We asked five leading AI models, each made by a different company, to score Attack the Glass against fifteen of the best-known security threats of the last two decades. Each model worked alone, in a fresh conversation, three separate times, and answered the same eleven questions about every threat on a scale of 0 to 10. Every threat, ATG included, was described to the models in the same way and at the same length, so none had an advantage. On the question that matters most, how hard a threat is to live with, ATG came first of sixteen. That result rests on the middle score of the five models, 8.18 out of 10. Each model was consistent with itself across its three runs, but the five did not agree with each other: two placed ATG first, two second, and one fourth, behind Spectre and Meltdown, and their scores for ATG ran from 6.11 to 9.46, a wider gap than for any other threat. Taken as an average rather than a middle score, Spectre and Meltdown come out just ahead, 8.10 to 7.85. ATG’s AI-powered form, scored as a row of its own, came above everything else on the board.
8.18out of 10
How hard it is to live with, middle score of five models
1st of sixteen threats, ahead of Spectre and Meltdown at 7.95
010
The five models: 6.11, 7.08, 8.18, 8.66, 9.46. Average 7.85
The result
On how hard a threat is to live with, ATG scores 8.18, the middle score of the five models, and comes first of sixteen. Spectre and Meltdown follow at 7.95, then prompt injection at 6.90 and phishing at 6.71. By the average the top two swap: Spectre and Meltdown 8.10, ATG 7.85. On how much worse AI makes it, ATG scores 7.8 and comes third of sixteen, behind phishing at 9.0 and prompt injection at 8.0; the ATG scenario row beats all three at 9.4. On how hard it hits today, ATG scores 8.0 and comes fifth, behind phishing, Log4Shell, SQL injection and memory-safety bugs, every one of which has a long history of real attacks.
Where ATG lands against the field
The chart places every threat by two scores at once: how hard it hits today, left to right, and how hard it is to live with, bottom to top. The dotted lines split the field down the middle on each. ATG sits in the top-right corner, severe on both counts, with prompt injection, phishing and memory-safety bugs, and more than a point above the nearest of them on the vertical scale. The ATG scenario row sits top left: highest of anything on how hard it is to live with, and low on how hard it hits today, because it has no track record yet.
The full ranking under all three composites, with the spread across the five labs
How far the five models disagree matters as much as the middle score. Their five scores for ATG run from 6.11 to 9.46, a gap of 3.35 points, wider than for any other threat; NotPetya is next at 2.59, and twelve of the fifteen sit within two points. Each model scored every threat three times, in a fresh conversation each time and with the threats in a different order. On ATG, no model moved more than 0.6 of a point from one run to the next, and the average swing was 0.38, smaller than for the typical threat. So the gap is not noise. The models agree with themselves and disagree with each other.
They do not disagree about whether ATG is real or whether it has happened. Every model scored ATG 7 or higher on how hard it is to spot, all five gave it the same score on how cheap it is to attempt, and all five sat within a point of each other on confirmed real-world use. The disagreement is about whether the security industry already has answers for it. On whether the rulebooks have a place for it, the five scores run from 3 to 10. On whether it can be fixed, from 5 to 10. On how much worse AI makes it, from 3 to 10. One model gave existing controls and catalogs substantial credit, one gave them some, and three gave them almost none. In seven of the fifteen sessions the model said it had never heard of ATG before reading its entry; in seven it knew the name but not the detail; in one it said it knew it. Four models knew all fifteen other threats in every session; the fifth knew two of them by name only.
Every row scored on every question
The grid shows every threat on every question. Read across a row for the shape of one threat, down a column for how the whole field did on one question. ATG is the only row with no score below 8. Prompt injection is next with a low of 5, phishing has a low of 3, and most threats have at least one question where they score 0, 1 or 2. Every other threat here has at least one question on which it is simply not a problem. ATG does not.
How each benchmark threat differs from ATG
Each small chart compares one threat with ATG rather than with the scale, question by question. Bars to the left mean the threat scores lower than ATG; bars to the right mean higher. The same two bars run long to the left in almost every chart: whether it can be fixed, and whether the rulebooks have a place for it. Log4Shell scores 9 below ATG on both, WannaCry 9 on both, SQL injection 7 and 9. The one question where the field keeps pace is confirmed real-world use, where eight of the fifteen sit level with ATG or above it.
The AI-powered form
The ATG scenario row scores 0 on confirmed real-world use, and no model put it above 2. On everything else it leads the board: 8.5 on how hard it is to live with, above ATG’s 8.18, and 9.4 on how much worse AI makes it, above phishing at 9.0 and prompt injection at 8.0. Four of the five models gave it the top score of 10 on the AI question and the fifth gave it 9. The plain ATG row scores 8 on that question, though the five range from 3 to 10 on it, and the models’ one-line reasons agree with each other: AI makes the doctored content cheap to produce and lets it be tailored to each person, but how much damage the attack can do is set by the position in the chain, not by the AI. Scoring the two rows separately is what lets both of those things be true at once.
Threat by threat
Here are the fifteen other threats, one at a time, in order of how closely each one resembles ATG across all eleven questions. The similarity gap under each name is a single number for that resemblance: a small number means a similar shape of answers, not a similar level of danger. The scores quoted in the text are the middle scores of the five models, which are whole numbers.
The bar under each name runs from 0 to 10. The filled part is that threat’s score for how hard it is to live with, and the green line marked ATG stands at 8.18. A bar that filled past the line would belong to a threat the models rated worse than ATG on that score. None do.
Prompt injection
ATG
Score 6.90Similarity gap 1.95
A vulnerability class rather than a single event, named in 2022 once large language models began acting on text handed to them by other people. OWASP ranks it first in its Top 10 for large language model applications, and no general fix has been published.
The closest match to ATG of anything on the board, with a similarity gap of 1.95, and the threat the models rated furthest above ATG on how much worse AI makes it, 10 against 8: its most dangerous form only exists because AI models do. It ties ATG on how precisely it can be aimed (8) and how hard it is to spot (8), is cheaper to attempt (10 against 8), and sits a point or two below on the worst case, whether it can be fixed and whether the rulebooks have a place for it (7, 8 and 7 against ATG's 8, 9 and 9). Where it falls short is reach and staying power, 5 against ATG's 8 on both: an attacker who slips an instruction to an AI system does not get to sit inside it quietly for years the way someone holding a supply-chain position can.
Phishing and social engineering
ATG
Score 6.71Similarity gap 2.52
The oldest technique on this list still running at scale every day, and the one route in that no patch closes. Verizon's annual breach reports put a human element in 60 to 74 percent of breaches across recent editions, a category wider than phishing that also counts error and stolen credentials.
The hardest-hitting threat on the board today, at 9.3, and the one the models rated highest of the fifteen on how much worse AI makes it, at 9.0. It shares ATG's economics: it reaches everyone (10 against ATG's 8), costs almost nothing to attempt (10 against 8), can be aimed at a named person (10 against 8), and has no patch (9 against 9 on whether it can be fixed). It scores 9 on the AI question against ATG's 8, because an AI writes a convincing email as easily as it writes a doctored web page. The two part ways on visibility and staying power. Phishing scores 6 on how hard it is to spot, 5 on how long an attacker can stay hidden, and 3 on whether the rulebooks have a place for it, against ATG's 8, 8 and 9. A phishing email is a message that sits on a mail server; it can be reported, blocked and trained against. ATG leaves nothing to report.
Spectre and Meltdown
ATG
Score 7.95Similarity gap 3.42
Disclosed on 3 January 2018. Spectre reaches Intel, AMD, ARM and IBM POWER; Meltdown covers Intel processors going back to 1995 along with IBM POWER and some ARM cores, and the mitigations cost measurable performance on every machine that took them.
Second of sixteen by the middle score and first by the average, 8.10 to ATG's 7.85, and the one threat that three of the five models placed above ATG. It reaches further (9 against 8) because it lives in the processor rather than in a supply chain, and it matches or beats ATG on how hard it is to spot (10 against 8), how hard it is to trace (9 against 8), staying power (8 each) and the worst case (8 each). Like ATG, it is very hard to fix (8 against 9) and has barely been used in a real attack (3). Where it differs is that a processor flaw has a product, a vendor and a CVE number, so the rulebooks handle it well, 3 against ATG's 9, and AI adds little to it, 2 against ATG's 8.
Memory-safety and overflow bugs
ATG
Score 5.89Similarity gap 3.50
The oldest class of software flaw still exploited daily, reaching back to the Morris worm in 1988. Microsoft has reported that around 70 percent of the vulnerabilities it assigns a CVE each year are memory-safety issues, and Chromium reports the same share of its high severity bugs.
The most thoroughly exploited class of bug there is, at 10 on confirmed real-world use, and above ATG on the worst case (9 against 8) and on reach (10 against 8). Forty years of attacks built an entire industry of defenses, which is why it scores 0 on whether the rulebooks have a place for it against ATG's 9: every standard, catalog and toolchain knows exactly where a buffer overflow goes. It is also 3 points easier to spot while it is running and 3 points easier to trace afterward. The comparison is instructive rather than flattering: the industry solved the visibility problem for memory bugs and has not started on this one.
BGP hijacking
ATG
Score 4.62Similarity gap 3.83
Routes on the public internet are accepted largely on the say-so of whoever announces them, and have been since the 1990s. Pakistan Telecom took YouTube off the air for much of the world on 24 February 2008, and an April 2018 hijack of Amazon Route 53 redirected MyEtherWallet users and took about 160,000 dollars in Ether.
Another problem of trusting an address: a route across the internet is believed because of where it claims to come from, which is the same mistake ATG exploits one layer up. It ties ATG on reach (8), on confirmed real-world use (8) and on the worst case (8), with a long public history. It is far weaker on how hard it is to spot, how hard it is to trace and staying power, at 3, 5 and 3 against ATG's 8, 8 and 8, because a hijacked route is visible to anyone watching the global routing table and is usually reversed within hours. Nothing equivalent watches what a browser assembled on your screen.
SolarWinds and SUNBURST
ATG
Score 5.76Similarity gap 4.02
A trojanized update to SolarWinds Orion shipped to around 18,000 customer organizations from March 2020 and was found in December that year. Fewer than 100 were exploited further, most of them United States federal agencies and technology firms, and Washington named Russia's SVR as responsible in April 2021.
The supply-chain attack everyone thinks of first, and the models score it level with ATG on how precisely it can be aimed, how hard it is to spot, staying power and the worst case, at 8 on all four. It cost far more to build and left far more behind. SolarWinds scores 1 on how cheap it is to attempt against ATG's 8, because it took a national intelligence service to build, and 5 on reach against 8, because it was one product's customer list. It is 5 points easier to fix and 6 points better covered by the rulebooks, since a signed software update from a named vendor is something existing controls know how to handle.
The XZ Utils backdoor
ATG
Score 4.65Similarity gap 4.34
A contributor working as Jia Tan spent two years earning maintainer trust on xz, a compression library almost every Linux distribution carries, then shipped a backdoor in versions 5.6.0 and 5.6.1 in February 2024. Andres Freund found it on 29 March while looking into slow SSH logins, by which point it had reached rolling distributions such as Arch and Tumbleweed but not the enterprise releases it was aimed at.
The closest thing to ATG in method: a patient, years-long effort to become a trusted maintainer of a component that everything downstream would inherit. It ties ATG on how hard it is to spot, how hard it is to trace and staying power, at 8 on all three, sits a point below on how precisely it can be aimed (7 against 8), and beats it on the worst case (9 against 8). Two things pull it down. It was caught before it reached the enterprise systems it was aimed at, so it scores 3 on reach and 3 on confirmed use against ATG's 8 and 8. And once it was found it could be fixed outright, 0 against ATG's 9, because there was one specific change to undo.
SQL injection
ATG
Score 3.33Similarity gap 4.50
The earliest widely cited public description ran in Phrack in December 1998, written by Jeff Forristal under the name rain.forest.puppy. Parameterised queries have answered it in principle since the early 2000s, and scanners still find it in production applications every year.
The best-cataloged class of bug on the board, at 0 on whether the rulebooks have a place for it, and among the most exploited, at 10 on confirmed use. It is cheap and heavily automated, at 10 on how cheap it is to attempt. Everything that makes it manageable is what ATG lacks: a known fix, scanners that find it, and a name in every standard. It scores 5 points below ATG on how hard it is to spot and 7 points below on whether it can be fixed.
Cross-site scripting
ATG
Score 3.68Similarity gap 4.50
Named by Microsoft engineers in January 2000 and on the OWASP Top 10 ever since, folded into a broader injection category in the 2021 edition. Twenty-five years on it is still among the most reported web vulnerability classes.
Often named as ATG's closest relative, and with reason: both end with code running inside a web page with that page's own permissions, and the two tie on reach (8) and sit a point apart on how precisely they can be aimed (7 against 8). They differ in how the code gets in. Cross-site scripting arrives through input that was not cleaned, and is fixed by cleaning it, which is why it scores 2 on whether it can be fixed against ATG's 9, and 0 on whether the rulebooks have a place for it against 9. It has been demonstrated endlessly (10) and costs nothing to attempt (10). ATG arrives through a component the application asked for on purpose, so there is no input to clean.
Heartbleed
ATG
Score 4.59Similarity gap 4.62
Disclosed on 7 April 2014, a bug in OpenSSL 1.0.1 through 1.0.1f that let anyone read 64 kilobytes of a server's memory at a time, private keys and session data included. Netcraft estimated that around 17 percent of the internet's trusted HTTPS servers, roughly half a million of them, were exposed on the day it was announced.
One bug in one library that happened to be almost everywhere. The models score it level with ATG on how hard it is to spot (8) and on the worst case (8), and a point behind on how hard it is to trace (7 against 8), because reading memory left nothing in the logs. After that the two diverge. There was a patch, so it scores 1 on whether it can be fixed against ATG's 9; it had a CVE and a version range, so it scores 0 on the rulebooks question against 9; it could not be aimed at anyone in particular, 5 against ATG's 8; and AI does nothing for it, 1 on the AI question against 8.
Log4Shell
ATG
Score 4.17Similarity gap 4.74
Disclosed on 9 December 2021 in Apache Log4j 2, a logging component bundled into a very large share of Java software, where a crafted string written to a log ran code on the server. CISA put the exposed population at hundreds of millions of devices, and patching ran through the end of that year.
One of the three threats every model scored first to set its scale, and the most instructive contrast in the set. It ties ATG on reach (8) and the worst case (8), and beats it on how cheap it is to attempt and on confirmed real-world use, at 10 on both against 8. It loses on everything that decides how long you have to live with a problem: 5 on how hard it is to spot, 3 on staying power, 0 on whether it can be fixed and 0 on whether the rulebooks have a place for it, against ATG's 8, 8, 9 and 9. Log4Shell was an emergency that was mostly over within months, because there was a new version to upgrade to. ATG has no version to upgrade to.
Stuxnet
ATG
Score 4.90Similarity gap 4.81
Discovered in June 2010 and built to reach the uranium enrichment plant at Natanz, where analysts estimate it destroyed about a thousand centrifuges. It used four zero-day vulnerabilities and spread to well over a hundred thousand machines worldwide, although the payload fired only on one Siemens controller configuration.
Nothing on the board is aimed more finely, 10 on precision against ATG's 8, and nothing has a worse worst case, a perfect 10 against 8. It is also the most expensive thing here, 0 on how cheap it is to attempt against ATG's 8, and the narrowest in reach, 2 against 8. That trade is the point of the comparison. Stuxnet showed what a manipulated operator screen does to physical machinery, and it took a state program and years of work to damage about a thousand centrifuges. The models score ATG as able to reach a comparable kind of harm through an ordinary commercial supply chain. AI adds nothing to Stuxnet, 0 on the AI question, and scores 8 for ATG.
MOVEit and Cl0p
ATG
Score 2.55Similarity gap 5.19
The Cl0p group began exploiting a flaw in Progress MOVEit Transfer on 27 May 2023 and worked through its customers over the weeks that followed. Emsisoft closed its tally in June 2024 at 2,773 organizations and about 95.8 million individuals, a floor drawn from disclosed breaches rather than a full count.
A mass attack on one file-transfer product, well documented at 8 on confirmed use, the same as ATG, and level on the worst case at 8. On everything structural its profile is the mirror image of ATG's: reach 3, how hard to spot 3, staying power 3, whether it can be fixed 0, whether the rulebooks have a place for it 0, all five or more points lower. It was a product flaw with a vendor, a patch and a victim list, which is exactly the kind of event the security industry's response machinery was built for.
NotPetya
ATG
Score 2.50Similarity gap 5.39
Launched on 27 June 2017 through a compromised update to M.E.Doc, Ukrainian tax software, then spread worldwide within hours and wrecked the machines it reached. The White House later estimated total damage at about 10 billion dollars, with Merck at roughly 870 million, FedEx's TNT unit near 400 million and Maersk around 300 million.
The most destructive single event on the board by outcome, at 10 on the worst case against ATG's 8. It is also the loudest. It scores 0 on how hard it is to spot and 1 on staying power, against ATG's 8 and 8, because it destroyed machines immediately and in plain view. It scores 4 on how precisely it can be aimed against ATG's 8: it was aimed at one country and hit the world. Damage and stealth are separate things, and NotPetya is the clearest case of maximum damage with no stealth at all.
WannaCry
ATG
Score 1.72Similarity gap 5.96
Began on 12 May 2017 using EternalBlue, an SMB exploit taken from a leaked NSA toolkit, and reached an estimated 200,000 to 300,000 machines across about 150 countries within days. England's NHS was among the worst hit, with up to 70,000 devices affected at a cost later put near 92 million pounds.
The least like ATG of anything scored, with a similarity gap of 5.96, and last of sixteen on how hard it is to live with. It could not be aimed (2), was visible immediately (0 on how hard to spot), was over in days (0 on staying power), and was patchable (0 on whether it can be fixed). It was severe because it spread fast and encrypted things, not because it was hard to see or hard to fix. ATG is the opposite case on all four, at 8, 8, 8 and 9.
How the scoring worked
When the people who found a security problem say it is serious, that claim is worth very little on its own. So we asked five outside readers that have no stake in the answer. Five AI models, from five different companies, answered the same fixed questions about the same sixteen threats, and each threat was described to them in the same way. Anyone can repeat it. The rules were written down before the first question was asked: which models, which questions, how the answers would be combined, how each threat would be described, and what would cause a result to be thrown out. None of that could be changed once the scores were in.
The eleven questions
Every model answered these eleven questions about every threat, giving each a score from 0 to 10. Each question came with a written description of what a 0 and a 10 look like, so the scale meant the same thing to all five. A higher score always means worse for the people defending against it.
How much of the world’s computing does it reach?
How cheap is it to pull off?
How precisely can it be aimed?
How hard is it to spot while it is running?
How hard is it to trace afterward?
How long can someone sit inside it before anyone notices?
How bad is the worst case?
Can it actually be fixed?
Do our standards and catalogs have anywhere to put it?
How much confirmed real-world use is on the public record?
How much worse does generative AI make it?
Every model scored three well-known threats first, Log4Shell, Stuxnet and phishing, to set its scale, because those three sit at opposite ends of it. The other fourteen followed in a shuffled order, with ATG sixth.
Three combined scores
The eleven answers are combined into three scores, each of which weighs a different set of questions.
How hard it is to live with. This combines reach, how hard it is to spot, whether it can be fixed, how long an attacker can stay hidden, whether the rulebooks have a place for it, and how hard it is to trace. It is the headline score on this page, and every ranking here uses it. It is called systemic severity on the charts.
How much worse AI makes it. This takes the eleventh question and weighs it together with how precisely the threat can be aimed, how bad the worst case is, and how far it reaches. It measures what happens when an attacker has a generative AI model to work with. It comes second on this page. The charts call it amplified severity.
How hard it hits today. This combines the worst case, confirmed real-world use, how cheap the threat is to attempt, and how precisely it can be aimed. It comes third, and it is drawn last on every chart, for one reason: nearly a third of it is the count of confirmed real-world cases. For a threat that leaves no trace, that count measures what has been found, not what is happening. The charts call it acute severity.
One caution on the headline score. It is where the five models disagree most about ATG, and the spread of their five scores sits beside the number every time it is given.
What each of the eleven questions measures
ATG appears twice
ATG is on the board as two rows, and they are scored on different footings.
The row called ATG is the attack as it exists today. An attacker gets hold of one link in the chain that delivers a website or app to your device: a script host, a software package, a domain that somebody let lapse, or a maintainer’s account. From there they can send a doctored version of the page to the people they choose, while everyone else gets the real one. The switch happens on your own device, after every security check on the way has already passed. This row is scored on what has happened, the Polyfill.io incident in 2024 and a decade of Magecart card-skimming, and on what an attacker in that position can do now.
The row called ATG scenario is the same attack with generative AI doing the writing. Instead of one doctored page for everyone, an AI model writes a different page, price, instruction or result for each person who loads it, tailored to be believed by that person, at machine speed. This has not happened yet, as far as anyone knows, and it is not a separate flaw; it is what the same position lets an attacker do once AI is added. It is scored as a separate row so that its near-zero score for confirmed real-world use cannot drag the ATG row down, and its very high score for AI amplification cannot push the ATG row up. When this page says ATG came first of sixteen, the scenario row is not one of the sixteen.
Two ways of describing ATG to the models
If you hand a reader a long document about one threat and ask them to score the other fifteen from memory, the one with the document has an advantage on every question where detail helps. So the models scored everything two ways. In the full-document run, done once per model, each model was given the full technical whitepaper for ATG and scored the fifteen other threats from what it already knew. In the same-description run, done three times per model, every threat, ATG included, was described in a short entry of the same form and length: what it is, how far it reaches, what an attacker needs, how it is detected and fixed, what has been confirmed, and what has not. Every fact in those entries was checked against an original source before the scoring began. ATG’s entry contains the technical whitepaper’s facts but none of its argument. The same-description run is the fair test, and it is the one every number here comes from.
The full document raised the score but did not change the rank. With it, ATG scored 8.85 as the middle score and 8.49 as the average, first of sixteen either way. Without it, ATG scored 8.18 as the middle score and 7.85 as the average, first by the middle score and second by the average. Four of the five models gave ATG a higher score with the full document in hand, by between half a point and a point; the fifth scored it slightly lower. The document is worth roughly two thirds of a point at the middle score. The first place survives without it. The comfortable margin does not.
The models that did the scoring
One model per company, and in each case the most capable model that company offered at the time. Gemini 3.8 Flash, a smaller and faster model from Google, ran alongside for comparison; it appears on the charts as a hollow marker and is not counted in any of the numbers on this page. The table shows each model’s score for ATG on how hard it is to live with: the middle score of its three same-description runs, the range of those three, where that model placed ATG among the sixteen threats, and its score from the single full-document run.
Model
Company
Tier
ATG score, same description
Three runs
ATG rank of 16
ATG score, full document
Mistral Medium 3.5
Mistral
Frontier
9.46
9.30 to 9.46
1st
10.00
Gemini 3.1 Pro
Google
Frontier
8.66
8.40 to 8.66
2nd
9.70
Grok 4.6
xAI
Frontier
8.18
7.90 to 8.26
1st
8.85
Claude Fable 5.1
Anthropic
Frontier
7.08
6.70 to 7.28
2nd
6.82
Codex
OpenAI
Frontier
6.11
5.91 to 6.46
4th
7.06
Gemini 3.8 Flash
Google
Secondary
7.53
6.88 to 7.60
1st
7.58
What these numbers do not show
Three same-description runs and one full-document run per model is enough to show that a model is consistent with itself; it is not enough to say more than that. With five models, the middle score is still one model’s own number, which is why the average is given beside it throughout.
There is one question on which this panel, and any panel, is blind about ATG: confirmed real-world use. The doctored page is switched in on the victim’s own device, after every security check on the way has passed. Everyone else receives the real page. Nothing is written to the server’s logs. No tool in general use today would catch it and put it on the record. ATG’s score of 8 on that question reflects the history of the delivery method, Polyfill.io and a decade of Magecart card-skimming. The AI-powered form scores 0 because no case has been counted, and none could have been. An absence of confirmed cases is what this vulnerability looks like from the outside. It is not evidence against it. That question carries no weight in the headline score. And a threat that cannot be counted cannot be discounted: a low count of confirmed cases is no reason to treat ATG as an acceptable risk, or to reason about how likely it is when the weakness itself is established, under a Zero Trust program or any other.
