这篇论文戳破了“AI将颠覆安全攻防”的简单叙事，用经济学框架解释了为什么防御者才是LLM漏洞发现的真正受益方。做安全运营、开源维护或漏洞奖励计划的人，看完会重新理解自己的瓶颈在哪。
本文从“漏洞经济学”视角分析LLM驱动的漏洞发现对攻防格局的影响。传统上，高端零日漏洞是政府、经纪商和攻击性厂商的昂贵专业产出，而LLM辅助系统降低了候选漏洞生成、代码理解、验证报告等环节的成本。这导致瓶颈从“发现更多漏洞”转向“吸收、验证、分类、修补和发布大量报告”。基于Anthropic Mythos Preview与Mozilla Firefox合作数据，论文指出近期变化不是更多零日漏洞，而是防御者修复吞吐量的提升：低信号候选漏洞变便宜，证据丰富的修复更重要，稀缺能力转向维护者审查和发布。开源项目受影响最严重，因为LLM辅助发现可增加报告量，但维护者验证、分类、资金和发布能力可能无法同步扩展。
Demystifying the Mythos or Disrupting Bugonomics? From Zero-Day Asymmetry to Defender Remediation Throughput
Recent demonstrations of large language models producing candidate and confirmed vulnerabilities in production software have renewed the narrative that AI will reshape offensive and defensive security. Headlines emphasize capability; they rarely interrogate costs and incentives. This paper examines LLM-driven vulnerability discovery through a bugonomics lens: the operational economics of producing, proving, prioritizing, and fixing security-relevant defects. Historically, the most visible high-end bugonomics was offense-priced because production-grade zero-days and exploit chains were expensive specialist outputs for governments, brokers, and offensive vendors. Defender-side bugonomics already existed in vulnerability research, reward programs, and vendor remediation work; LLM-assisted systems change its scale and distribution. They make candidate generation, code comprehension, harness construction, proof-of-impact drafting, and report preparation cheaper at codebase scale. Exploits and proofs of concept remain important, but in defender workflows they primarily prove impact, guide prioritization, and justify remediation. The resulting bottleneck is not only finding more bugs; it is absorbing, validating, triaging, patching, and shipping a larger stream of reports. Using public data from Anthropic's Mythos Preview and Mozilla Firefox collaborations, along with public exploit-market price anchors and vulnerability reward programs, we argue that the near-term shift is not simply more zero-days. It is a move toward broader defender remediation throughput: low-signal candidates become cheaper, evidence-rich remediation become more important, and scarce capacity shifts toward maintainer review and release work. The effect is acute in open source, where LLM-assisted discovery can increase report volume while maintainer-side validation, triage, funding, and release capacity may not scale.