Pretty sure I've read somewhere in the HBGary email leaks about a company that bought and developed exploits and sold them to the government.