The vulnpocalypse is here. Where are the large-scale cyberattacks?

Hopefully after the recent OpenAI news, the fact that large-scale attacks are coming is clear to all. Anyway, it's still interesting to explain the lag:

Vulnerabilities are just one small input to attacks. Especially small on mundane targets (as opposed to nation-state targets).

Even if this input (vulnerability discovery) is infinitely faster, cyberattacks will only increase by a capped amount (this is Amdahl's law).

The most effective cyberattacks are the ones with a human driving the intrusion hands on keyboard. Once that is unblocked (basically once malware becomes synonymous with LLM agent making API calls to "Together AI for cybercrime" serving open-weight models), we will see the large scale attacks. Did you know that your laptop is more valuable than just joining a botnet or mining crypto if someone can look at all of your files and threaten you to send the files to the public/the appropriate persons, unless you pay the ransom (itself set according to your standard of living)?

The same question was asked here in March 2025 but for SWE, and the top answers said the same thing (basically in the absence of end-to-end automation, Amdahl's law results in disappointing real uplift). A year later, we absolutely do have the 10x developers.

(Btw Gustafson's law seems more real than Amdahl's law but that's a detail here.)