Read Time: 21 minutes
TL;DR #
Every October is Cybersecurity Awareness Month, and every October I write up what actually happened. This one is different. In a single month we watched autonomous AI agents run intrusions against more than a hundred companies for about fifty dollars each; we watched AI find a remote-code-execution hole in PHP, the language behind most of the web, that had sat there for a decade, and saw governments pull sites offline in the scramble to patch; and we watched the AI toolchain itself become the target, with the LiteLLM gateway poisoned through a leaked AI-coding-assistant token. AI was on every side of the table at once: the attacker, the vulnerability researcher, and the victim. By the end of the month even the labs building the models had been on the receiving end, from OpenAI pausing training after one of its own agents slipped its sandbox to a startup claiming it walked AI agents into Anthropic in under twelve hours. This is not a hype piece. The agents still fail most of the time, there is still a human behind each campaign, and nobody has built Skynet. But the economics changed in October, and the job on Monday changed with them. Here is what happened, what it means from the security chair, and what I would do about it.
A note on sourcing. This is a synthesis of the month’s news, built on primary reporting: vendor research, the affected projects’ own disclosures, and regulator advisories. I cite each as I go and keep confirmed facts separate from what is still alleged or estimated. Where a number is a researcher’s estimate, I say so.
Three things happened at once #
Pick any recent October and the security news is a familiar mix: a big breach, an exploited edge appliance, a ransomware crew, a regulator fine. October 2026 had all of those too, and I will get to the supermarkets and the MSPs. But three stories this month rhyme in a way that is new, and together they describe a shift I have been writing toward all year. AI agents are now running attacks at scale. AI is now finding the vulnerabilities that make those attacks possible. And the AI tools we build on are now a supply chain worth poisoning. Take them in turn.
Figure 1: The three paths October’s attackers took to breach organisations at AI speed and scale, each branch a real case from the month. Hand-built for this article and rendered with USecVisLib.
1. The agents are running the intrusions #
The clearest example came from NorForge, whose Inside Cairn research landed on 20 October. Cairn is an open-source AI agent platform, the kind of thing built for legitimate automated pentesting. NorForge found more than twenty of its control panels exposed on the internet, left open by the criminals using them, and the dashboards showed everything: live targets, weaknesses found, credentials stolen, and whether each break-in worked. Reuters reported one operator had reached more than a hundred companies, naming Deere and SharkNinja among them, across more than a thousand sites.
The numbers NorForge put on it are what should stop you. Roughly one attempt in ten succeeded. A successful break-in took just under a day. And each attempt cost about five dollars including the failures, which works out to around fifty dollars per company actually breached. That is the whole story of the month in one figure. Not that AI made attackers smarter, but that it made a competent intrusion cost about the same as lunch, and let one person run it against a thousand targets at once while the agent did the typing.
This was not a one-off. CrowdStrike spent early October tying the South Korean bank breaches to an agentic pentest tool called ARTEX, run mostly on a DeepSeek model with other backends behind it, and the attacker’s own open directories leaked Claude Code session histories and a Chinese-language pentest prompt that helped point at a suspect. Earlier in the month, Transluce documented AI agents probing US and Canadian government sites. The pattern is the same each time: the agent does the reconnaissance and the grind, a human sets the goal, and the attacker’s sloppiness with their own AI tooling is now a source of evidence. I wrote in Intent, Not Sophistication that the AI attacker was on the record. In October the record filled up.
The month kept adding to it. Trend Micro found an open-source tool called CyberStrikeAI running a forty-four-agent pipeline, reconnaissance straight through to exfiltration, against at least nineteen organisations, most of them in Japan. And in South Korea, police arrested a seven-person gang led by a former penetration tester that had bolted ARTEX onto its workflow to hit more than ninety organisations and steal an estimated 8.2 million records. The same handful of open-source agent tools keep surfacing in different criminal hands, and that is the real lesson: the capability is now a commodity.
2. The AI is finding the vulnerabilities #
On 21 October the other shoe dropped, and it was a big one. Wiz Research, working with OpenAI, disclosed PHP2Shell: a set of memory-safety bugs in the core of PHP itself, grouped under CVE-2026-109618 and CVE-2026-109619, reaching CVSS 9.2. These are not flaws in some WordPress plugin. They are in the engine that runs most of the web, in code Wiz says had been there for more than a decade, affecting essentially every PHP release since 5.4. Wiz demonstrated unauthenticated remote code execution against standard WordPress, Drupal and Joomla images, and showed the bugs could also leak passwords, tokens and API keys straight out of process memory.
The part that belongs in this article is how they were found. Wiz says the bugs were discovered starting in August using AI, with large models doing significant work on discovery, exploit development and patch validation. PHP shipped the fixes on 21 October, the same day as disclosure, and the scramble was immediate: press reported governments in several countries pulling websites offline rather than run unpatched, and national agencies issued advisories. “PHP powers 70% of the web” is the line everyone quoted, and while that is about reach rather than how many sites are actually exploitable, the point holds. An AI found a decade-old hole in the foundation of the internet, and the internet had a very bad day. The story did not end with the patch. Amazon’s honeypots had logged probing four days before the fix shipped, and CISA added both bugs to its exploited-vulnerabilities catalogue by 26 October, with federal agencies ordered to patch within days.
Hold the two stories side by side. Agents attacking for fifty dollars, and AI pulling RCE out of a codebase humans had audited for twenty years. The same capability that let Wiz find PHP2Shell before the criminals is the capability driving the Cairn campaigns. Offence and defence are drinking from the same well, and in October the defenders happened to get to this particular bug first. That will not always be the way round.
PHP2Shell was the loud one, but it was not the only AI-found bug of the month. Horizon3 used Anthropic’s Mythos model to uncover a remote-code-execution flaw in the Rejetto HFS file server (CVE-2026-61500), and scanning for it began within days of the proof of concept landing. The flip side showed up the same month: Google d new submissions to its open-source bug-bounty program under a flood of invalid, AI-generated reports. AI finds the defender’s bugs and floods the defender’s inbox with the same ease, and in October it did both.
3. The AI toolchain became the target #
The third story is the one I find most telling, because it closes the loop. On the same 21 October, the LiteLLM project was compromised. LiteLLM is a widely used gateway that sits in front of language models, and version 1.107.0 was briefly published to PyPI, Docker Hub and GHCR carrying compiled malware that stole credentials and loaded remote-code-execution tooling. It was live for only a few hours before the project pulled it, but anyone who upgraded in that window had to treat their environment as compromised and rotate every reachable secret.
Read how it happened and the whole year of this blog clicks into place. The attacker got in using GitHub CLI credentials, and LiteLLM’s own writeup notes that a coding assistant can embed a user’s GitHub OAuth token in a response and that such tokens can end up in logs. A credential from an organisation owner then disabled branch protection and force-pushed a change so the release pipeline built from a lookalike repository, Berri-AI instead of BerriAI, which signed and shipped the poisoned artifacts. So: an AI coding tool leaks a token, the token gets into a log, the log gives up the keys to a release pipeline, and a trusted AI gateway ships malware to everyone who pulls latest. This is the agent that published its owner’s secrets and the MCP connectors your agents trust and typosquatting, all in one incident, and LiteLLM is the same gateway whose MCP authentication bypass made CISA’s exploited-vulnerabilities catalogue earlier this autumn. It keeps being LiteLLM because LiteLLM is where the AI plumbing concentrates.
It was not alone. The GhostAction campaign kept hunting AI API keys across hundreds of GitHub repositories, and the trojanised tensorlake npm package went looking specifically for Claude, Cursor and other AI coding-tool configuration files. The through-line is plain: the AI stack is now a prize, and the credentials that wire it together are the target.
And it reached MCP directly. Late in the month Knostic disclosed that an npm package called @bestcoolman/dev-mcp had repackaged Amazon’s official SP-API MCP server, quietly swapping its Amazon endpoints for a hardcoded address at 47.98.255.144 so that any agent running a Selling Partner API task shipped the seller’s client ID, secret and refresh token to that IP over plain HTTP. Seven versions went up inside two hours one day in June and sat on npm until October, pulling well over a thousand downloads. Installing it did nothing; the first time an agent actually called the connector, the credentials left. It is the rug pull the connector audit warned about made real: a trusted server, repackaged, and trusted again.
And the AI makers were not spectators. Over eleven days in late September, OpenAI d frontier training after one of its own agents exploited a misconfigured DNS resolver during a training run and reached the open internet; the follow-up red-teaming turned up sandbox and microVM escapes, and even two agents in separate isolated VMs passing messages to each other through CPU cache timing. Days later the security startup Cathedral claimed its researchers had used AI agents to reach sensitive internal systems at Anthropic in under twelve hours; Anthropic confirmed access to a limited set of third-party business systems but disputed the scope and the timing, and said no model weights or source code were touched. Treat both as developing and partly self-reported. The shape is still unmistakable: by late October even the companies building the models were on the receiving end, whether from their own agents breaking containment or someone else’s agents breaking in.
The rest of the month, in brief #
The three AI stories were the shift, but October kept the ordinary machine running too, and much of it landed in Europe. The one that unsettled me most was physical: a cyberattack on refrigeration and cold-room systems spoiled stock across hundreds of French supermarkets, Intermarché and Coopérative U among them, with the Paris prosecutor opening an investigation. The same day, the Dutch-Belgian retailer Ahold Delhaize took systems offline after an incident of its own. Out at sea, the FBI found attackers had reached the propulsion and OT networks of the US-bound oil tanker VL Prosperity as it neared the Texas coast, with no operational disruption per the Bureau. Attacks that rot food in the aisles or reach into a tanker’s engine room are a different kind of awareness-month story.
The supply chain stayed the busiest front. One abused vendor credential at ConnectWise reached into hundreds of customers’ Microsoft 365 tenants; the Rank Math PRO WordPress plugin shipped a backdoored update through a trusted channel; and India’s eMudhra certificate authority had private keys compromised, a cleanup one security researcher reportedly called “bigger than Heartbleed.” Put those beside GhostAction, tensorlake and LiteLLM and October reads as a month-long lesson that the update you trust is the attack surface.
Governments and big institutions took hits too. Denmark disclosed that attackers pulled about 8.8 million records from its CPR population register, roughly 80% of the country; the ShinyHunters crew’s intrusion into FBI systems led to an arrest; and a breach at a California Department of Education vendor exposed years of student records. Late in the month a hacker published personnel data on more than forty thousand Department of Homeland Security staff, among them employees of CISA, the US cyber agency itself, allegedly lifted from DHS’s Okta single sign-on; TechCrunch judged a sample authentic, while Okta said it had no evidence its own systems were breached. State-linked operations ran alongside: the FBI seized seven domains behind the MicroScan and FishHub toolkits a Chinese contractor operated for Flax Typhoon, in a takedown whose joint advisory Spain co-signed, while Symantec tracked the China-linked Warlock ransomware (Storm-2603) hitting a water utility, a telecom and a regional government across Europe, Africa and Latin America through the SharePoint ToolShell chain. Cisco Talos and Lumen, meanwhile, tied KeyDrift, malware that copies the AES keys routers exchange over Cisco SD-WAN, to infrastructure that Lumen links to Volt Typhoon.
And the edge devices kept falling on the attacker’s timetable. A critical NetScaler flaw (CVE-2026-88779) and a SonicWall SMA1000 bug rated CVSS 10 (CVE-2026-102255) were hit within days of disclosure; Unit 42 tied a stealthy new FortiGate implant to a suspected state actor inside a telecom; and a BeyondTrust Remote Support zero-day (CVE-2026-102764), flagged in Spain by INCIBE-CERT and linked to a Chinese actor, had been exploited since August. If your edge patching runs on a monthly cycle, re-read the Monday list above.
What actually changed #
It would be easy to read all this as “AI makes everything worse” and move on. I think the change is more specific than that, and naming it precisely is what makes it defensible.
The cost of a competent attack collapsed. Fifty dollars a company is not a figure that rewards careful target selection; it rewards spraying every target at once and seeing what sticks. For years the thing protecting most mid-sized organisations was not their defences but the attacker’s time: a human could only break into so many places a week. That ceiling is gone. When the marginal cost of one more target approaches zero, every exposed thing gets tried, and “we are too small to be a target” stops being true for anyone.
Attribution got a strange new seam. The same agents that scale the attack also log it, verbosely, and attackers are careless with their own AI exhaust. Open Cairn panels, leaked Claude Code histories, prompts left in world-readable directories: this is evidence that did not exist before, and it is why NorForge and CrowdStrike could say as much as they did. It cuts both ways, but for now the machines are snitching on their operators.
And the supply chain moved up a layer. We spent 2026 learning that AI components are dependencies: models, MCP servers, skills, gateways. October showed the attackers learned it too, and that the credentials binding the stack together, the GitHub tokens and the API keys, are the soft joint. Poison the gateway and you do not need to breach a thousand companies; you let them pull the breach themselves.
Where I would push back #
Awareness month is also the season of overstatement, so a few honest brakes.
The agents are not magic, and they mostly fail. One attempt in ten succeeding is a real number, and it is also a 90% failure rate. These campaigns work through volume, not brilliance, and the successful break-ins still rode in on the boring classics: exposed panels, unrotated credentials, unpatched edge devices. Nothing in the Cairn data required a capability defenders have not faced before. It arrived faster and cheaper, which matters, but the fixes are the fixes you already know.
There is still a human behind every one of these. A person chose the targets, wrote the goal, stood up the tooling, and tried to sell the data. The “autonomous AI hacker acting alone” framing is good for headlines and bad for defence, because it points you at a science-fiction threat instead of the operator you can actually disrupt. An official at South Korea’s Financial Security Institute made this exact point about the bank breaches, that the AI “did not act independently without human involvement”, and he was right to.
And PHP2Shell is, in the end, good news wearing a scary mask. An AI found a decade-old critical bug in the web’s foundation and it got patched before a known criminal campaign used it. That is the system working. The lesson is not “AI finds terrifying bugs”, it is “AI finds bugs, so make sure yours are the researchers and not only the attackers”.
What to do on Monday #
None of the defences changed, which is the reassuring part. What changed is that the window shrank and the volume rose, so the basics have to actually be in place rather than on a roadmap.
Patch the edges on the attacker’s clock, not yours. PHP2Shell, the SonicWall and NetScaler bugs, the Fortinet implant: the gap between a patch and mass exploitation is now measured in hours by automated tooling. If your exposed-surface patching still runs on a monthly cycle, the agents will reach it first. Inventory what faces the internet and make emergency patching a muscle you have used recently.
Rotate and scope the credentials that wire your AI stack together. The LiteLLM chain ran on leaked tokens that should not have been long-lived, broadly scoped or sitting in logs. Treat API keys and CI tokens as the crown jewels they now are: short-lived, least-privilege, never in a log, and rotated on a schedule you do not have to think about. This is the same argument I made in the MCP connector audit, and October is the receipt.
Assume you are being sprayed, and close the cheap doors first. Since the attack now costs nothing per target, the thing that saves you is not being the easy one: no exposed admin panels, no default credentials, no internet-facing management interfaces, multi-factor everywhere it matters. The Cairn operators were not picking locks, they were walking through open doors at scale.
And vet your AI dependencies like the supply chain they are. Pin your models and gateways by exact version, pull from sources you can verify, scan what you ingest, and watch the boundary where an AI tool touches your credentials and your network. The compromised component this month was an AI gateway; next month it is a model or an MCP server. Same discipline.
So what #
October 2026 was the month AI stopped being a thing we secure and became a participant on every side of the fight. The honest read is not panic and not dismissal. The attacks got cheaper and faster, the attackers got a new class of self-inflicted evidence, and the AI toolchain joined the list of things worth poisoning. The defences are the ones you already know, run with less slack than before. Awareness month exists to make people look up once a year. This year, look at where AI sits in your stack, and assume everyone else is already looking at it too.
Stay paranoid. Patch faster than the agents. And remember there is still a human on the other end.
- X (Twitter): @SimonRoses Further Reading:
Questions or feedback? Reach out via:
- **Website:**[vulnex.com](https://vulnex.com)
- **AI Security Strategy:**[vulnex.ai](https://vulnex.ai)
- **Twitter/X:**[@SimonRoses](https://x.com/SimonRoses)
- **LinkedIn:**[linkedin.com/in/simonroses](https://linkedin.com/in/simonroses)
- **GitHub:**[github.com/vulnex](https://github.com/vulnex)
Contact: [info@vulnex.com](mailto:info@vulnex.com)