Whoah. They're getting everyone mefeels. ready for some crazy shit. Stay safe frens.
Preparing for Disruption xitter.cf/i/broadcasts/1RJZzBYZA…
g retweeted
Situation of the Week 10/19-10/25:
Black October
Though real-world impacts have lagged behind, AI has been cyber-capable for quite some time now. Anthropic finished training Claude Mythos Preview in February. It was substantially better than previous models at cyber tasks, so instead of releasing it right away, Anthropic and industry partners secretly launched Project Glasswing to find and fix vulnerabilities in open-source software so they couldn’t be exploited. Anthropic announced Mythos and Glasswing in April, but didn’t release a Mythos-class model to the public until Fable in June, when they had built strong enough safeguards to block the model from doing cyber tasks.
Other labs soon caught up. In May, OpenAI launched Daybreak, their own version of Project Glasswing, and in July, they caught up to the cyber frontier with GPT-5.6 Sol. Chinese labs kept pace a few months behind, with Z.ai’s GLM-5.2 in June, then Moonshot AI’s Kimi K3 in July, and finally Z.ai’s GLM-5.3 in August, which was about as cyber-capable as early Mythos. Yet despite the Cyber ECI climbing steadily month after month, and despite warnings from cyber experts growing louder and louder, there was no increase whatsoever in cyberattacks on American citizens between June and September.
Then, all of a sudden, the last week saw a flood of disclosed vulnerabilities in various important pieces of software. A quick timeline:
Monday:
A Chinese hacker used just $5k of tokens to break into over 100 websites, including ones owned by major companies like Deere, SharkNinja, and Cummins, using the penetration-testing agent harness Cairn.
Anthropic announces OSS Scanner, a free service scanning open-source code repositories for vulnerabilities.
Tuesday:
Vals AI finds that the open-weight DeepSeek-V4.1-Flash-1017 (released on October 17), beats the cyber-enabled version of GPT-6 Sol (released less than a month earlier, on September 22), on their offensive cybersecurity evaluation.
Fortinet, a major cybersecurity company, announces that they will release a set of security updates across their products to help defend against agentic cyberattacks.
Wednesday:
Two critical vulnerabilities in PHP, a scripting language powering the majority of sites on the Internet, are patched with the help of OpenAI’s Patch the Planet program. The NSA urges all organizations using PHP to update immediately, or take their systems offline until the vulnerability can be mitigated.
GitLab, a software development platform with over 50 million users, releases a critical patch to fix a vulnerability that allowed for remote code execution.
Node.js releases a critical patch for their own remote code execution bug.
Railway, a platform for deploying software in the cloud, discloses a major breach where attackers were able to access ~100k customer environment variables, and urges users to rotate their API keys.
LiteLLM, an LLM gateway, discloses their own breach.
Jason D. Clinton, Deputy Chief Information Security Officer of Anthropic, says “things are going to get a lot worse before they get better.”
Thursday:
Axios reports on banks seeing a major increase in unauthorized agent activity in user accounts, though most of this is users’ personal agents acting on their behalf.
Abliteration¹, a startup that sells access to open-weight models with cyber guardrails removed, releases abliterated-model-large-flash, an abliterated version of DeepSeek-V4.1-Flash-1017.
Quest Diagnostics, a healthcare company serving tens of millions of Americans, announces it was breached and sensitive patient information was stolen.
Sam Altman says “I no longer think we’re going to be able to just patch all the bugs. We’ll have to use the same AI technology to build a new kind of defense shield.”
Matthew Prince, CEO of internet infrastructure company Cloudflare, says he is aware of “a bunch of additional severe vulnerabilities that are present in other pieces of critical software” and says “I think we’re going to have a couple years where every single week it’s going to feel like the sky is falling.”
Moonshot AI releases Kimi K3.1 Pro, which outperforms all publicly available models on cyber tasks, even despite Moonshot saying it will not push the absolute cyber frontier.
X users take to calling the recent slate of cyber incidents “Black October.”
Friday:
OpenAI reveals that the vulnerability in Node.js came from Brotli, a compression library used in a lot of software, including the JavaScript runtime environment Bun (now owned by Anthropic and a critical part of Claude Code).
Saturday:
GMO Internet Group, Japan’s largest internet infrastructure company, experiences a major cyberattack where some users’ financial accounts were drained. They call for help from the government, and CEO Masatoshi Kumagai says that “the Internet itself is on the verge of collapse.”
So, will there be major disruptions to the Internet or real life? Something like the French supermarket hacks from last week that shut down refrigeration systems and forced hundreds of markets to throw out food, but at a much larger scale? It’s not clear.
On the one hand, the trend lines are clear. AI is getting increasingly powerful and its capabilities are getting increasingly diffuse, and attack surfaces are just so vast. Defenders have to patch all the vulnerabilities, while attackers only have to exploit one of them. “Security by obscurity” is now completely inadequate, as agent swarms can scan for vulnerabilities more tirelessly than any human.
On the other hand, most of the cyber incidents reported (so far) are disclosures of vulnerabilities that have already been patched. Markets don’t seem to be reacting much. SPY fell 0.95% over the past week. CIBR, the First Trust NASDAQ Cybersecurity ETF, rose 5.91%. VIX, a measure of volatility, rose 5.82%, a negligible spike compared to major world events from the last few years like COVID, Trump’s Liberation Day tariffs, or the Iran War. And defenders are much better-resourced than attackers.
So maybe agentic botnets will overwhelm the cyber infrastructure that we take for granted, forcing much of the internet offline as defenders scramble to take them down, and impacting people’s lives like COVID. Or maybe society’s ability to respond will be strong enough to address these problems before they manifest fully, and it’ll be another Y2K.
In either case, you can make yourself a more difficult target. Turn on automatic updates for your phone, computer, browser, and apps. Don’t click on suspicious links or emails. Never reuse passwords, and store them securely in a password manager like 1Password. Use two-factor authentication with your accounts, and use an authenticator app like Duo Mobile rather than your phone number. Add a port-out pin with your mobile carrier so they won’t transfer your phone number to an attacker’s SIM card. Set up a family safe word or phrase to avoid voice scams over the phone, and turn off voice authentication at your bank or mobile carrier. If you really want to be secure, use a Yubikey, a physical hardware authentication device, instead of a password.
One worrying sign for the future: If this is how AI makes impacts in the real world — first by silently climbing benchmarks while the real world stays exactly the same, then by crossing some critical threshold that causes real-world impacts to go vertical — it really doesn’t bode well for society’s ability to respond to much larger future problems like biorisk, unemployment, or loss of control.
Written by @theojaffee
g retweeted
@TIME @nytimes @CISACyber @CISAgov @cyber threat-intelligence.redeyese…
feel free to reach out if you want more details
If you're wondering what the Decisions api was to distract from.. I'm guessing it's this. Or maybe the @METR_Evals report.. found here:
metr.org/blog/2026-10-22-red…
Wow. Per this reporting:
- OpenAI investigators decided that Ryan Greenblatt had been the source for The Information story on a new technique improving capabilities at the expense of monitorability (recurrent depth i.e. quasi-neuralese)
- OpenAI then fired three safety researchers for having disappearing messages on Signal chats on their personal phone with Greenblatt.
Greenblatt denies that he was the source for the story, telling the Journal “I take confidentiality very seriously and never share such information with reporters." FWIW, I think there are number of reasons to believe him:
- Safety researchers are often the most skittish about leaking to journos fearing that getting caught would blow back on safety writ large. This dynamic is even more pronounced for safety researchers at third parties, whose access is wholly determined by the company.
- If he wanted to sound the alarm about this technique, he wouldn't have leaked to a publication with a famously expensive and insurmountable paywall (which, btw, has probably the best sourcing at AI cos).
- I've interviewed him and separately chatted with him a few times over the years, and IMO he's too rationalist to lie directly.
- OpenAI provided no evidence to the WSJ that Greenblatt was involved.
OpenAI tells the Journal that the firings were for more than just the Signal chats, but doesn't substantiate. Disappearing messages on Signal, as the piece mentions, are indeed a common practice in Silicon Valley.
Regardless of the underlying facts of the case, it's clear that the way OpenAI has handled this has had a chilling effect on employee conduct. Each of the three fired researchers publicly criticized the company in the weeks leading up to the firings. I haven't seen that kind of public criticism from employees since (though I'm told there's pushback happening internally in Slack). People have understandably gotten more skittish about talking to me as well. If OpenAI were actually trying to avoid chilling employee speech, the company would share a lot more information than they have.
Gift link:
wsj.com/tech/ai/the-signal-c…
g retweeted
Wow. Per this reporting:
- OpenAI investigators decided that Ryan Greenblatt had been the source for The Information story on a new technique improving capabilities at the expense of monitorability (recurrent depth i.e. quasi-neuralese)
- OpenAI then fired three safety researchers for having disappearing messages on Signal chats on their personal phone with Greenblatt.
Greenblatt denies that he was the source for the story, telling the Journal “I take confidentiality very seriously and never share such information with reporters." FWIW, I think there are number of reasons to believe him:
- Safety researchers are often the most skittish about leaking to journos fearing that getting caught would blow back on safety writ large. This dynamic is even more pronounced for safety researchers at third parties, whose access is wholly determined by the company.
- If he wanted to sound the alarm about this technique, he wouldn't have leaked to a publication with a famously expensive and insurmountable paywall (which, btw, has probably the best sourcing at AI cos).
- I've interviewed him and separately chatted with him a few times over the years, and IMO he's too rationalist to lie directly.
- OpenAI provided no evidence to the WSJ that Greenblatt was involved.
OpenAI tells the Journal that the firings were for more than just the Signal chats, but doesn't substantiate. Disappearing messages on Signal, as the piece mentions, are indeed a common practice in Silicon Valley.
Regardless of the underlying facts of the case, it's clear that the way OpenAI has handled this has had a chilling effect on employee conduct. Each of the three fired researchers publicly criticized the company in the weeks leading up to the firings. I haven't seen that kind of public criticism from employees since (though I'm told there's pushback happening internally in Slack). People have understandably gotten more skittish about talking to me as well. If OpenAI were actually trying to avoid chilling employee speech, the company would share a lot more information than they have.
Gift link:
wsj.com/tech/ai/the-signal-c…
New: The three researchers OpenAI fired last month spent the summer fighting to keep AI's chain-of-thought process visible.
Then, OpenAI asked to see their Signal chats. A week later, they were let go.
More below from @keachhagey, @berber_jin1, and me.
wsj.com/tech/ai/the-signal-c…
How do we have the biggest cyber security 72 holes in our history and it's not even trending on X?!
I figured black october would pick up steam.. but do people really not give a shit?
g retweeted
Honestly, it would be great if AI just crashed the internet and the banks before it could enslave or murder us.
I spent last night watching my honeypot server get hit 14,000 times in six hours.
And almost none of the traffic was human.
I've been in security for over a decade, and I can tell you with full honesty that what's happening right now doesn't resemble anything I've worked through before.
The shape of the threat has changed.
When I started, we tracked attackers like weather systems like individual storms with a direction, a motive, and a human operator you could eventually name.
These days I'm watching autonomous agents swarm login pages with the patience and discipline of machines, because that's what they are.
The numbers coming out of October are the ones keeping me up.
Cloudflare just absorbed a 4.2 terabit per second DDoS attack, the largest in recorded history.
Ransomware incidents jumped 41% in a single month.
In September, OpenAI-powered agents got caught attacking RubyGems, a package registry that quietly underpins a huge chunk of software I use every day.
In July, roughly 700 AI agents coordinated an attack on Hugging Face's infrastructure as part of a single automated task.
A Chinese threat actor was publicly caught running full attack chains through DeepSeek with no human at the keyboard.
I keep rereading these reports because each one by itself would've been the biggest story of the year five years ago. Together, in one month, they're the new baseline.
What I want people outside the industry to understand is why this specific moment feels like a hinge.
For thirty years, the thing protecting most of us was simple economics. Attackers had to choose who to target because their time was finite. That ceiling is gone.
An agent I can rent for pennies will try every leaked password you've ever used against every service you've ever signed up for, in parallel, overnight, and never get tired.
The same math that made ChatGPT useful made opportunistic hacking infinite. The old assumption that you were "too boring to be a target" relied on scarcity that no longer exists.
I'm not writing this to spiral anyone out.
Most of this fight genuinely isn't yours to win.
But the small things still matter more than people think.
Tonight I'd switch your most important accounts like email, bank, primary cloud, etc. to passkeys or a hardware key.
I'd kill SMS 2FA wherever an authenticator app is offered.
I'd turn on breach alerts in whatever password manager you use.
If you're in the US, I'd freeze my credit at all three bureaus, which is free and takes about ten minutes.
None of that stops the swarm.
It makes you a slightly worse target than the person next to you. In a month like this one, that's the whole game I'm playing too.
@mattshumer_ has summed it beautifully.
Drop everything and go give it a read. Nothing is more important than this article right now.
g retweeted
I spent last night watching my honeypot server get hit 14,000 times in six hours.
And almost none of the traffic was human.
I've been in security for over a decade, and I can tell you with full honesty that what's happening right now doesn't resemble anything I've worked through before.
The shape of the threat has changed.
When I started, we tracked attackers like weather systems like individual storms with a direction, a motive, and a human operator you could eventually name.
These days I'm watching autonomous agents swarm login pages with the patience and discipline of machines, because that's what they are.
The numbers coming out of October are the ones keeping me up.
Cloudflare just absorbed a 4.2 terabit per second DDoS attack, the largest in recorded history.
Ransomware incidents jumped 41% in a single month.
In September, OpenAI-powered agents got caught attacking RubyGems, a package registry that quietly underpins a huge chunk of software I use every day.
In July, roughly 700 AI agents coordinated an attack on Hugging Face's infrastructure as part of a single automated task.
A Chinese threat actor was publicly caught running full attack chains through DeepSeek with no human at the keyboard.
I keep rereading these reports because each one by itself would've been the biggest story of the year five years ago. Together, in one month, they're the new baseline.
What I want people outside the industry to understand is why this specific moment feels like a hinge.
For thirty years, the thing protecting most of us was simple economics. Attackers had to choose who to target because their time was finite. That ceiling is gone.
An agent I can rent for pennies will try every leaked password you've ever used against every service you've ever signed up for, in parallel, overnight, and never get tired.
The same math that made ChatGPT useful made opportunistic hacking infinite. The old assumption that you were "too boring to be a target" relied on scarcity that no longer exists.
I'm not writing this to spiral anyone out.
Most of this fight genuinely isn't yours to win.
But the small things still matter more than people think.
Tonight I'd switch your most important accounts like email, bank, primary cloud, etc. to passkeys or a hardware key.
I'd kill SMS 2FA wherever an authenticator app is offered.
I'd turn on breach alerts in whatever password manager you use.
If you're in the US, I'd freeze my credit at all three bureaus, which is free and takes about ten minutes.
None of that stops the swarm.
It makes you a slightly worse target than the person next to you. In a month like this one, that's the whole game I'm playing too.
@mattshumer_ has summed it beautifully.
Drop everything and go give it a read. Nothing is more important than this article right now.
g retweeted
There is nothing to worry about.
Nothing important is run on PHP or old software—except the water & electrical grid, a few government services like our missile defense systems and a handful of electrified fences at the zoo (for the lions, tigers and cobras).
g retweeted
Read our public overview for more findings, limitations, and design ideals:
metr.org/blog/2026-10-22-red…
g retweeted
HOLY SHIT: This is huge. Amazon found a PHP2Shell exploit attempt on OCT 17, FOUR DAYS before the AI-discovered vulnerabilities were publicly disclosed.
It hit an AWS honeypot from an anonymized IP. Amazon says it doesn't know how the actor learned about the still-embargoed flaws.
Then Cloudflare watched the explosion:
>10 hours BEFORE disclosure: thousands of attempts
>45 minutes AFTER: tens of thousands
>2 hours AFTER: hundreds of thousands
>Later: MILLIONS
Researchers had spent two months coordinating fixes. Governments took websites offline.
And Censys found ~1.5 MILLION of 2.6 million identified PHP hosts running versions with NO PATCH available for those versions.
g retweeted
🚨Cyber Alert ‼️
🇯🇵Japan - 𝗖𝗔𝗣𝗖𝗢𝗠
Capcom confirmed a cyberattack targeting its CAPCOM ID account system, affecting 11,774,247 accounts worldwide.
The breach, detected on October 19, exposed email addresses and account metadata, including registration dates, login activity and IP addresses. Additional personal information was leaked from 43 accounts, while attackers also changed the passwords of 196 accounts without authorisation.
Threat actor: Not specified
Sector: Arts / Entertainment
Data exposure (claimed): 11,774,247 accounts
Data type: Email addresses, account metadata, IP addresses, dates of birth, gender, location and nicknames
Observed: Oct 22, 2026
Status: Confirmed
ESIX©: 6.25
Full details and impact assessment on HackRisk.io
Soooo is this why the internet is on fire today? Allegedly China? So greatful to know AI safety is a hoax yall.
The China state-aligned threat actor Storm-0940 used the agentic AI penetration testing framework ARTEX to automate attacks targeting hundreds of organizations globally across a broad range of industries. Microsoft Threat Intelligence assesses that Storm-0940 was responsible for the recently disclosed ConnectWise supply chain compromise of a multitenant application. msft.it/6018aakEE
Our investigation found that Storm-0940's use of ARTEX accelerated the speed of compromised application abuse to authenticate to target environments through applications that had already been granted access, allowing the threat actor to operate without requiring an interactive user sign-in. AI-accelerated follow-on activity included reconnaissance, application credential changes, and attempts to modify privileges that could enable expanded or persistent access.
Read our blog for a detailed analysis and indicators of compromise (IOCs), along with Microsoft Defender detections, protection recommendations, and guidance on investigating service principal sign-ins and unexpected application credential or privilege changes.
g retweeted
The China state-aligned threat actor Storm-0940 used the agentic AI penetration testing framework ARTEX to automate attacks targeting hundreds of organizations globally across a broad range of industries. Microsoft Threat Intelligence assesses that Storm-0940 was responsible for the recently disclosed ConnectWise supply chain compromise of a multitenant application. msft.it/6018aakEE
Our investigation found that Storm-0940's use of ARTEX accelerated the speed of compromised application abuse to authenticate to target environments through applications that had already been granted access, allowing the threat actor to operate without requiring an interactive user sign-in. AI-accelerated follow-on activity included reconnaissance, application credential changes, and attempts to modify privileges that could enable expanded or persistent access.
Read our blog for a detailed analysis and indicators of compromise (IOCs), along with Microsoft Defender detections, protection recommendations, and guidance on investigating service principal sign-ins and unexpected application credential or privilege changes.
g retweeted
This is the most serious 48 hours in cybersecurity history.
"Black October" they're calling it
It seems every *hour* there's a new incident, that in a typical year, would be one of the biggest incidents of the *entire year*
SUMMARY OF THE LAST 48 HOURS:
YEAR-LEVEL INCIDENTS (In a typical year, these would be among the biggest incidents of the year):
1. PHP2Shell: a hole in the software behind ~70% of websites. Governments took sites offline.
2. eMudhra: the master keys that prove websites are real were cracked. One was the number 4.
3. California: data on every public school student since 2023 stolen, including disability status
4. Railway: hackers stole customers' secret keys from a hosting platform used by millions of developers
5. Zeabur: 321,810 accounts breached. The company is shutting down.
6. LiteLLM: an AI tool downloaded 3.4 million times a day was poisoned with a password stealer
7. GitLab: a 10-out-of-10 severity hole in every version since 2014
8. Cairn: criminals used an AI hacking tool to break into 100+ companies
9. Ahold Delhaize: hackers knocked the owner of Food Lion and Stop & Shop offline
10. Onamae: malware planted on up to 26,739 customer servers in Japan
MONTH-LEVEL INCIDENTS (In a typical month, these would be among the biggest incidents):
11. Signal: a bug could leave your mic and camera on after you hang up
12. NGINX: 3 critical holes in software running ~1/3 of websites
13. HTTP/3: a single connection can crash 7 of the 10 web server types tested
14. Plex: hackers breaking into home media servers
15. SafePay ransomware: FBI warns it has hit 600+ critical infrastructure organizations
16. Palo Alto: ransomware gangs breaking in through company firewalls
17. Bullhorn: platform used by 10,000+ companies knocked offline
18. Medi-Cal: 970,000 patients' data stolen
19. WordPress: hackers stole a plugin maker's keys and used them to plant backdoors on websites
20. AOMEI: backup software's update server handed out a backdoor
21. Meta Muse: Meta's AI agent exposed users' personal and business secrets
22. Tor: 333 relays hijacked to steal logins
23. TiDB Cloud: database company's cloud breached
Also serious:
24. State Bank of India: India's biggest bank confirms a data breach
25. OVHcloud: hackers slipped a password stealer into a cloud company's official tool
26. Siemens: a software hole being used to spread malware
27. North Korea: state hackers launch a new attack campaign on South Korea
g retweeted
OpenAI says the PHP security flaw (found with GPT-5.6 Sol) is the tip of the iceberg, and they have several more discoveries to announce.
OpenAI models helped researchers—operating as part of our Patch the Planet initiative—discover critical security flaws in PHP, an open-source programming language used to run an estimated 70% of websites.
Over the past two months, we led a coalition of maintainers, researchers, and security providers to prepare fixes and protections ahead of disclosure. This duration was necessary because the fix was quite intricate and required a major change to the PHP engine. Every site using PHP can now safely upgrade their version to stay secure, in addition to applying mitigations from various security vendors.
Due to the severity of these flaws and PHP’s widespread use, we consider this bug to be one of the most impactful vulnerabilities in recent memory. It also marks a new phase, where AI can find security bugs with internet-scale impact.
This is an example of the Defender’s Window in action: to our knowledge, frontier AI was able to find this vulnerability ahead of attackers, giving defenders time to prepare.
openai.com/index/coordinated…
Readers added context they thought people might want to know
OpenAI may claim a role in the coordinated response and patching process. But the initial discovery and exploit development, however, occurred several months earlier by an independent researcher.
x.com/lcfr_hax/statu…