerability rediscovery - the empirical fact that the same defect is often found independently by more than one party - studied by Ozment,[6] quantified at scale by Ablon and Bogart[7] and by Herr, Schneier, and Morris,[8] and it revives Rescorla's old question of whether finding holes helps defenders or attackers.[5] The economics of disclosure timing - when to reveal a defect, and to whom - is Arora, Telang, and Xu's subject,[10] and the access lag $τ$ is that policy lever in a single parameter. Autonomous find-and-patch is not new either: DARPA's Cyber Grand Challenge fielded machines that did both a decade ago;[4] Mythos is that capability crossing from contest to consequence.[1][3] Our contribution is not a mechanism but a lens: a race model in which the release decision is literally a point in $(g, τ)$ space, and gated release is the act of choosing one above the frontier.

Limitations and threats to validity

The model is deliberately minimal, and its assumptions are where it can mislead. Rediscovery may not hold. The race presumes both sides can independently find the same defect; where a vulnerability is effectively unique and unrediscoverable, the contest collapses into a lottery over who searches a region first, and the empirical rediscovery rate - which the literature puts anywhere from modest to substantial - sets how much of the ecosystem the model actually covers.[7][8] The stock is not fixed. Real software is written continuously, so new code refills the pool; the fixed- $N$ results are a per-cohort statement, and under ongoing development the same threshold governs a flow balance rather than a depletion.³ The defender must actually lead. The whole advantage is the head start; an insider, a leak, or an open-weights release collapses $τ \to 0$ and $g \to 1$ , and the model then predicts exactly the coin flip it warns of. Expected share understates the tail. $φ_{A}$ is a mean; if damage is heavy-tailed, a single catastrophic defect the attacker wins can dominate the outcome, and the attacker needs only one - so a low expected share is necessary for safety but not sufficient. Finder precision is asymmetric. A finder that returns plausible non-bugs taxes the defender, who must triage and fix correctly, more than the attacker, who needs one real exploit; the model's shared hazard rate hides that the same tool may be worth more to one side. Models validate models. Nothing here substitutes for measuring rediscovery, lead time, and realized damage on live systems - the telemetry a program like Glasswing is positioned to collect, and the place these predictions should be falsified.

Conclusion

The stance is the point. Stop asking who has the finder - both sides will - and start asking who holds the window. A shared finder is a coin flip; what tips it is the head start and the capability gap a release builds around it, and the quiet structural gift that patches are permanent while exploits are spent. Gating Mythos, shipping a weaker Fable, and deploying to defenders of critical software first is not caution for its own sake. It is the deliberate placement of a release above the frontier $τ^{⋆} (g)$ , holding the window open long enough for defense to compound before capability equalizes.

This is the fifth essay in an arc with one underlying claim: autonomy at scale is a systems problem before it is a modeling problem. We began with the substrate - the operating system that arbitrates one agent's contended resources - and its memory, the context window managed as a hierarchy. We made a single agent reliable through verification, and found reliability is bought on the checking side. We coordinated a whole fleet through a market, where no single mind holds the global problem. Each move replaced an improvised behavior with a mechanism that carries guarantees. This essay points the same verification machinery outward, at an adversary, and finds that the guarantee survives the hostile setting - but only conditionally, and only for the side that engineers the asymmetries. The frontier did not hand security to the attacker. It handed both sides the same verifier, and left the advantage to whoever holds the window. For a single agent, verify. For an ecosystem under adversaries, hold the window - and design the release so the window is long enough.

A vulnerability is a witness that code violates an implicit specification - a crash, a leaked secret, an escalated privilege - so a finder is a verifier run against an adversarial target, the object of the third essay in this series. What is new is not the machinery but the aim: not the agent's own output but a live opponent's code. The generation-verification gap becomes an offense-defense gap. ↩

Monotonicity is doing real work. Because a patch is permanent and a defect, once claimed by either side, leaves the pool, the exploitable stock is non-increasing in time; the defender's head start front-loads the depletion into patches, so the attacker arrives to a pool already thinned of its easiest finds. Offense draws down a finite, shrinking balance; defense accrues a permanent, replicated one. ↩

The fixed-stock assumption is the sharpest idealization. Continuous development injects new defects, so the pool refills at some rate; the honest object is then a flow balance in which the defender must clear defects at least as fast as new code and attacker discovery introduce them. Gated release buys the transient the defender needs to reach that steady state, which is the dynamic version of holding the window. ↩