Cyber Losses vs. AI Capabilities

AI capabilities relevant to attack and defense have climbed steadily since ChatGPT and the open-weights wave of 2022–2023. Global losses to fraud and hacking have not visibly responded: on Joshua Saxe’s compilation they grew roughly 3x over the decade as online scams, fraud, and ransomware industrialized — with the steep part before 2022 — then flattened or tapered in the AI era. Saxe treats the missing uplift as the crux any AI security policy has to clear: a claimed new risk from AI, and any intervention premised on it, needs an explanation for why damages have not moved with capability. ¹

The damages record and its error bars

The baseline itself is contested. Lukosiute, Halstead and Righetti (2026) survey 27 estimates of global cybercrime damages and find them spread over three orders of magnitude, from tens of billions to tens of trillions of dollars, with vendor headline estimates often inflated by commercial incentives and RAND’s 2018 models ($799B to $22.5T total costs) better read as maximum-exposure analyses than realized damage — $22.5T would be about 22% of world GDP. Their composite estimate, built from a UK business victimisation survey scaled globally, a US individual victimisation survey, and global cybersecurity spending as a defense-cost proxy, puts individual direct losses at ~$200B/year, business direct and response costs at ~$200B/year and defense spending at ~$100B/year: about $500B/year total, 90% confidence interval $100B–$1T, excluding indirect costs. ²

That baseline has two consequences for the AI debate. A ~20% increase in damages — reachable through efficiency gains in existing attack methods, with no qualitatively new capability — would add $100B and cross the damage thresholds frontier-labs safety frameworks commonly cite; a $10B increment needs only a ~2% uplift. And incremental AI-driven increases are not directly detectable in current data, because under-reporting, evolving crime definitions and measurement inconsistencies swamp them. Lukosiute et al. suggest indicators beyond aggregate cost (AI-generated code in malware samples, criminal forum adoption talk, labor-market changes in fraud operations) as the better instruments. ³

What “losses” counts

Anderson and colleagues’ cost accounting (2012 framework, 2019 update) splits the total social cost of cybercrime into direct losses, indirect losses and defense costs. By 2019 about half of property crime by volume and by value was online — slightly under half in the UK ONS survey, slightly over in France, disputed for the US. Amounts actually stolen per citizen stayed small (tax and welfare fraud a few hundred a year, card and online-banking fraud a few tens, pure cyber-scams tens of cents per head), while indirect and defense costs ran tens of dollars per head — more than ten times criminal earnings on their 2012 figures; 2019 victimisation data (6% of people victimized at ~$200 average take) pushes proceeds into double digits per citizen. The move online socialized the cost of crime: where victim costs once exceeded defense and criminal-justice costs combined, defense and indirect costs now dominate, and the authors’ policy advice is unchanged since 2012 — spend less on anticipation (antivirus, firewalls) and more on catching and punishing perpetrators, because near-complete impunity is the core problem. ⁴

So “why are losses not worse?” has an accounting answer and an actor-side answer. Measured direct theft was never the bulk of the bill; the bulk is defensive spending, which scales with caution and precaution rather than with attacker productivity. ⁵

Attacker-side constraints

Saxe’s theory starts with the workforce. His (unpublished) modeling estimates ~720,000 people in the online criminal economy, 90% of them in scam and fraud call-center operations, some of them human-trafficked; of the ~76k actual hackers the vast majority work for governments, and of the few thousand criminal hackers most work in ransomware. Criminal organizations base themselves in middle- and lower-income countries where pay is low and workers have few formal-economy options; the skill distribution of the workforce is well below the “MIT graduate” adversary that AI-safety threat modeling tends to imagine. Arrest, sanction and interdiction then cap scaling: larger organizations attract more domestic and international law-enforcement attention, and in a Claude-assisted sample of 152 named criminal enterprises (survivorship bias acknowledged) a large majority ended in legal consequences. Outside zero-day access, attackers run into physical constraints — talent, wages, law enforcement — that defenders do not. ⁶

UNODC’s 2023 field study of Southeast Asian scam compounds documents what that workforce looks like up close: organized-crime groups traffic young, economically vulnerable, educated and multilingual people from at least the region into casino, hotel and special-economic-zone compounds (Cambodia, Lao PDR, Myanmar and neighbors), confine them there, and force them up to 15 hours a day to run online scams — an estimated 10,000 to over 100,000 people trafficked for forced criminality, defrauding victims worldwide of on average USD 169,000 each. The same operations already use AI tools (face swapping, voice replication) to bypass banking security. The compound workforce is coerced labor, not volunteer elite hackers, and it is concentrated in exactly the low-wage, weak-rule-of-law settings Saxe’s wage argument predicts. ⁷

Workflow and business-model inertia

Initial access is one step of a longer chain: infrastructure setup and maintenance, lateral movement, ransom negotiation, payment, money laundering, and recruitment/retention all sit around it. On Saxe’s reading, the AI security community’s focus on CVE-driven initial-access (and sometimes privilege-escalation) costs as the bellwether for future damages misreads where the binding constraints are. Criminal workflows industrialize slowly: the “cryptoviruses” literature dates to 2008 and ransomware took another 5–8 years to become a multi-billion industry, helped along by impunity geopolitics, a former-USSR labor pool pushed toward informal work, and crypto payment rails; “Cyber Pearl Harbor” was popularized in 2012 and the first nation-state attack to significantly disrupt another national economy was NotPetya in 2017. Fully AI-automated criminal business models — agent armies doing the end-to-end work of extracting laundered cash — do not yet exist, and would need to clear the same workflow-maturation lag. AI also prices as a premium input for attackers, and provider-side interdiction (accounts banned, inference cut off) makes an AI-native criminal operation unstable in a way a traditional one is not. ⁸

Nation-state bottlenecks

Governments have better talent and capital access than criminals but different bottlenecks. They adopt private-sector technology slowly — US security agencies lagged business on mobile phones, 2010s-era machine learning, and video calls — so offensive cyber units are unlikely to retool around agentic automation quickly even while using AI piecemeal for vulnerability research and exploits. They also lose AI cyber talent to the private sector on pay (the ex-NSA, ex-8200, ex-GCHQ flow). And fully automated swarm attacks that damaged a victim nation’s economy or critical infrastructure would likely cross the threshold of physical warfare and invite retribution: more cyber weapons, like more ballistic missiles, does not automatically mean more damage exchanged between states. ⁹

What would flip the picture

Saxe’s own risk list: nation-state agent-swarm capabilities doing 10–100x the damage of previous nation-state attacks; self-replicating worms from ideologically motivated actors; criminal innovation that substantially automates workflows. The historical pattern is a long conceptual lead time followed by step changes once conditions line up, so the current defender-dominant window is preparation time rather than a permanent state. On the macro-modeling side, Baksy–Caratelli’s cyber-risk model (see economics-of-cyber-risk) treats AI as raising attack capacity and finds the policy answer flips with the channel: minimum-security requirements stay robust, while subsidies turn corrosive when risk rises through attack capacity. ¹⁰¹¹

The October 2026 agentic-offense record

The “do not yet exist” side of the argument has dated counter-evidence now, though not in the form the essay describes. On 21 October 2026 Microsoft Threat Intelligence documented Storm-0940 (China-state aligned) running ARTEX-driven intrusions from September 2026: agents chaining reconnaissance, password spraying and OAuth application abuse at machine speed — 2,900 sign-in attempts per minute across more than 2,250 tenants — with privileged cloud access reached in under three hours at multiple organizations. ¹² On 30 October Chainalysis attributed an intrusion into its own systems and internal tools to “offensive agentic techniques.” ¹³ Saxe’s narrower claim still stands: what remains undocumented is the fully automated criminal business model — the workforce he counts is coerced labor in scam compounds, the October record is state-aligned campaigns plus one vendor intrusion, and the aggregate damages series has not visibly moved. ¹⁴ The nation-state bottleneck claim (offensive cyber units are unlikely to retool around agentic automation quickly) is the part the record touches most directly: Storm-0940 was operating an agentic framework by September 2026, while public reporting on the framework surfaced only in October. See agentic-offensive-techniques.

Reliability notes

• Saxe’s damages series and workforce numbers come from an unpublished practitioner essay (researched with Claude Opus assistance, self-described as a sketch ahead of a peer-review version); his 152-enterprise arrest sample is subject to survivorship bias. Read as orders of magnitude.
• Lukosiute et al. is a GovAI technical report (authors’ views, not peer-reviewed). Its wide interval is part of the argument: any “AI increased damages by X%” claim inherits a baseline spanning an order of magnitude, which is also why the authors argue incremental AI effects are not directly detectable today.
• The concrete, checkable claim of the essay — PHP2Shell and comparable AI-era CVEs will not by themselves produce a visible bump in overall damages — can be tested against 2026–27 loss data. ¹⁵

Related

• agentic-offensive-techniques — the October 2026 operational record (ARTEX/Storm-0940, the Chainalysis attribution) this page’s hordes question now runs against
• economics-of-cyber-risk — defender-side investment models and the macro layer; its open question on AI’s double effect is this page’s subject
• php2shell — the motivating case for Saxe’s essay
• llm-inference-provider-landscape — the provider-side interdiction Saxe counts as an attacker bottleneck cuts through the same trust-concentration layer
• private-sector-hack-back — the law-enforcement and deterrence pole Saxe credits with capping criminal scaling

Sources

• Joshua Saxe 2026 — If the vulnpocalypse is the apocalypse, where are the agentic attacker hordes?
• Kamile Lukosiute, John Halstead, Luca Righetti 2026 — Global Cybercrime Damages: A Baseline for Frontier AI Risk Assessment
• Ross Anderson, Chris Barton, Rainer Böhme, Richard Clayton, Carlos Gañán, Tom Grasso, Michael Levi, Tyler Moore, Marie Vasek 2019 — Measuring the Changing Cost of Cybercrime
• 2023 — Casinos, cyber fraud and trafficking in persons for forced criminality in Southeast Asia
• Aniket Baksy and Daniele Caratelli 2026 — The Economic Costs of Cyber Risk
• Microsoft Threat Intelligence 2026 — AI-driven, large-scale nation-state campaign using ARTEX enables supply chain compromise
• 2026 — Chainalysis Security Incident Information

Footnotes

1. Joshua Saxe 2026 — If the vulnpocalypse is the apocalypse, where are the agentic attacker hordes? ↩

2. Kamile Lukosiute, John Halstead, Luca Righetti 2026 — Global Cybercrime Damages: A Baseline for Frontier AI Risk Assessment ↩

3. Kamile Lukosiute, John Halstead, Luca Righetti 2026 — Global Cybercrime Damages: A Baseline for Frontier AI Risk Assessment ↩

4. Ross Anderson, Chris Barton, Rainer Böhme, Richard Clayton, Carlos Gañán, Tom Grasso, Michael Levi, Tyler Moore, Marie Vasek 2019 — Measuring the Changing Cost of Cybercrime ↩

5. Ross Anderson, Chris Barton, Rainer Böhme, Richard Clayton, Carlos Gañán, Tom Grasso, Michael Levi, Tyler Moore, Marie Vasek 2019 — Measuring the Changing Cost of Cybercrime ↩

6. Joshua Saxe 2026 — If the vulnpocalypse is the apocalypse, where are the agentic attacker hordes? ↩

7. 2023 — Casinos, cyber fraud and trafficking in persons for forced criminality in Southeast Asia ↩

8. Joshua Saxe 2026 — If the vulnpocalypse is the apocalypse, where are the agentic attacker hordes? ↩

9. Joshua Saxe 2026 — If the vulnpocalypse is the apocalypse, where are the agentic attacker hordes? ↩

10. Joshua Saxe 2026 — If the vulnpocalypse is the apocalypse, where are the agentic attacker hordes? ↩

11. Aniket Baksy and Daniele Caratelli 2026 — The Economic Costs of Cyber Risk ↩

12. Microsoft Threat Intelligence 2026 — AI-driven, large-scale nation-state campaign using ARTEX enables supply chain compromise ↩

13. 2026 — Chainalysis Security Incident Information ↩

14. Joshua Saxe 2026 — If the vulnpocalypse is the apocalypse, where are the agentic attacker hordes? ↩

15. Joshua Saxe 2026 — If the vulnpocalypse is the apocalypse, where are the agentic attacker hordes? ↩