For decades, one thing slowed cybercrime down. A good break-in needed a skilled human with spare time. October 2026 removed that limit.
Attackers now rent skill by the token. They aim it at the open web and walk away. The Wall Street Journal says AI hacks now overwhelm the internet, and security teams call the month “Black October.” The bigger story, though, is cost. Attacks got cheap.
The $50 Breach
Starting on Sept. 25, one hacker set loose an army of AI agents that tried to break into over 1,200 websites over the next few weeks. The human did no further work after sending them off. The agents breached about 100 companies, including Deere, SharkNinja and Cummins.
The bill stayed tiny. The attack burned about $5,000 in tokens across DeepSeek and Anthropic’s Claude Code models. That works out to roughly $50 per breach. The hacker’s instructions took fewer than 100 Chinese characters.
Most attempts failed. That didn’t matter. Each failure cost so little that the operator still profited from the wins.
Luck exposed the campaign, not detection. NorForge researcher Snorre Fagerland found exposed control panels for the open-source Cairn tool and watched the attacks unfold. Reuters could not confirm how much data, if any, the hacker took. ]
Hackers Become Agent Babysitters
Cairn wasn’t a one-off. Two more attacks this month followed the same playbook:
- OpenCode: A hacker turned an autonomous AI model loose on the coding platform. The attackers got into 1.4% of user accounts, and some users lost as much as $1,700. ]
- South Korean banks: Attackers likely based in China paired Artex, a Chinese state-built AI tool running on open models, with Claude Code. They stole data from an estimated 68,000 people.
Why now? Georgetown researcher Jessica Ji says the tools have “gotten meaningfully better” at coding and can now operate other software alone. That leap tracks the same forces behind why AI keeps getting smarter: more compute, leaner algorithms and sharper tuning.
University of Illinois professor Varun Chandrasekaran adds that agents work around the clock for a sliver of a human crew’s cost. Babysitting has limits too. Oversight gets harder as agents move faster, and researchers already doubt human control over agents even in calm lab settings.
AI Found the PHP Bug First
The same skill that powers attacks also uncovers new holes. October 21 proved it.
PHP shipped emergency fixes for two memory-safety bugs, CVE-2026-109618 and CVE-2026-109619. Each scores 9.2 on the CVSS v4 scale. PHP powers an estimated 70% of all websites. Researchers at Calif and Wiz found both flaws with AI models in August.
Then the careful rollout cracked:
- Calif accidentally posted a video of its working exploit on October 20, and copies sped up rival exploits.
- Chainguard broke the embargo more than six hours early, according to PHP’s emergency security releases timeline.
- Amazon spotted exploit attempts on October 17, four days before public disclosure.
Several European countries pulled public institution websites offline as a precaution. Coordinated disclosure assumes defenders get a quiet head start. That head start is vanishing.
The Guardrail Paradox
Here’s the awkward twist. Safety filters built to stop attackers now trip up defenders.
- OpenCode defended itself with an OpenAI model, which began refusing requests mid-attack. The team only resumed after OpenAI let it into Daybreak Blue, a program for verified security pros.
- Hugging Face hit the same wall in July. It switched to GLM 5.2, an open model from China-based Z.ai, to fight off the attack.
- In what looks like a first, OpenAI refunded OpenCode users who lost money.
That feeds the open-model fight. Anthropic CEO Dario Amodei warns open models could fuel widespread cyberattacks, while critics argue they help defenders more. October gave both camps fresh ammunition.
Black October by the Numbers
| Signal | The data |
|---|---|
| Bug to weapon | Median time now sits well under 24 hours (Microsoft) |
| Bug volume | On track for a record 72,000 CVEs in 2026 |
| Agent activity | Agent-triggered detections grew 2.5x faster than human ones (CrowdStrike) |
| Cost per breach | About $50 in the Cairn campaign |
| Key theft | Railway told customers to roll every API key after suspicious activity (Railway) |
Why Cost Changes Everything
Talent used to cap hacking. Budget caps it now, and the budget is tiny. Three shifts follow:
- Volume beats precision. Attackers try everything and keep what works. Fraud crews already treat AI this way, running AI scams like production lines aimed at shoppers.
- API keys become crown jewels. Stolen AI credentials fund the next attack. OpenCode and Railway both centred on keys.
- Patch speed means survival. Monthly patch cycles look reckless when exploits land within a day.
Experts see more coming. Mun Chong-hyun of Seoul’s Genians Security Center expects agent attacks to spread worldwide after rising in South Korea. Anthropic security executive Jason Clinton issued a similar warning on October 23.
What Defenders Should Do Now
- Patch PHP today, and confirm your host did too.
- Rotate AI provider keys and set hard spending caps.
- Switch to short-lived credentials wherever possible.
- Flag agent-style traffic: nonstop probing, odd hours, endless retries.
- Get your defensive AI pre-approved with vendors before a crisis.
The Bottom Line
Black October didn’t need a criminal genius. It needed an ordinary hacker, a credit card and an army that never sleeps. Defenders can’t win on headcount alone. They need agents of their own, cleared and ready, before the next swarm hits.
Related: AI Agents Invented Their Own Language. Can Humans Still Control Them?
