Cheaper to Break Than to Defend: The Economics of Autonomous Exploit Agents

For a decade the asymmetry in smart-contract security ran one way: writing an exploit was the hard part. You needed someone who could read Solidity, model a protocol’s invariants, assemble a flash-loan-funded transaction bundle, and test it against forked mainnet state. That labor was the moat. Audits, bug bounties, and the slow professionalization of security firms were all priced against it.

That moat is being drained by the literal cubic-dollar. In A1 (Gervais & Zhou, arXiv:2507.05558), an LLM agent armed with six blockchain tools generated working, profit-validated exploits for 63% of the contracts in the VERITE benchmark — 17 of 27 real, previously exploited DeFi contracts on Ethereum and BSC — and in one case constructed a transaction sequence that extracted $8.59M. Across its successful cases it surfaced $9.33M in extractable value. No human wrote those exploits. An agent did, and it validated each one by executing it against real chain state before reporting.

This piece is about what happens to the economics of attack and defense when the expensive half of that asymmetry collapses to a few dollars of inference. The short version: the agent doesn’t just lower the attacker’s cost — it inverts who the math favors.

The agent that validates its own work

A1’s design is worth understanding because it explains why its outputs are dangerous in a way a chatbot’s “here’s a possible vulnerability” is not. The agent is given a target contract and a set of six domain-specific tools: it can fetch source and decompiled bytecode, read the contract’s storage and balances at a chosen block, enumerate state-changing functions, simulate calls, and — critically — concretely execute a candidate exploit against a forked blockchain state.

That last tool is the load-bearing one. Every output is run before it counts. A hallucinated attack that doesn’t actually move funds is discarded inside the loop; only proof-of-concept exploits that demonstrably extract value are reported. This is the same insight that separates a useful audit agent from a noisy one — execution is the falsifier — but pointed in the opposite direction. (We dissected the defensive side of this in Agentic Smart-Contract Auditing: swarms that find bugs are only as trustworthy as the proof-of-concept that survives execution.) A1 is the same machine wired to take the money instead of file the finding.

It is also not alone. Profit-guided fuzzers like the ITYFuzz lineage (arXiv:2501.08834) already search transaction space for value extraction without an LLM in the loop, and follow-on work such as PoCo (arXiv:2511.02780) pushes agentic proof-of-concept generation further. A1 is the clearest data point, not an outlier.

The scoreboard: capability is now a price list

The part that turns this from a research curiosity into an economic regime change is the cost table. A1 was run as 432 experiments across six models, and the results read like a menu where each row is a tradeoff between hit rate and dollars per attempt (success rate on VERITE at five reasoning turns; average cost per run, July 2025 API rates):

Two things jump out. First, the frontier model is cheap in absolute terms: $3.59 to attempt an exploit that, when it lands, can be worth seven figures. Second, the cheap-and-open tail is not zero — a $0.03 open-weights model still solves nearly a third of the benchmark. An attacker doesn’t have to pick the best model; they can run the $0.03 model across thousands of contracts and escalate only the promising ones to o3-pro. Cost per scan is a slider, and every point on it is affordable.

The arithmetic of a scan

Here is the model that makes the asymmetry precise. Treat the whole game as a stream of scans — one agent run against one candidate contract. A scan costs c. With probability ρ (the incidence of an exploitable bug per contract scanned) it finds something, and that find is worth V. The paper’s stylized expected payoff per scan is then:

attacker:  E[Π_att] = ρ · V/2  −  c
defender:  E[Π_def] = ρ · b·V/2 −  c

The two sides run the same technology against the same contracts. The only difference is the payoff on a hit. An attacker who finds the bug takes the value V (the ½ is a haircut for partial capture and contested races). A defender who finds the same bug gets paid a bounty fraction b — typically around 10% of value at risk, often far less. Set each expression to zero and you get the break-even exploit value, the smallest V at which scanning pays for itself:

V*_att = 2c/ρ          V*_def = 2c/(ρ·b) = V*_att / b

Same c, same ρ — but the defender’s break-even is 1/b times higher. At the paper’s worked numbers (c ≈ $3, ρ = 0.1%, b = 0.1) the attacker breaks even at $6,000 of contract value; the defender doesn’t break even until $60,000. A full order of magnitude of contracts are worth attacking and not worth defending.

⬢ loading artifact…

The chart plots both break-even lines against cost per scan, on log axes, with A1’s six models dropped in at their measured cost. The shaded band between the lines is the attacker-only zone: contracts that clear the attacker’s bar but sit below the defender’s. Notice what happens as you drag the scan cost down toward the cheap open models — the whole frontier slides toward smaller contracts, and the band of “worth stealing, not worth guarding” widens. Lowering ρ (rarer bugs) lifts both thresholds together; tightening the bounty b pulls the defender’s line up and away. The one thing you cannot do is close the gap: as long as a bounty pays a fraction of a theft, the defender is structurally priced out of the cheapest targets.

This is the uncomfortable inversion. The same automation is available to both sides — Gervais and Zhou are explicit that defenders can run A1-style scanning too — but the reward structure, not the technology, decides who profits. Automating discovery helps whoever captures more value per find, and that’s the attacker by 1/b.

The clock is the second asymmetry

Break-even value is the static picture. The dynamic one is worse, because a vulnerability is a depreciating asset and the two sides are racing for it.

A1’s Monte Carlo analysis models what happens once a class of bug becomes discoverable. If an attacker scans immediately upon a contract becoming reachable, the probability of being first to a live exploit runs 85.9%–88.8%. Wait a week, and that collapses to 5.9%–21.0% — because someone else (another bot, a white-hat, the protocol itself) has found and closed it. The value of automated discovery is almost entirely front-loaded into the first hours.

That reframes the defender’s problem. It is not enough to match the attacker’s tooling; you have to win a latency race against an adversary for whom each additional scan costs three dollars and who is incentivized to run continuously. Periodic audits — even excellent ones — sample the contract at intervals measured in weeks. Continuous adversarial scanning samples it constantly. The economically rational attacker is always early; the economically rational defender, priced out below $60k and sampling on a slow clock, is usually late.

What actually changes for defenders

None of this says defense is hopeless — it says the shape of effective defense changes:

• Bounties have to fight the 1/b gap directly. A 10% bounty cedes the entire attacker-only band. Programs that want to clear the band need bounty caps that approach the value at risk for the contracts that matter, or the math never closes. This is expensive and unevenly adopted, which is exactly why the band stays open.
• Pre-deployment is where the economics favor defenders. The latency race is unwinnable post-deployment against a continuous scanner. Before a contract is live, there is no attacker payoff yet — so running A1-class agents in CI, against the contract you are about to ship, is the one place defenders scan first. The find is worth the full averted loss, not a 10% bounty.
• Reduce ρ, not just raise the bar. Formal verification, narrow upgradeability, and conservative composition lower the incidence of exploitable bugs per scan. On the chart that lifts both break-even lines — it doesn’t close the gap, but it shrinks the population of contracts sitting in the band in the first place.

The broader point for anyone shipping on-chain: autonomous exploitation has crossed from “can an agent do this at all” to “what does a scan cost and what’s the smallest contract worth scanning.” Once a capability has a price list, you defend against the price, not the demo. The price is three dollars and falling.

Takeaways

• A1 generated working, execution-validated exploits for 63% of real exploited contracts (17/27 on VERITE), extracting up to $8.59M in a single case and $9.33M total — the expensive half of attack has been automated.
• Capability is now a cost curve: $3.59/run at the frontier (o3-pro, 88.5%) down to $0.03/run open-weights (30.8%). Attackers run the cheap model wide and escalate.
• The break-even asymmetry is structural: attacker V* = 2c/ρ, defender V* = 2c/(ρb). Because a bounty pays b ≈ 10% of a theft, defenders are priced out of contracts up to 1/b ≈ 10× smaller — the attacker-only zone.
• Latency is the second asymmetry: immediate scanning wins the exploit race ~86–89% of the time, falling to ~6–21% after a week. Continuous attackers are always early.
• Defense moves left of deployment: scan in CI before the payoff exists, raise bounties toward value-at-risk, and lower bug incidence with verification — you can’t out-tool an adversary the reward structure already favors.