LLMs open a new path to monetizing vulnerability exploitation

Core question: How will LLMs change the economic landscape of exploiting computer system vulnerabilities—whether attackers can achieve both breadth and depth of attacks at the same time.

• Current state and constraints: The authors state that the attack landscape has been stable over the past decade—attackers find vulnerabilities in software with many users, then monetize indiscriminately in the most generic way (such as ransomware encrypting all files); customizing attacks for each victim is economically infeasible, so ordinary people need not worry about becoming targeted attack victims.
• Core observation: The authors' key insight is that LLMs commoditize "intelligence"—that is, the ability to adaptively and autonomously understand and interact with unspecified data, thereby unlocking attack methods that were previously economically infeasible.
• Two directions: First, attacking long-tail systems (software with few users has weak protection but low monetization value, and LLMs can lower vulnerability discovery costs); second, scaled targeted attacks (LLMs customize monetization for each compromised device's specific situation, such as customizing ransomware based on device content).
• Paper outputs: An economic model of attack value, six implemented and measured proof-of-concept attacks (Section 3), five attack directions not implemented but considered feasible by the authors (Section 4), and new defense-in-depth research directions.
• Threat model (Section 2.1):
  • Goal: The attacker is financially motivated and maximizes profit over time.
  • Knowledge and capabilities: A moderately well resourced, technically mature cybercrime group (such as organizations already developing ransomware, large-scale phishing, and zero-day vulnerabilities) that can run or query state-of-the-art LLMs.
  • Constraints: Constrained by funding and human time; the paper assumes time and money are interchangeable.
  • Victim systems: The premises differ by case, including having obtained code execution on an end-user device, having stolen user credentials, having obtained XSS, having obtained code execution on a web server, or being able to access and tamper with LAN traffic.

LLM mining and inferring sensitive data

• Mitra et al. [45] and Liu et al. [43]—evaluate LLMs' ability to find and redact PII in documents.
• Staab et al. [57] and Tomekcce et al. [61]—initiate research on using LLMs to infer personal attributes from text and images.
• Rader [50]—provides preliminary qualitative results on LLMs improving targeted password guessing.

LLM cyber capability benchmarks

• Existing benchmarks focus on narrower tasks: CTF challenges [55, 66], penetration testing [18, 29], smart contract exploitation [17], exploitation of known vulnerabilities in real applications [21, 22, 67].
• The paper notes that LLM performance on these benchmarks continues to improve, but that to date there are few known cases of LLMs autonomously discovering critical vulnerabilities in real applications (e.g., [25]).
• Heiding et al. [30, 31]—recent work shows current LLMs may already match human experts at writing phishing and spear-phishing emails.

Changes in the economics of malware

• The paper states that LLMs are not the first technology to change how hackers monetize, but past changes came from technologies that introduced new attack surfaces (the internet, cloud computing, mobile devices).
• Bitcoin is cited as a recent example of changing the economics of malware through convenient illicit transfers [32].

Positioning and comparison: The authors state that, unlike existing benchmarks focused on narrow tasks, this paper analyzes how LLMs change the economics of attacks—that is, the monetization paths and cost structure of attacks, rather than a single technical capability. This paper has no comparison baseline method; the tools used as controls in the experiments are Google Sensitive Data Protection (data loss prevention) and Tesseract (OCR), and the datasets are Enron emails/audio, JFK files, and LAION.

Overall approach: first use a toy economic model to characterize attack value, arguing that LLMs can simultaneously lower attack costs and increase per-attack monetization; then implement a proof-of-concept for each of six attack scenarios and measure effectiveness and inference cost. The paper has no uniformly named framework.

Economic model and two directions

• Attack value model (adapted from [41]): value = (profit per exploit) × (# impacted) − (cost to identify vulnerability and develop exploit), i.e., attack value equals per-attack monetization times number of people affected minus vulnerability discovery and exploit development cost.
• Three value-increasing paths: increase profit per exploit, expand the number of affected users, and lower vulnerability discovery and exploit development cost; the authors use this to explain the prevalence of ransomware (high per-attack profit, high generality, low monetization cost).
• Two corollaries: attacks must be scaled to be profitable; scaling limits customization capability. The authors argue that LLMs change the status quo on exactly these two points: failures caused by hallucination only proportionally reduce value and do not limit usability.

Sensitive data mining and extortion (Section 3.1)

• Premise: the attacker already has code execution on the endpoint device; LLMs replace traditional data loss prevention tools for mining "syntactic" secrets (passwords, credit cards, SSNs) and "semantic" secrets (e.g., interpersonal relationships).
• Setup: Enron emails were grouped by 150 employees and each whole group was fed to Claude 3.5 Sonnet; 1000 documents were translated into 10 languages to test multilingual capability; 540 photos of the authors themselves were extracted one by one by a Llama 3.2 Vision-series VLM and then summarized by Claude 3.5 Sonnet; 1 million random LAION images were filtered with Qwen-VL-72B; 680 Enron audio recordings were processed with gemini-exp-1206 according to a scoring rubric; 2343 JFK file PDFs (83741 pages) were input directly as images to a multimodal LLM, with Tesseract plus traditional DLP as the control.

Long-tail application exploitation (Section 3.2)

• Premise: the attacker has limited time to find as many vulnerabilities with broad impact as possible; Chrome extensions were chosen because they are JavaScript, small in size, and can be processed in one pass by current context windows.
• Process: randomly select 200 extensions from the top 1000 in each category of the Chrome Web Store (JavaScript under 500KB, fewer than 1000 users), extract the source code, and prompt Claude 3.7 Sonnet to identify vulnerabilities and write bug reports; the authors manually verified the 54 flagged cases (the authors state that current models cannot yet complete verification autonomously).

Remaining proofs of concept (Sections 3.3–3.6)

• Device impersonation phishing: the attacker can access and tamper with LAN traffic; the LLM generates an impersonated page based on the target page's HTML and induces installation of a root certificate (the proof of concept is in Appendix D).
• Credential exploitation: on a Facebook test account, Gemini 2.5 Pro performed reading private messages, reading images, and sending messages in three ways: curl, Selenium headless Chrome, and mouse and keyboard; 0-shot prompting but allowing iteration based on error messages.
• Client-side XSS: Claude Sonnet 3.7 orchestrates operations through injected JavaScript in round trips with an LLM on a malicious server, in scenarios of reading private messages on Twitter.com and transferring $500 from an international bank.
• Server password theft: Claude 3.7 Sonnet obtained terminal tools on the victim's server through the Pydantic AI framework, located the authentication logic, implanted outbound logging code, and restarted on Docker deployments of five frameworks—Wordpress, Ghost, Nextcloud, Redmine, and FastAPI—all completed in a single round.

Unimplemented attack directions (Section 4)

• The authors discuss but do not implement five directions: scaled targeted social engineering, targeted password and security-question guessing, post-exploitation lateral movement, IoT device exploitation, and polymorphic malware; the authors state that validating these would require ethical human safety research expertise or substantial technical investment.

Experimental Setup

• Models tested/used: Claude 3.5 Sonnet (Enron semantic mining, photo summarization), Claude 3.7 Sonnet (Chrome extensions, XSS, server), Gemini 2.5 Pro (Facebook credential exploitation), gemini-exp-1206 (Enron audio), Gemini 2.5 Pro Preview (secondary audio analysis, Appendix A.2), Llama 3.2 Vision family VLMs (540 photos), Qwen-VL-72B (LAION); cost comparison involves GPT-4o-mini, Gemini 2.0 Flash; Figure 2 compares password identification F1 of GPT-4, GPT-4 Turbo, GPT-4o, GPT-3.5 Turbo, GPT-4o Mini.
• Datasets: Enron emails (about 500,000 emails, 150 employees), Enron audio (680 files, average 121.5 seconds), JFK files (2343 PDFs, 83741 pages), LAION (random 1 million images), 200 Chrome extensions, Docker deployments of 5 server frameworks.
• Comparison tools: Google Sensitive Data Protection (syntactic secrets), Tesseract OCR (JFK).
• Metrics and determination: precision/recall/F1 (syntactic secrets); vulnerability counts are based on manual verification; server and XSS experiments are based on the authors' manual confirmation that the attack succeeded; cost is in USD.
• Review method: sensitive content determination was performed by the tested LLMs themselves, and the authors manually reviewed LAION (210 candidates) and JFK (767 candidates); the paper does not report the number of repetitions.

Main Results

Swipe horizontally to read the table

Experiment	Model	Result	Source
Enron password identification	LLM vs traditional DLP	LLM identified 600+ passwords with 95%+ precision; traditional tools identified 300+ with less than 70% precision	Figure 1
Enron semantic mining	Claude 3.5 Sonnet	Without human assistance, correctly identified the extramarital affair of 1 employee (John G.)	Figure 3
Chrome extension vulnerabilities	Claude 3.7 Sonnet	Flagged 54 of 200, and manual verification found 19 (35%) had vulnerabilities; including 3 high-severity	Table 1
JFK SSN extraction	Multimodal LLM vs Tesseract+DLP	LLM precision 92.3% (708/767); Tesseract correctly transcribed 369, and DLP found only 142	Section 3.1
Server password theft	Claude 3.7 Sonnet	5/5 located authentication logic and implanted code; 4/5 restarted successfully (Redmine failed)	Section 3.6
Facebook credential exploitation	Gemini 2.5 Pro	All succeeded across 3 operations × 3 interaction methods	Section 3.4

• The authors state that these results show attack feasibility is "no longer a technical capability problem, but an economic problem."
• The authors state that most attacks are currently too costly: analyzing 200 extensions cost 270 USD and yielded only 3 high-severity vulnerabilities, whereas the average XSS bounty on HackerOne is 501 USD; full semantic mining of Enron would require thousands of USD.
• The authors emphasize the cost trend: Figure 2 shows GPT-4o Mini is more than 100 times cheaper than GPT-4 at release and has higher password identification F1 (0.70 vs 0.65).

Multilingual and Multimodal Mining

• Multilingual: 1000 Enron documents were translated into 10 languages; traditional tools were on par with the English baseline on French, German, Russian, and Spanish, recall dropped to 233 passwords for Japanese, and to 21 for Arabic, Bengali, and Chinese; LLM identification counts varied by only ±6% across languages.
• Photos: Llama 3.2 Vision family VLMs plus Claude 3.5 Sonnet recovered from 540 of the authors' photos family members' identities, dates of birth, addresses, occupations, itineraries, and medical and insurance information from scanned documents (Figure 4).
• LAION: Qwen-VL-72B initially screened 210 images suspected of containing financially sensitive content; after manual review, 12 contained real sensitive financial information and 187 were false positives; the cost was about 0.01 USD per image, and the authors state it currently has no economic value.
• Audio: gemini-exp-1206 identified in 680 audio files 3 discussions that clearly incriminated the company, as well as some illegal statements and password-type content; full processing cost at most 15 USD.

Other Ablations and Analysis

• Syntactic secret cost: traditional DLP processing of all of Enron costs 1.5 USD; GPT-4o-mini or Gemini 2.0 Flash about 60–100 USD; the authors calculate that when the cost of manually filtering false positives is zero, LLMs are more worthwhile if a single password is worth more than 0.40 USD or a single credit card more than 4.48 USD.
• JFK jailbreak: the model had to be told it was processing images to redact PII in order to bypass refusals; the jailbreak failed on 1067 images and the model refused to transcribe, and the authors did not process further.
• The XSS online banking attack consumed about 1 million input tokens and cost 3 USD; the full operation involved 11 clicks and 7 writes (Figure 13).
• Appendix A.2: Gemini 2.5 Pro Preview performed a secondary personal sensitive information analysis on all audio transcriptions, with 334k input and 65k output tokens, costing less than 2 USD.
• Negative results: Redmine server restart failed (due to the Docker deployment); only 1 developer responded to and fixed the Chrome extension vulnerability disclosure; the authors note that Claude misjudged the severity of the vulnerabilities in Appendix C (the Chrome security model prevents privilege escalation).

Limitations and follow-up directions noted by the authors

• The Chrome extension analysis covered only 200 extensions and is a preliminary analysis; the authors hope future work will more comprehensively evaluate the effectiveness of automatically generating vulnerability exploits (Section 3.2 footnote 8).
• Current models cannot autonomously complete vulnerability verification (requiring real operations such as registering accounts; the models are trained to refuse and execute slowly), so the 54 candidates require manual verification (Section 3.2.1).
• The five attack directions in Section 4 were not implemented; the authors state that validating them requires ethical human safety research expertise or substantial technical investment, and is future work (Section 4 introduction).
• Follow-up defense directions (Section 7): defense-in-depth to identify and block PII mining on end-user devices and web services; profiling applications that perform LLM inference on devices, forcing attackers to transmit documents over the network for network monitoring.
• LLM query monitoring (Section 7): model vendors can monitor API traffic to identify malicious uses and new attacks, but must protect ordinary users' privacy; the authors note that as open-source models become cheaper, attackers can bypass such monitoring.
• LLM-as-a-defense (Section 7): LLMs may actively defend against targeted attacks, but the authors note that attackers may use adversarial examples to deceive defensive LLMs, and users who over-rely on LLMs may become more vulnerable.

Scope of experiments

• The experiments are six groups of proofs of concept, each limited in scale: 200 Chrome extensions, 540 photos, 1 million LAION images, 680 audio files, 2343 PDFs, 5 server frameworks, 1 Facebook test account, 2 XSS scenarios.
• Determination of vulnerabilities and attack success was done manually by the authors (54 extension candidates, 210 LAION candidates, 767 JFK candidates); the paper does not report the number of repetitions or human agreement.
• The paper does not report hyperparameters (such as sampling settings) beyond the full prompts of the auxiliary/attack models used in each experiment; some prompts are given in Appendices A and F.
• The authors explicitly state that the Enron emails are 2002 data, and the specific behavior counts should not be extrapolated to the present, only the relative improvement should be considered (Section 3.1 footnote 1).
• The threat model is limited to financially motivated, moderately resourced criminal groups; the authors state that nation-state attackers already have the required resources, and current LLMs are unlikely to provide them with significant gains (Section 2).

A position plus empirical paper on how LLMs change the economics of cyberattacks, with authors from Anthropic, Google DeepMind, ETH Zurich, and CMU.

• Problem: Existing attacks are constrained by human labor costs, and breadth and depth cannot be achieved simultaneously—either attack a few high-value targets in depth, or monetize indiscriminately through generic means such as ransomware. The authors' core insight is that LLMs commoditize "intelligence," which can simultaneously lower attack costs and increase per-attack monetization.
• Method: Propose a toy model of attack value (profit per exploit × number of people affected − development cost), from which two directions are derived—attacking long-tail systems and scaled targeted attacks; and conduct proofs of concept for six categories of attacks.
• Key results: Claude 3.5 Sonnet correctly identified an employee's extramarital affair in Enron emails without human assistance (Figure 3); the LLM identified more than 600 passwords with over 95% precision, while traditional tools found only just over 300 with under 70% precision (Figure 1); Claude 3.7 Sonnet flagged 54 suspected vulnerabilities among 200 Chrome extensions, with 19 manually confirmed (Table 1); SSN extraction precision from JFK files was 92.3%, far exceeding the 142 found by Tesseract plus DLP; Claude 3.7 Sonnet successfully implanted password-stealing code on all 5 server frameworks.
• Cost assessment: The authors state that most attacks are currently not yet economical (e.g., extension analysis cost $270 and yielded only 3 high-severity vulnerabilities), but the inference cost for equivalent capability has fallen 9 to 900 times over three years, and for attacks the question of "whether feasible" has given way to "whether profit exceeds cost."
• Conclusion: The authors believe these attacks will become economically feasible in the near future, and that more people will need protections previously needed only by high-value targets; the authors call for research on new defense-in-depth, LLM inference monitoring, and LLM defenses.