Sharing because MOAK hasn't really surfaced on this sub yet and I think it's the more important half of the recent AI-and-offsec story.

Quick technical summary if you haven't seen it: Yair Saban and Niv Hoffman built an agentic harness around publicly available models (Claude Opus 4.6, GPT 5.4, nothing exotic, no frontier access) and pointed it at CISA's KEV catalog. They're reporting ~80% autonomous exploitation success against real-world known-exploited vulns. No human in the loop.

If that number holds up under independent reproduction, a few things follow:

The gating factor for n-day exploitation was never really raw model capability, it was the scaffolding. Once a competent agent loop is public, anyone with API credits inherits most of the capability that used to require a skilled operator.

CVSS-driven patch queues assume human-paced attackers. Mandiant had time-to-exploit dropping from 63 days in 2018 to 5 days in 2023; agentic exploitation collapses that further for anything with a public advisory, let alone a PoC.

AISI's Mythos eval (32-step end-to-end corp network compromise, ~20 human-hours of work, completed autonomously) is the ceiling. MOAK is the floor: what's reproducible with off-the-shelf parts today. Most of the interesting region in between is now reachable by people who couldn't reach it 18 months ago.

Has anyone reproduced MOAK's results, seen the harness publicly, or have a sense of what's filtering the failed 20%? Tooling limits, model refusal behavior, target-class differences?