By now, it is clear that AI has industrialized vulnerability discovery, and I’ve spent a good chunk of this year covering it, from frontier models finding bugs in long-audited codebases to vendor patch cycles hitting record volumes. Through most of that coverage, though, one stubborn data point kept showing up, which is that exploitation rates stayed relatively flat even as discovery took off.
That said, the last week or so has made that data point feel a lot less comfortable. On October 19th, former NSA Cybersecurity Director Rob Joyce posted on X that the “Transition from vulpocalypse to breachpocalypse is here,” pointing to a Chinese-speaking hacker who used AI agents to break into more than 100 company websites for roughly $50 a hack.
Transition from vulpocalypse to breachpocalypse is here.
Rob Joyce, former NSA Cybersecurity Director
Over the same few weeks we saw AI-assisted attacks on Latin American and South Korean financial institutions, Microsoft attributing a ConnectWise supply chain compromise to a China-aligned actor running an agentic AI framework, and a run of critical, decades-old vulnerabilities in some of the most widely deployed software on the internet. By October 22nd a good portion of X had started calling it “Black October.”
In this article, I want to walk through what happened this month, lay out the data from both the skeptics and those who think the breach wave is already here, and then explain why I think the answer to “who is right” matters less than what security does next.
So, let’s walk through it!
Black October
The label took off quickly, going from 137 posts on X on October 21st to 9,717 the next day, and CNBC ran it in a headline the following morning.
I want to be upfront that I’m not sure I agree with the Black October framing, at least in the way it is being used. We are clearly seeing highly impactful vulnerabilities, disclosures and findings in software that sits underneath a huge share of the internet, and that deserves attention.
So far, though, actual exploitation remains fairly limited when you measure it by real-world disruption and impact, and we haven’t yet seen many of the critical institutions and services that citizens depend on every day disrupted. Ciaran Martin, the founding head of the UK’s National Cyber Security Centre, captured this well in a LinkedIn post this week, asking what the reaction will be if something very bad but “entirely precedented” actually happens, such as NotPetya, WannaCry or the ransomware crisis of 2021, when a major vulnerability alert, weak private keys in India and some data breaches are already being called Black October. I think that is the right question to keep in mind, and it’s why I’d rather save the alarm for when it is warranted.
With that caveat, the cluster is still worth understanding. The centerpiece was PHP2Shell, a pair of unauthenticated remote code execution flaws affecting PHP versions back to 2012, found with help from GPT-5.6 Sol through OpenAI’s Patch the Planet effort and independently by Wiz, and AWS observed an exploitation attempt in its honeypots four days before disclosure. GitLab patched a CVSS 10.0 flaw present since 2014 that traces back to Onigmo, the regex engine built into Ruby, while Node2Shell, a Brotli decoder bug in Node.js found by OpenAI’s Codex Security team, dates to 2018.
On the supply chain side, LiteLLM shipped a malicious, credential-stealing release on October 21st after a master key accidentally committed to a public repository in May was never revoked. I covered the PHP2Shell arc in more depth in The Resilient Brief #119.
Anthropic Deputy CISO Jason Clinton, wrote on October 22nd that things “are going to get a lot worse before they get better,” urging security leaders to go to their boards for help with the basics rather than with AI, and to hold on for roughly 18 months.
...going to get a lot worse before they get better.
Jason Clinton, Anthropic Deputy CISO
When someone asked what changes after that, he replied “vulnzero,” predicting that small, cheap models will let all software development “stop shipping security bugs permanently.” Jason is an incredible security leader for our community and I mean no disrespect, but I have a hard time agreeing with that part of his prediction, for reasons I’ll come back to below.
The Debt Comes Due
When I joined Fox Business last week, I framed AI as a security debt collector, cashing in on decades of vulnerabilities, misconfigurations, and poor hygiene that we as an industry never got around to fixing, which I wrote about in Newsletter #118 and came back to in #119.
Whatever we end up calling this month, it is a good picture of what it looks like when the collector starts knocking on the door.
Look at the ages of the bugs. PHP code paths going back to 2012, a GitLab flaw present since 2014 and a Brotli line written in 2018 all surfaced in the same few weeks, after surviving years of human review and plenty of scanning, and the LiteLLM key sat unrevoked for five months.
What AI changed is the cost of finding them, and in several cases of exploiting them, at the same moment our ability to remediate stayed roughly where it was.
This lines up with conversations I’ve been having all year, starting with Sergej Epp walking me through the Zero Day Clock back in March. When caseyjohnellis came back on the show in July for Slopdemic, Not Vulnpocalypse (Yet), he argued that “the vulnpocalypse was already here, it just sort of wasn’t evenly distributed,” and that what AI changed was the economics of discovery.
That is the debt collector framing in a sentence, and it is also why I keep pointing to fix rates, like Glasswing finding 26,153 vulnerabilities with just 202 fixed, or 0.8%, which I walked through in The Remediation Receipts.
The vulnpocalypse was already here, it just sort of wasn’t evenly distributed.
Casey Ellis, Bugcrowd founder
So the question this article is really asking is whether that debt is now being collected through breaches as well as disclosures.
The Vulnpocalypse That Wasn’t (Yet)
The strongest case for the skeptics comes from Root Evidence’s Vulnpocalypse Report, which looked at every CVE published from 2018 through mid-July 2026. Of 253,912 CVEs, only 3,769 had confirmed exploitation, or 1.48%, and in every complete year the share of exploited CVEs stayed below 2.2%, even as annual CVE volume grew 2.5 times.
Root Evidence also found that for n-days first exploited in 2026, attackers waited a median of 116 days from patch availability to first exploitation, up from 24 days in 2018, though the distribution is bimodal, with 33.5% exploited within 30 days of a patch.
In a recent conversation, Root Evidence CEO Jeremiah Grossman told me he tracked new KEVs per month using VulnCheck’s data as a public ground truth and found them flat, and that across the cyber insurance claims data he sees, he can only tie roughly 600 CVEs to financial loss, with “no spike” so far.
He was candid that claims data may be a lagging indicator, and if exploitation and losses do climb, he expects AI will be the cause.
Google Threat Intelligence Group (GTIG) research looks different on the surface. Monthly disclosures doubled from 5,045 in January 2026 to 10,740 in August, and exploitation rose from an average of 10.5 vulnerabilities per month in 2025 to 18 per month in 2026.
Yet only 0.23% of 2026 disclosures were observed in active exploitation, and since May exploitation growth has closely tracked disclosure growth rather than outpacing it. Put Root Evidence and GTIG side by side and both can be true at once, since the share of vulnerabilities exploited is flat while the absolute count is climbing because the pool itself doubled.
Neither dataset covers October yet.
Breaches Without CVEs
The incidents from the last couple of weeks are where I think the conversation needs to shift, because most of them would barely register in KEV-style data at all.
Start with the campaign Rob pointed to. NorForge researcher Snorre Fagerland found more than 20 exposed panels of Cairn, an open-source AI agent platform, being used for malicious activity, and his write-up describes a Chinese-language operator running over 1,100 attack projects hunting for unauthenticated remote code execution through SQL injection, deserialization and similar web application flaws, with success rates around 10%.
Reuters reported that the agents breached over 100 companies, including Deere, SharkNinja and Cummins. One intrusion ran through a deserialization gadget chain in legacy Zend Framework components, the kind of custom-app flaw that often never surfaces as a CVE at all, and exactly the sort of debt the collector goes after first.
The other incidents follow a similar pattern. Straiker found the CyberCartel group using a multi-agent system built on models including Claude and Grok against more than 400 Latin American financial targets, CrowdStrike found an attacker using ARTEX, an open-source agentic pentest framework, to breach South Korean financial institutions, and Microsoft attributed the ConnectWise Cloud Backup compromise to Storm-0940, whose agents attempted sign-ins to more than 2,250 tenants at 2,900 attempts per minute, in some cases reaching privileged cloud access in under three hours.
These are techniques attackers have used for years, and Microsoft’s own description is that ARTEX accelerated an existing toolset to machine speed. If we only measure the AI threat through CVE exploitation rates, we may be looking for it in the wrong place.
This is consistent with what the frontier labs themselves have been reporting. Anthropic’s September threat intelligence report found that sophisticated attacks no longer require sophisticated attackers, with autonomous attack operations now spread across every class of actor it investigated, and none of the operations depending on an entirely novel technique.
Autonomy compresses the cost of an attack while leaving payoffs largely unchanged, which fits the debt collector framing, since a debt that was never worth an attacker’s time to collect at human labor rates becomes worth collecting at $50 a hack.
The Skeptics’ Strongest Points
I want to give the skeptics their due, because their arguments are better than they often get credit for. In a recent conversation, Ciaran made a point that is hard to argue with.
Disruptive cyber attacks are, by definition, visible, so if AI were producing a wave of them we would see networks going down, and he hasn’t seen a discernible rise in disruptive attacks in the six months since the Mythos announcement.
He also pointed out that the tools have operators, and operators can be found, arrested, and deterred, which the October incidents actually reinforce, since NorForge found many of the attackers had left their own control panels wide open on the internet.
Joshua Saxe, whom I had on the show this summer to discuss why restricting AI makes us less secure, came at the same question from the damages side in a piece this week. He points out that global fraud and hacking damages roughly tripled over the past decade, yet that growth tapered after ChatGPT and open-weight models arrived, and he argues any AI security policy proposal needs to explain why we haven’t seen a discontinuity in damages since.
His explanation centers on the attacker rather than the model, since initial access is just one step in a criminal business that still has to handle lateral movement, extortion, negotiation and laundering.
The calm before many potential storms.
Joshua Saxe
The impact data so far supports some caution as well, since Reuters could not determine how much data, if any, was extracted in the Cairn intrusions, and Microsoft notes that the majority of Storm-0940’s targeting wasn’t successful.
Where This Is Headed
My honest read is that the data doesn’t fully settle the debate yet, and I’d be skeptical of anyone telling you it does with certainty. The most recent incidents largely sit outside the datasets we use to measure exploitation, and the confirmed impact is still thinner than the headlines suggest.
Most of the uncertainty is about timing, though, and every source in this piece points the same way on adoption. Attackers will adopt AI broadly because it lets them scale their operations while spending far less effort per target. Josh expects the apocalypse to be “slow-moving” and calls this “the calm before many potential storms,” and Jason’s 18 month horizon is another estimate of the same window, with both of them arguing we should use it.
I also want to be careful about hyperbole in either direction, whether that is the sky falling or AI solving all of our problems. I’m genuinely optimistic that AI can and will help defenders in a lot of ways, including lowering the cost of finding and fixing bugs.
Nathan Lambert has made the case that open-weight models could be one of the best tools we have for diffusing AI to cyber defenders over the next few years, especially in places like sensitive government agencies where air-gapped networks rule out closed APIs, while acknowledging that open and closed models both carry risk.
AI is also stressing the ecosystem, through the industrialized discovery of decades of security technical debt and the democratization of cyber capabilities for attackers and defenders alike.
That is why I struggle with the vulnzero prediction, even though I hope Jason is right and I’m wrong.
As I wrote on LinkedIn, vulnerabilities have never been purely a code generation problem. Incomplete asset inventories, missing owners, end-of-life systems that can’t be patched and compatibility testing all sit outside what a better model can fix on its own, while the volume of code is exploding, with GitHub’s COO saying in April that the platform was on pace for 14 billion commits this year.
Add the remediation numbers I mentioned earlier, and I think the harder problems sit in the organizational realities of how we patch, own and maintain software, which are systemic across both open source and the enterprise. That is where much of our real work remains.
Sergej’s Verifier’s Law helps explain why that work is so much harder on the defensive side. Sergej argues that AI advances fastest where checking a result is cheap, and that offense has the cheapest verifier in cybersecurity, since you either popped a shell or you didn’t, while defenders validate in a space that is expensive, ambiguous and slow. I’d add that defense is far more nuanced than any single verifier captures, involving people, process and technology, internal politics, and competing priorities like speed to market and revenue, along with bureaucracy in the form of governance committees, change reviews and approvals that an attacker never has to sit through.
An attacker needs one working path, while a defender has to get a fix owned, tested, approved and deployed inside an organization with its own incentives, and that asymmetry disadvantages defenders in ways a better model alone won’t close.
As I’ve written before, our industry has a long track record of watching the business adopt Cloud, Mobile, SaaS, and whatever comes next while we hand-wring over the risks, only to bolt security on after the fact.
We can’t afford that posture with AI, because this time the adversary is adopting the technology at least as fast as the business is. AWS put it bluntly in its PHP2Shell guidance, telling teams to measure patch and mitigation timelines in hours, since a 7-day or 30-day SLA assumes a delay that no longer exists.
In practice, that means prioritizing what actually matters, because no organization is going to patch everything at the volume we’re now seeing.
I’d start with what is known to be exploited, then what is actually exploitable and reachable in your environment, and put real effort into limiting attack surface and the blast radius when something does get through.
AI can help with every one of those, from correlating threat intelligence to tracing reachability and tightening permissions, and that is where I’d point it first.
James Berthoty of Latio offers a good way to start that conversation internally in his piece on the recent incidents, boiling the response down to three questions, what can you patch within an hour, what is the mitigation for what you can’t patch, and how would you detect exploitation.
None of this removes the fundamentals. Least privilege, credential hygiene, secrets management, and hardened perimeters would have blunted most of what is described above, and revoking one leaked LiteLLM key in May would have changed that story entirely. That is also why I agree with Jason’s call to go to the board for the basics.
The opportunity is to do those fundamentals at the speed and scale the adversary now operates at, and that requires security teams to be early adopters and builders with AI rather than the last function in the enterprise to get comfortable with it.
Closing Thoughts
It of course is debatable whether Black October marks the transition to a breachpocalypse or whether we are simply watching the same attacks get cheaper, and I’ll be watching the data that Jeremiah, GTIG, and others publish over the coming months.
That said, it is clear where adversaries are headed, and decades of security technical debt are coming due whether we’re ready or not. I remain optimistic about what AI can do for defenders, as long as we pair it with the unglamorous, systemic work of owning, maintaining and prioritizing the software we already have.
Waiting for the losses to show up in the actuarial data before we act would be repeating the same mistake our industry has made with every prior wave of technology.
Do we really want to be the laggards again, this time against an adversary that isn’t waiting for us?
Nice summary. Something I find interesting as an AI person that the cyber experts I know focus so much on the ecosystem and trends that existed before, where AI is an accelerant. On my side of the world, AI people love to debate if it’s caused by open models or if trusted access programs are good enough and things that actually seem much more surface level.
Hoping to write about all this this weekend too!
The Cairn campaign here is the same NorForge report I wrote up a few days back, the $50-a-hack one. What stuck with me wasn't the exploitation numbers, it was the funding numbers sitting right next to them. The same quarter this hit, $6.8 billion went into cybersecurity, and a good chunk of the AI-security rounds specifically funded tools that map agents a company already runs internally. None of that catches a decade-old deserialization bug in a public-facing web app nobody's watching. The debt-collector framing you land on is right, the collector's going after the boring external surface nobody budgets for, while the money keeps chasing the newer, flashier category instead. The fundamentals argument at the end is correct too, the open question is why fundamentals keep losing that budget fight.