Two Big Macs 🍔🍔 a Day

For four days in early July, an attack cracked 85 credentials, authenticated with 98.8 percent of them, pulled 2,564 personnel records, and mapped 21 connected government systems. The whole campaign ran on two Big Macs a day.

This time it wasn’t a super dangerous frontier research model escaping containment, or a coordinated hacktivist group wearing masks: it was open-source agents using a publicly available flash model. Cybersecurity firm Dream, whose threat research team disclosed the campaign, published the figures last week: an attack framework built on Hermes and OpenClaw, running DeepSeek-V4-Flash, delegating to 8 sub-agents at a time to execute 12 coordinated waves across government infrastructure from July 1-4th. The target list ranged from government vendors to a nuclear safety agency.

Being annoying to attack was a real defensive strategy for about a decade. It worked because attacker attention was scarce, so you only had to be more trouble than the next target. That assumption is dead, and most security budgets are still priced against it.

Taiwan’s Ministry of Digital Affairs separately confirmed an AI agent-assisted attack during the same period. (Though neither side has connected the two publicly.)

Dream described what they saw: an agent system built to “run an intrusion campaign rather than answer questions about one.” This was a purpose-built attack harness, not an LLM doing post-mortem log analysis.

Credential stuffing, account takeovers, lateral movement: I have watched these for about nine years, most of it at Akamai, where credential stuffing campaigns were background noise on a Tuesday rather than a P0. Bot traffic and account takeovers were a constant baseline that we used ML to filter automatically, every day for our customers’ websites, sometimes reaching 40% of their daily hits.

The frame I used with customers was: if your login is more annoying to attack than the next website’s, the attackers will validate their credentials where there are no bot protections in place. That was the reality, not a pitch: once we moved our bot protections into deny, the attackers moved on that same day. Either to another bank or retailer, or sometimes to a forgotten API endpoint we hadn’t protected yet. But attackers’ botnets carried an actual cost: zombie swarms still needed someone coordinating them, and that someone needs to sleep, take breaks, have caffeine, and gets frustrated. Attacker capacity was finite nine years ago, and being uninteresting worked because of it.

Sometimes the brand or site wasn’t the point at all. The attackers wanted somewhere, anywhere, that would return a clean 200 instead of a 401, so they could filter a stolen list into valid and invalid. What sat behind the login was irrelevant, the response code was the whole point of the attempts.

That was the first time I saw indiscriminate attacks.

Cred stuffing was just one technique, though. The rest of the kill chain still needed someone to choose to target you, and that person had a limited number of hours.

But those four days in July were 12 waves of attacks using 8 concurrent sub-agents. 21 systems in four days, for just the price of inference. Skipping a hardened target used to save the attacker something of value. Attention, time, money, frustration. Not today.

I ran some math on this attack’s inference costs: using the 1,395 files disclosed, at DeepSeek’s own published API rates rather than the cheaper rates at OpenRouter, the campaign’s inference bill is probably under $50, and under $500 even at the high end. Call it two Big Macs a day, at US prices, for four days. And it has only gotten cheaper since. If I’m off by 10x, the argument is unchanged. This is cheap for breaching a government.

[Before you point out flaws in my calculation, the assumptions I made are below ^{1 2}
Please run your own calculation and adjust the assumptions yourself with the calculator and sliders here. And no, I don’t endorse two burgers per day, even for adversaries.]

Attribution doesn’t change the cost. Linguistic analysis in reporting suggests a Chinese-language operator, but no attribution to a group or country. Either way: official state program, sub-contractor, or one person in a basement with a laptop, the cost of the API inference was identical globally.

The strongest objection to all of this is that compute was never the constraint. Building the attack system / harness, acquiring creds, renting residential proxies, acquiring compromised IoT devices, knowing what to do with all of it. Those are the real costs, and none of them collapsed. Pricing the compute is pricing the cheapest input.

Two problems with that: the first is that those costs are lower than most people assume. In 2024, Kaspersky priced dark web botnets at $99 to $10,000 to buy and $30 to $4,800 a month to rent, with leaked source code going for $10 to $50, or nothing. Residential proxies run $1 to $8 per gigabyte on the open market, and anything materially below the $0.10 to $0.30 per gigabyte that device owners get paid is, by definition, traffic sourced without consent. There is literally a SKU list for all of it.

The second is that those are fixed costs. You pay them once and use them across every target you point the thing at. Operator attention was a marginal cost, paid fresh for every target, every time.

The cost of mounting a campaign hasn’t really changed, but the cost of adding you to one has.

I’m not claiming that credential stuffing and breaching a government across multiple agencies are the same problem. They obviously aren’t. But what I think we’re watching is the first version of a reusable attack harness. Build it once, point it at a new domain, hit go. And I’d bet it’ll be on the darkweb next week for copycats.

You used to be able to buy your way out of the attempt, or at least deter. Now the most you can buy is less damage.

I recognize this from battling bots on the web: if you’re validating 100,000 stolen credentials through a botnet, it doesn’t bother you in the least that most login attempts fail, or that the defender’s SOC is blocking your bot IPs hours after you’ve already rotated to 3 others since then. The successful logins are the entire point. 8 sub-agents running 12 waves works the same way: 11 can fail, the 12th attack might not. And you’ll still be standing up manual defenses against the first few waves when successful wave 12 hits you.

Security budget spent making yourself frustrating to attack is like doing drills for yesterday’s warfare. We’re in the age of autonomous agentic guerrilla drone swarms and you’re marching to battle in formation, flag up, drums, fifes, and bugles going, buttons polished. The bots aren’t intimidated. They coldly loop, reason, spawn subagents and flank you. Microsoft’s David Weston put it plainly at Black Hat this month: “Hand-to-hand combat with attackers will cause us to lose in defense.”

Segmentation is where I’d start, and it’s less daunting than it sounds. When I was at Akamai in 2021 they bought Guardicore to stop lateral movement inside the network, on the assumption that something inevitably always gets in.³ That’s a safe assumption now. The second is detection speed, because agents attacking at machine speed need a response at machine speed, and the best trained SOC analysts alive can’t comb through logs from 8 sub-agents across 12 waves fast enough to mount a defense. In July, Hugging Face had to run its forensics on the “unsafe” Chinese open-weight GLM-5.2, because the US frontier models’ “safety” guardrails refused to look at real attack payloads. A bookmarked SIEM query isn’t going to help here.

You could try to patch every vuln, but at Snyk most backlogs I saw firsthand were trending the wrong way, at no fault of the security team (coding assistants haven’t helped). Weston put a number on the other side of that race too: Microsoft’s own tooling found roughly 200 Linux kernel vulnerabilities and auto-generated 182 working exploits, averaging $3.61 and 21 minutes each. Security basics like patching, vuln management, and least privilege still work exactly the way they always did against human adversaries: a hardened target costs the attacker something, whether material or emotional, so they go bother someone easier. That’s still most of what lands on your desk daily, while agentic attack campaigns are still countable on one hand.

Against an agent, none of that matters: blocking a wave costs a few cents of inference and another loop of reasoning, and the campaign keeps running. You’ve only reduced what it can reach.

Your SIEM dashboard hasn’t changed, but what it represents has.

Most attack volume is the adversary your budget already tackles. The rarer adversary is the one your budget doesn’t address yet. That’s the inertia.

So the question I’d ask is what share of your threat model still responds to deterrence, and which adversarial population is growing faster.