Key Takeaways
- Uber’s experience shows that unrestricted use of expensive frontier AI models can exhaust an annual budget in months, prompting cost‑caps on agentic coding tools.
- Enterprises are realizing that AI‑driven offensive security (penetration testing) is far cheaper for attackers—who can run lightweight, open‑source models continuously—than for defenders who must test thousands of applications with costly frontier models.
- The cost imbalance stems not from the volume of work alone but from applying a single, general‑purpose frontier model to every task, many of which do not require its full reasoning power.
- A sustainable offensive‑security AI architecture routes each task to the model best suited for it: specialized, proprietary models handle high‑volume, repetitive work; frontier models are reserved for problems that truly need broad reasoning.
- Owning the full offensive AI stack—models, prompting/harness, and intelligent routing—allows continuous benchmarking, optimization, and cost control, keeping defenders’ economics aligned with attackers’.
- When evaluating AI penetration‑testing platforms, decision‑makers should look beyond the frontier model name and assess whether the platform owns and continuously optimizes the entire stack, measuring recall, precision, and cost.
Uber’s AI Budget Crisis as a Warning Sign
In April, Uber’s chief technology officer disclosed that the company had burned through its entire yearly AI budget in just four months. By June, the firm imposed a hard cap of $1,500 per month per employee on agentic coding tools such as Claude Code and Cursor. This move was not an isolated reaction; it reflected a broader trend where enterprises are finding that AI costs are outpacing the budgetary projections they initially made. Bain’s recent survey corroborates the sentiment, showing that most companies are achieving less cost reduction from AI than they had anticipated. Uber’s experience thus serves as an early indicator that unrestricted reliance on premium AI models can quickly become financially unsustainable.
The Economics Gap Between Attackers and Defenders
The cost squeeze is evident across industries, but it is especially pronounced in cybersecurity. Attackers and defenders both harness AI, yet they operate under radically different economic models. An attacker needs only to find a single exploitable path in one application; they can achieve this with a cheap, capable open‑source model that lacks the safety guardrails imposed on commercial offerings. Because the model must succeed only once, the attacker can run it continuously at minimal expense.
In contrast, a defender must continuously test thousands of applications, every new deployment, each workflow, and every conceivable attack surface. Most of that testing still relies on frontier models—large, general‑purpose AI systems priced at a premium. Running those models across an entire portfolio at the frequency required for modern software delivery incurs costs that are orders of magnitude higher than what an attacker spends. The same methodological approach—AI‑driven offensive security—therefore yields wildly different cost structures for the two sides.
Why Frontier Models Alone Are Overkill for Many Tasks
The problem is not merely that defenders have more ground to cover; it is that many organizations apply the same general‑purpose frontier model to every offensive‑security task, regardless of its complexity. Most penetration‑testing activities—such as scanning for known vulnerabilities, generating simple exploit scripts, or checking routine misconfigurations—do not require the world’s most advanced reasoning abilities. Yet they are billed as if they do, because the underlying platform relies exclusively on frontier models.
Frontier models excel at broad, abstract reasoning and are invaluable for novel, ambiguous problems. However, using them to perform high‑volume, repetitive checks is analogous to hiring a Nobel‑prize physicist to verify basic arithmetic: the work gets done correctly, but the expense is unjustifiable. This mismatch inflates the defender’s cost curve while leaving attackers free to operate with lean, unguarded models.
The Architectural Solution: Model Routing and Specialization
The remedy is not to abandon frontier models altogether but to stop using them as the sole engine for offensive security. As testing frequency and coverage increase, a frontier‑model‑only architecture becomes progressively more expensive—each new application, deployment, or assessment adds another premium‑cost layer. Adjusting pricing models (e.g., negotiating discounts) does not address the root cause; the architecture itself must change.
Winning platforms will combine proprietary, task‑specific models with frontier models, routing each piece of work to the model that delivers the best performance‑to‑cost ratio. Specialized models handle the bulk of repetitive, high‑volume offensive security tasks, while frontier models are summoned only for challenges that genuinely demand broader reasoning—such as zero‑day exploit discovery or complex chaining of vulnerabilities. This hybrid approach ensures that the most expensive compute is reserved for where it truly adds value.
The Importance of the Harness, Prompts, and Orchestration
Selecting the appropriate model is only part of the equation. The surrounding harness—prompt engineering, skill libraries, tool orchestration, and feedback loops—determines how effectively each model is applied. AI capabilities evolve rapidly; new models appear monthly, performance shifts, costs fluctuate, and attacker techniques evolve. A static architecture that locks in a single model or fixed set of prompts will quickly become sub‑optimal.
Organizations that will prevail own the critical layers of the offensive AI stack: the models themselves, the harness that directs their use, and the intelligent routing logic that selects the optimal model for each task. By controlling these layers, they can continuously benchmark performance, fine‑tune prompts, and re‑route work as better or cheaper models emerge. This dynamic optimization enables the defender to maintain—or even gain—a cost advantage over attackers who rely on static, low‑cost open‑source tools.
From Financial Adjustments to Architectural Shifts
Re‑pricing AI compute merely changes who bears the expense of the same costly workload; it does not reduce the underlying cost of performing the work. True savings arise when the architecture itself makes the work less expensive by matching each task to the model best suited for it. In offensive security, this means that the defender’s cost curve can keep pace with—and eventually outstrip—the attacker’s, not by spending more on frontier models, but by spending smarter across a diversified model portfolio.
Uber’s budget overrun is therefore less a cautionary tale about AI spend in general and more a specific illustration of what happens when a single, high‑cost model is applied indiscriminately. The lesson extends beyond coding assistants to any domain where AI is used at scale, especially cybersecurity, where the asymmetry of attacker versus defender economics is most stark.
Evaluating AI Penetration‑Testing Platforms
When organizations assess AI‑driven penetration‑testing solutions, they should look beyond the headline frontier model employed by the vendor. Critical questions include:
- Does the platform rely exclusively on frontier models, or does it combine them with proprietary, specialized models?
- Does it own and continuously optimize the full offensive AI stack—models, harness, and routing?
- Is the system benchmarked against the metrics that truly matter: recall (ability to find real vulnerabilities), precision (low false‑positive rate), and cost per test?
Platforms that satisfy these criteria will be able to scale testing continuously without the prohibitive expense that currently constrains many defensive AI initiatives.
The Future of Offensive Security Lies in Adaptive AI Architectures
The evolving threat landscape demands that defenders test their applications continuously, yet the economics of AI make that untenable if every test consumes premium compute. By embracing an architectural approach—routing tasks to the fittest model, leveraging specialized AI for high‑volume work, reserving frontier models for genuinely complex challenges, and maintaining ownership over the entire AI stack—companies can align their cost structures with those of attackers.
In doing so, they transform AI from a budget‑draining liability into a sustainable, scalable advantage. Uber’s early budget caps are a signal; the enterprises that heed it by building flexible, cost‑aware offensive AI systems will be the ones that stay ahead in the relentless cycle of attack and defense.