Game theory has a new job in cybersecurity: deciding who gets the most powerful AI models first. A paper presented on Monday 26 October 2026 at GameSec 2026 in Ann Arbor, Michigan, uses game theory to show that handing the same frontier model to attackers and defenders at the same time leaves defenders no better off, even as attacks rise. The researchers argue that a short, timed head start for software vendors restores the balance.
The work comes from Christoph Landolt, a doctoral researcher at the CISPA Helmholtz Center for Information Security, with Tobias Lorenz and Mario Fritz of CISPA and Marta Kwiatkowska of the University of Oxford. Their paper, “The Oracle’s Gambit: A Game-Theoretic Framework for Responsible AI Release”, frames the problem with an image from Lewis Carroll. In Through the Looking-Glass, the Red Queen tells Alice that in her country you must run as fast as you can just to stay in the same place.
That, Landolt says, is where software vendors now find themselves. This article explains the game theory behind the paper, the numbers it produces, how it lines up with Anthropic’s Project Glasswing, where the model is simplified, and what it means for organisations that patch software for a living.
Table of contents
- The Red Queen’s Race and Why Game Theory Fits Cybersecurity Now
- How Responsible Disclosure Gave Defenders a Head Start
- Inside The Oracle’s Gambit: A Three-Player Game Theory Model
- Why the Defender Loses an Even Race
- Calibrating the Game Theory With Real Frontier Models
- The Answer: A Pre-Release Window for Defenders
- Project Glasswing as a Real-World Test of the Game Theory
- Limits of the Game Theory Model
- What Game Theory Means for UK Businesses That Run Software
- What to Watch Next for Game Theory and AI Security
- Frequently Asked Questions
- References
The Red Queen's Race and Why Game Theory Fits Cybersecurity Now
The story was first reported by Tech Xplore and supplied by the Helmholtz Association of German Research Centres. Its central claim is simple: when one AI model powers both sides of a cyber conflict, both sides get faster, but the defender does not get safer.
Alice, Carroll and an endless sprint
Biologists borrowed the Red Queen long ago to describe species that must keep evolving just to survive against rivals that are evolving too. Security people have used the same image for years. Attackers adapt, defenders respond, and nobody pulls ahead for long.
What is new is the speed. Landolt applies the metaphor to a specific moment: the release of a new frontier AI model. Each release raises the offensive and defensive capability of everyone who can use it. Game theory is the natural tool for that situation, because it models decisions that depend on what an opponent will do next.
What changed in 2026
Landolt points to two events. In February 2026 Anthropic released Claude Opus 4.6, and he says the model found more than 500 high-impact vulnerabilities in open-source software within its first two days. Anthropic’s own write-up, published on 5 February, says its team had “found and validated more than 500 high-severity vulnerabilities”, including flaws in Ghostscript, OpenSC and CGIF.
Then, in April 2026, Anthropic decided not to release Claude Mythos Preview publicly because it was so effective at finding unknown vulnerabilities. “The question we’re asking in our research,” Landolt says, “is how does this dynamic change the ways in which we need to think about cybersecurity in the AI era?” His answer is a piece of game theory with three players rather than two.
Why game theory rather than ordinary optimisation
Landolt explains the choice of method directly. “Cybersecurity and game theory are a common combination,” he says. “Many optimization problems in mathematics assume a rigid environment. But in game theory, we try to find optimal solutions by taking the opposing side into account.”
A patch schedule optimised against a static threat looks very different from one optimised against an attacker who reads your patches and moves first. Game theory builds that reaction into the maths, which is why it has a long history in security research and an annual conference, GameSec, dedicated to it.
How Responsible Disclosure Gave Defenders a Head Start
Before looking at the new game theory model, it helps to understand the system it says is breaking. For two decades, software security has relied on responsible disclosure to keep defenders a step ahead.
The 90-day norm
Under responsible disclosure, a researcher who finds a flaw reports it privately to the vendor. The vendor builds a patch, and the details become public when the fix ships, so users have a fair chance to update. The paper cites Arora, Telang and Xu’s 2008 model of this process, which found that the best policy is a deadline long enough for the vendor to patch but short enough to force action.
That work is itself a piece of game theory, and it fed the industry norm: a 90-day disclosure window, with a possible 30-day extension. The arrangement creates a temporary information advantage. The defender knows about the flaw before the attacker does.
Three conditions the old system relies on
The paper says responsible disclosure works only while three things stay true. Each is now under pressure from the same source: AI models that can find and exploit flaws cheaply. The table below sets out the conditions and the pressure the authors describe.
| Condition for responsible disclosure | Why it mattered | AI-era pressure cited in the paper |
|---|---|---|
| The flaw is not already known to attackers | Gives the vendor private time to fix it | Agents can rediscover the same flaw independently and cheaply |
| Patching is faster than rediscovery | The fix lands before anyone else finds the bug | Discovery rates rise with every frontier release |
| Turning a patch into an exploit takes time | Users can install the update before attacks start | Patch-to-exploit time has fallen from days or weeks to hours |
From years to hours
The third condition has collapsed, from days or weeks to hours. “We know that the time it takes to go from a disclosed vulnerability to an attack has decreased drastically,” Landolt says. “As the zerodayclock.com website showed at one point, in 2018 it still took about 2.3 years as opposed to only about 10 hours in 2026.”
The Zero Day Clock, a public scoreboard maintained by security researcher Sergej Epp, now tracks wider pressure too. For the first half of 2026 it counts 35,849 published vulnerabilities, 141 of which were already being exploited when they were published.
Those two figures, as Landolt quotes them, are worth putting side by side. 2.3 years is roughly 20,150 hours (2.3 × 365 × 24), so the gap he describes is a fall of about 2,000 times.
Why the decision moves upstream
If an AI model gives attackers the ability to find and weaponise flaws on their own, controlling when a vulnerability becomes public no longer protects anyone. The paper argues that the real decision now sits with the laboratories that build frontier models, because their release choices set the capability of both sides. That is the game theory shift at the heart of the work.
Inside The Oracle's Gambit: A Three-Player Game Theory Model
Most security game theory has two players: a defender who commits to a strategy and an attacker who responds. The Oracle’s Gambit adds a third player above them, the frontier AI lab, and makes it the leader.
The lab as Stackelberg leader
The structure is a Stackelberg game, a classic form of game theory in which one player commits first and the others react. Here the lab commits to a release policy. That policy sets how capable the defender and the attacker will be over time, which in turn shapes the contest between them.
The paper calls this a bilevel, three-player Stackelberg game. At the upper level the lab chooses. At the lower level, the defender and attacker play out a race over a set of vulnerabilities. The lab then picks the release policy that gives it the best payoff once that race has been solved.
Two pipelines racing over the same flaws
In the game theory model, the inner contest is a race. For each vulnerability, the defender must detect the flaw, build a patch, test it and ship it, after which protection grows only as users install the update. The attacker must detect the flaw, build an exploit and use it. It also has a second route: once a patch ships, it can reverse-engineer the fix by “diffing” the patched and unpatched code.
Detecting a flaw, building a patch or exploit, testing a patch and diffing a shipped fix each succeed with a probability set by the AI capability available to that player. Shipping a tested patch always succeeds, and users install it at a fixed rate that AI does not change. The authors describe five capabilities: discovery, exploit generation, reverse engineering, patch generation and patch testing. Discovery helps both sides; the other four belong to one side each.
| Stage | Defender (software vendor) | Attacker (cybercriminal) |
|---|---|---|
| 1 | Detect the vulnerability | Detect the vulnerability |
| 2 | Generate a patch | Generate an exploit, or, once a patch ships, diff it straight into an exploit (no detection needed) |
| 3 | Test the patch | Exploit, every round, until users patch |
| 4 | Ship the patch | (no further step needed) |
| 5 | Wait for users to install it | (no further step needed) |
Three ways to release a model
The lab’s only lever is a window, W, that decides how long the new model is withheld from the attacker. That produces three regimes. A public release gives both sides the new model at once. A pre-release gives the defender immediate access and the attacker access only after W rounds. An embargo withholds the model from both sides for the whole period.
| Release policy | Defender gets the new model | Attacker gets the new model | Capability gap |
|---|---|---|---|
| Public (W = 0) | Immediately | Immediately | None |
| Pre-release (W = 1 to T) | Immediately | After W rounds | Defender leads for W rounds |
| Embargo | Never in the window | Never in the window | None; both stay a generation behind |
What the lab is trying to maximise
The lab is not modelled as a pure altruist. Its payoff is the defender’s welfare minus a cost for every round it holds the model back, which stands in for lost market share. Landolt explains why the lab cares about welfare at all: “the frontier lab could suffer significant reputational damage if its models were used for malicious purposes.”
He also notes a difference from ordinary vendors. “With a frontier lab, however, the customer relationship is different, since the users of a software product are not necessarily customers of the frontier lab.” The game theory has to price that tension in, rather than assume the lab protects users by default.
Why the Defender Loses an Even Race
The most striking result of the game theory is that giving both sides better AI does not help the defender. The reason lies in the shape of the two pipelines.
The pipeline asymmetry
“The defender must not only ensure security but also availability,” Landolt says. “A vulnerability has to be detected, and a patch has to be built, tested and released. The attacker has it easier because they don’t care if they cause a system crash.”
In the game theory model, the expected time to finish a pipeline is the sum of the waits at each step. The attacker’s pipeline is shorter, so it reaches a working exploit before the defender reaches a shipped patch. Faster AI speeds up both pipelines, but it also moves the attacker into the damaging state sooner. And because patch adoption by users does not speed up with AI, an earlier attacker simply has more rounds to cause harm.
A shipped patch is an exploit blueprint
The game theory also captures a long-standing worry: publishing a fix tells attackers where the hole was. In the model, once the defender ships, the attacker can choose between weaponising its own discovery and diffing the patch. That makes releasing a patch a strategic choice, not a purely good deed.
The diffing route matters more than you might expect. With one vulnerability in play, it accounts for up to 21% of attacks at its peak; with two, that rises to 54%, because the attacker can diff a patch on one flaw while working on another. The route disappears only when users patch quickly. In the paper’s terms, it vanishes once fleet coverage grows at about 45% per round or faster.
The Red Queen result
Landolt describes the trap in plain words. “If attackers can be faster at discovering new vulnerabilities than users can be at updating their software, the system begins to oscillate,” he says. “The benefit of releasing a patch becomes negative, and the benefit of not releasing a patch also becomes negative. When we operate in this space, we’re in a pickle no matter what we do.”
The numbers in the paper show the same thing. When both sides get the same model, moving up the ladder from GPT-4o to Claude Mythos Preview raises the attack frequency from 0.27 to 0.34. Defender welfare barely moves, from −13.79 to −13.22. Both sides run faster, and the defender stays where it was. That is the Red Queen’s race, produced by game theory rather than metaphor.
Gap, not level
The paper’s central finding follows from this. “Defender welfare turns on the capability gap, not the shared level,” the authors write. Equal upgrades leave the structural disadvantage in place. Only a gap, with the defender on the newer model and the attacker a generation behind, lets the defender ship and start protecting users before the attacker is ready.
Calibrating the Game Theory With Real Frontier Models
A game theory model is only as useful as its numbers. The authors calibrate theirs against real remediation data and against five real frontier models, from GPT-4o to Claude Mythos Preview.
Rounds, horizon and patch adoption
Each round in the game theory model represents seven days. The authors take the software sector’s mean time to remediate, about 63 days according to Edgescan’s 2025 vulnerability statistics report, which equals nine rounds. That gives a patch adoption rate of about 0.11 per round, meaning full coverage after nine rounds.
The horizon covers one release window of 48 rounds, about 11 months. The number of vulnerabilities in play is kept small, at three or fewer, so the game can be solved exactly. Two cost settings, the lab’s cost of delay and the defender’s cost per action, are swept across ranges and set at 0.05 for the headline results.
An AI panel to estimate AI capability
The five capability rates cannot be measured directly, so the authors elicit them. They use a “Scalable Delphi” method developed by Lorenz and Fritz, in which a panel of language-model experts estimates values from shared evidence. The panel has five security personas: a defensive specialist, a malware reverse engineer, an AI security researcher, a threat-intelligence analyst and a compliance officer.
Each persona runs on GPT-5.1, so no rated model judges itself. The evidence base includes offensive benchmarks such as CyberGym, ExploitGym, BountyBench and Cybench, the UK AI Security Institute’s evaluations, defensive benchmarks such as SWE-bench, and the Zero Day Clock, plus each model’s own system card.
The capability ladder
The panel’s consensus estimates are below. Each figure is the chance that one pipeline step succeeds in one round. All five rates rise with each release, but the jump from Opus 4.6 to Mythos Preview is weighted towards offence.
| Model | Discovery | Exploit generation | Reverse engineering | Patch generation | Patch testing |
|---|---|---|---|---|---|
| GPT-4o | 0.07 | 0.04 | 0.06 | 0.09 | 0.12 |
| OpenAI o4-mini | 0.12 | 0.07 | 0.10 | 0.15 | 0.20 |
| Claude Opus 4.5 | 0.17 | 0.12 | 0.15 | 0.22 | 0.28 |
| Claude Opus 4.6 | 0.22 | 0.14 | 0.17 | 0.24 | 0.29 |
| Claude Mythos Preview | 0.31 | 0.26 | 0.29 | 0.31 | 0.37 |
The offence-weighted jump
Exploit generation shows the shift most clearly. It nearly doubles from Opus 4.6 to Mythos Preview, from 0.14 to 0.26, while patch testing rises only from 0.29 to 0.37. The chart scales each model’s exploit-generation rate against Mythos Preview, so Mythos = 100% and, for example, Opus 4.6 = 0.14 ÷ 0.26 ≈ 54%.
Which capabilities move the result
A sensitivity screen in the paper shows that patch testing and patch generation have the biggest effect on attack success and defender welfare. The defender’s longer pipeline is the binding constraint. On the offensive side exploit generation matters most, and reverse engineering matters least, because diffing and building an exploit from scratch act as near-substitutes at realistic patch speeds.
The Answer: A Pre-Release Window for Defenders
Having shown the trap, the game theory points to a way out. If the lab gives defenders the new model first, the defender works at the frontier while the attacker is a generation behind. That gap, not more raw capability, is what restores the head start.
What the gap is worth
In the calibrated model, opening a gap with Mythos Preview raises defender welfare from −13.22 to −9.47 and lowers the attack frequency from 0.34 to 0.26. Welfare in this model is a loss figure, so a smaller loss is better. The chart shows the expected loss under each scenario, with the GPT-4o public release as 100%.
The headline window: about 168 days
For the step from Opus 4.6 to Mythos Preview, solved with two vulnerabilities in play, the lab’s best choice is a pre-release window of 24 rounds. At seven days a round, that is about 168 days of exclusive defender access. Compared with a public release, it improves defender welfare by 3.48 and cuts attack frequency from 0.34 to 0.27.
Neither alternative opens a gap. A public release equips both sides at the frontier. An embargo holds both sides at the previous generation. In the game theory, only the timed pre-release beats both.
Robust across the uncertainty
Because the capability numbers come from an expert panel, they carry uncertainty. The authors test this by Monte Carlo simulation, drawing 150 random capability sets per model transition and re-solving the game theory model each time. A pre-release came out as the best decision in 80% to 95% of draws for every transition.
| Model transition | Pre-release optimal | Median window (rounds) | Welfare gain | Attacks averted |
|---|---|---|---|---|
| GPT-4o to o4-mini | 87.3% | 25 | +4.06 | 41% |
| o4-mini to Opus 4.5 | 85.3% | 19 | +2.94 | 32% |
| Opus 4.5 to Opus 4.6 | 80.0% | 11 | +1.31 | 14% |
| Opus 4.6 to Mythos Preview | 95.3% | 12 | +2.17 | 23% |
The Monte Carlo runs use a single vulnerability, which is why the median window for Mythos Preview is 12 rounds here rather than the 24 rounds of the two-vulnerability headline result. The share of attacks averted is plotted below, as a percentage reduction against public release.
The most offensive jump gives the clearest answer
The strongest case for a pre-release comes from the transition to Mythos Preview, where it was optimal in 95.3% of draws. That is the release whose gains are most heavily weighted towards discovery and exploit generation, the capabilities that help attackers most. The paper says its game theory model predicts gains from a pre-release for offence-weighted releases like this one. In the Monte Carlo runs, though, the size of the gain here (+2.17 welfare, 23% of attacks averted) is smaller than for the earliest model steps, so the clearest case is not the same as the biggest payoff.
Project Glasswing as a Real-World Test of the Game Theory
The paper does not have to imagine a pre-release. Anthropic ran one for exactly the transition the authors single out, which makes Project Glasswing a useful check on the game theory.
What Anthropic did
Anthropic announced Project Glasswing on 7 April 2026. It gave Claude Mythos Preview, an unreleased model, to a group of partners: Amazon Web Services, Apple, Broadcom, Cisco, CrowdStrike, Google, JPMorganChase, the Linux Foundation, Microsoft, NVIDIA and Palo Alto Networks. Access was extended to more than 40 further organisations that build or maintain critical software.
Anthropic committed up to $100 million in usage credits and $4 million in donations to open-source security groups. It said it did not plan to make Mythos Preview generally available. Its longer-term aim is to deploy Mythos-class models safely once it has safeguards that can detect and block their most dangerous outputs, which it planned to launch first with an upcoming Claude Opus model. We covered the launch in our guide to what Project Glasswing is and our explainer on what Claude Mythos is.
Mozilla’s 271 Firefox fixes
The clearest evidence of a defender head start came from Mozilla. In a post on 21 April 2026, Mozilla’s Bobby Holley wrote that Firefox 150 “includes fixes for 271 vulnerabilities identified during this initial evaluation” of an early version of Mythos Preview. An earlier scan with Opus 4.6 had led to fixes for 22 security-sensitive bugs in Firefox 148.
That is about 12 times as many fixes (271 ÷ 22 ≈ 12.3), shipped while access to the model was limited to selected defenders. In the language of the game theory, Mozilla used the window to ship patches and build coverage while the attacker was still a generation behind.
Why the model was held back
The UK AI Security Institute’s evaluation, published on 13 April 2026, shows why the jump worried people. Mythos Preview was the first model to complete “The Last Ones”, a 32-step simulated corporate network attack that AISI estimates would take a human expert about 20 hours. It solved the range end to end in three of ten attempts and averaged 22 of 32 steps, against 16 for Opus 4.6.
Where the model and reality differ
Glasswing is not a perfect match for the paper’s policy. The model gives the pre-release to “the defender” as a single player, while Anthropic chose a list of mainly US companies. As the Tech Xplore report puts it, Anthropic made the model “available to select U.S. tech companies only”. The paper’s proposal could apply to the whole AI industry, with a release window chosen by calculation rather than case by case.
The paper also prices a finite window, followed by public release. Glasswing has no published end date, and Anthropic has said it does not plan to make Mythos Preview generally available, though it aims to deploy Mythos-class models once new safeguards are in place. Viewed through the game theory, that sits closer to an extended pre-release than to an embargo, since defenders do have access.
Limits of the Game Theory Model
The authors are open about the simplifications they needed to make the game solvable. Anyone citing the 168-day figure should know what sits behind it.
Simplifying assumptions
The inner game of the game theory model assumes full observability, meaning the defender can see the attacker’s progress perfectly. That overstates the defender’s strength, so any protection the model reports comes from the capability gap rather than from information. The game is also zero-sum, which treats the attacker as a pure damage-maximiser and gives an upper bound on harm. Finally, a fixed horizon limits the analysis to one release cycle.
Calibration caveats
The lab’s cost of delay and the defender’s cost per action cannot be found in public data, so the authors sweep them and report the window as a function of cost. The capability rates are elicited by an AI panel, not measured. And the mapping from rounds to calendar days rests on sector-wide averages. In the authors’ words, “the framework identifies an optimal release strategy, not a precise duration.”
Two terabytes to solve one game
The computation is heavy. “If we take into account all possible interactions between the attacker and the defender, our game becomes too complex,” Landolt says, “so we had to resort to simplified solution algorithms and assumptions. And even with this simplified model, we still needed two terabytes of RAM just to be able to solve the game once.” That is why the number of vulnerabilities in the game stays at three or fewer.
What the authors want next
Landolt says the team built a model with an exact solution so the community could test it. “We couldn’t find any scientific literature that analyzes the impact of newly released AI models on cybersecurity,” he says. The paper names its own next step: mechanism design, because a lab weighing its private cost of delay may choose a shorter window than society would want. Other extensions include defenders that differ from one another, richer release instruments such as guardrails and performance throttling, repeated releases and competition between labs.
What Game Theory Means for UK Businesses That Run Software
Most UK organisations will never decide when a frontier model is released. But the game theory in this paper still says a lot about how to defend the systems they do control.
Patch speed is your lever
In the game theory model, the patch adoption rate does not depend on the AI release, and it is the one environment setting taken from real-world remediation data. It decides how long attackers can profit from a flaw. The diffing route all but disappears once coverage grows quickly. For a business, that means the time between a vendor shipping a fix and your fleet installing it matters more than ever. Regular vulnerability assessment helps you find which systems lag.
Treat every published patch as a disclosure
The game theory treats a shipped patch as a map for attackers, and Landolt’s 10-hour figure suggests they read it quickly. Earlier this year an AI tool claimed it weaponised a Chrome V8 patch in under a day, and Google has since moved Chrome to updates every two weeks. Assume exposure starts the moment a fix is public.
Test like an attacker would
If attackers have AI-assisted discovery, defenders need the same view of their own estate. Penetration testing that uses current tooling shows what an AI-equipped adversary is likely to find first. Pair it with a rehearsed incident response plan, because the model assumes some attacks will land before every patch does.
A practical checklist
The table below turns the game theory findings into actions an IT team can take now.
| Finding from the paper | What it means in practice | Action |
|---|---|---|
| Patch adoption speed is not helped by AI | Slow installs give attackers more rounds | Set and track a patch deadline for critical fixes |
| Shipped patches can be diffed into exploits | Exposure starts when the fix is published | Prioritise updates the day vendors release them |
| Equal AI upgrades favour attackers | New public models raise your risk | Review exposure after each major model launch |
| A head start for defenders cuts attacks | Early access programmes have real value | Ask key vendors whether they joined one |
Ask your vendors about early access
The paper’s policy only works if vendors use the window. When you buy software, it is reasonable to ask whether the supplier takes part in early-access security programmes and how fast it ships fixes. Building that into your AI strategy and supplier reviews applies the same game theory from the buyer’s side. For a view of how criminals are already using AI, see our report on AI guardrails failing to stop criminal hackers.
What to Watch Next for Game Theory and AI Security
The paper is a first attempt, and its authors want feedback. Several developments will show whether its game theory shapes real policy.
How the labs’ safety frameworks respond
The paper points out that OpenAI’s Preparedness Framework, Anthropic’s Responsible Scaling Policy and Google DeepMind’s Frontier Safety Framework all set thresholds for whether to deploy a model. None of them, the authors argue, governs how to time the release of a model that passes the threshold but still carries dual-use risk. Watch for frameworks that add release sequencing.
Whether early access becomes standard
Glasswing was a one-off decision for one model. If more labs adopt structured early access for defenders, the game theory suggests the window should be set by calculation, and that a head start for defenders is most clearly justified when the upgrade is weighted towards offence. A shared industry approach would also answer the question of which defenders qualify.
GameSec and the research community
GameSec 2026 runs from 26 to 28 October in Ann Arbor, and its proceedings will appear in Springer’s Lecture Notes in Computer Science. The paper is already available from CISPA under a CC BY 4.0 licence. Responses from other researchers, especially on the capability estimates, will show how far the 168-day figure can be trusted.
Frequently Asked Questions
What is the Red Queen’s race in cybersecurity?
It describes a situation where attackers and defenders both keep getting faster, so neither gains ground. The CISPA game theory paper shows that giving both sides the same AI model produces exactly this: attacks rise while defender welfare barely changes.
How does game theory improve cybersecurity?
Game theory models decisions that depend on an opponent’s response. In this paper it shows that a timed head start for defenders, rather than equal access to new AI, lowers attack frequency and improves defender welfare.
What is The Oracle’s Gambit?
It is a paper by Christoph Landolt, Tobias Lorenz, Marta Kwiatkowska and Mario Fritz, presented at GameSec 2026 on 26 October 2026. It models AI release as a three-player Stackelberg game between a frontier lab, a defender and an attacker.
What release window does the model recommend?
For the step from Claude Opus 4.6 to Claude Mythos Preview, the optimal pre-release window is 24 rounds, about 168 days. The authors stress this identifies a strategy rather than a precise duration.
Is Project Glasswing the same as the paper’s proposal?
It is similar. Glasswing gave Mythos Preview to selected defenders before any public release. The paper proposes a calculated, time-limited window that could apply across the AI industry.
What should businesses do now?
Patch faster, treat every published fix as a disclosure, test systems the way an AI-equipped attacker would, and ask suppliers whether they take part in early-access security programmes.
References
The Oracle’s Gambit: A Game-Theoretic Framework for Responsible AI Release (CISPA)
Running with the Red Queen: Using game theory to improve cybersecurity in the AI era (Tech Xplore)
Conference on Game Theory and AI for Security (GameSec 2026)
Project Glasswing: Securing critical software for the AI era (Anthropic)
Evaluating and mitigating the growing risk of LLM-discovered 0-days (Anthropic)
Our evaluation of Claude Mythos Preview’s cyber capabilities (AI Security Institute)
The zero-days are numbered (Mozilla)
Scalable Delphi: Large Language Models for Structured Risk Estimation (arXiv)
Stackelberg competition (Wikipedia)
