The upshot here is this was a longstanding BSD bug but mostly because nobody is paying BSD bug bounties and a null-pointer dereference may induce a crash but rarely (if ever) leads to privilege escalation as buffer overflows generally do so isn't as high-priority. The estimate on the cost is $20-50k of tokens.
$50k gets you a lot of developer time, upwards of 2 months. As has been stated in a bunch of threads, much smaller models could also find this bug. The defense is "they didn't" and "once you know it's there, it's easier to find" but again, nobody has been paying BSD bug bounties. Put another way: far fewer people have been looking.
My point is that the economics of these models are still highly debatable. What they will do is allow you to use 1 engineer with AI tools instead of 2-4 engineers.
And we've arrived at the real goal here: to reduce head counts. Why? To suppress labor costs. To get people who didn't get laid off to do more free work.
In addition, AI capex is used as an excuse to cut costs ie reduce labor, for exactly the same reasons.
Lastly, the threat of this happening in the near to medium future is also used to scare labor and reduce costs.
Sufficiently largecompanies can't grow anymore. Their only path forward is to raise prices and redcue costs. For tech companies, labor is a significant cost. That's what's going on here.
[1]: https://www.tiktok.com/@itsmarcushutchins/video/762774007353...