I generally agree with this with the caveats that: (1) these models are probably primarily being used for vuln research and 1.Xing the productivity of junior operators executing clandestine CNE operations today; (2) threat actors probably haven't updated their mission management/risk models to permit noisy CNE at scale yet but we should expect the same within 1 year; and (3) if these models demonstrate capability in crypanalytic exploitation or even making current methods/HPC clusters substantially more efficient, that would be a potentially catastrophic phase change. But yes, the case for "catastrophic cyber risk" is relatively weak *today* where loss-of-control risks are also weak. The most sensitive data are already hosted in airgapped networks and protected by DLP systems/monitoring of exfil paths. Cybercrime and military cyberattacks are not that remunerative for attackers, and states have incentives to preserve this activity as a nuisance rather than invitation for reprisal.