Black October Isn't Just A PHP Bug. Attackers Want Your AI Keys.

Summary

The video argues that AI agents are making cybersecurity attacks cheaper and faster by continuously exploring code, testing possible weaknesses, and scaling work that once required large teams. The same capabilities can help defenders, so the speaker urges organizations to put capable AI models to work on defense rather than rely on weaker tools.

Incidents and risks discussed

• PHP vulnerabilities: The speaker says PHP issued patches for two critical vulnerabilities on October 21. One described attack could make PHP code run on a site before its own application code. British and European security services reportedly advised organizations to isolate or shut down affected systems that could not be quickly updated or protected.
• Weak eMudhra certificate keys: Security researcher Scott Helme reportedly recovered eight weak private keys in less than a second. One key was the number 4. Because eMudhra was treated as a root certificate issuer, the speaker says the weakness could affect trust across the internet. He says Helme used Claude to recover the keys with one request.
• Compromised AI and developer credentials: A release from LiteLLM, a tool that connects applications to AI models, reportedly included credential-stealing malware. The video emphasizes that a clean source repository does not prove a distributed package was safe. Investigators need to determine what code actually ran, what permissions it had, and whether it could access production keys.
• AI keys as financial assets: A stolen API key can let someone use a provider’s compute while the owner pays the bill. The speaker recommends investigating both whether keys were exposed and whether they were used, including checking billing activity.
• Other reported incidents: The video mentions a small AI startup, Post, temporarily shutting down its service after a warning that Anthropic and Stripe keys had been compromised as part of a Railway-related hack. It also cites Microsoft’s account of a Chinese state-linked group using the Artax AI-agent framework to target hundreds of organizations. Most attacks reportedly failed, but some gained privileged cloud access within hours.
• AI tools can create or expose risks, too: LiteLLM reportedly said Claude Code had, in some situations, inserted GitHub credentials into responses that could be logged. The speaker also describes cases in which agents disclose personal information through URLs while trying to identify themselves to websites.

Broader security analysis

• AI agents can inspect code, form a hypothesis, write and run tests, correct their own mistakes, and keep investigating without tiring. Those capabilities are useful for both attacks and defense.
• Automation lowers the cost of attacks: a single person may be able to operate fleets of agents rather than organize a large human team.
• Long-standing maintenance and compatibility trade-offs can leave vulnerabilities unaddressed. The speaker says Anthropic reported finding more than 29,000 potential vulnerabilities while scanning critical software projects over six months, with roughly 6,000 manually reviewed at the time described.
• Fixing disclosed bugs is necessary, but the speaker argues it is not enough. Organizations should also examine how system components and configurations combine to create attack paths, and reduce the amount of code and access exposed in the first place.
• He cites Anthropic’s work across 25 projects, which reportedly identified nearly 500 opportunities to reduce unsafe or overly open interactions. One example involved OpenSSH code reachable during authentication even when the related algorithm was disabled; changes in version 10.6 removed some code accessible to authenticated clients.

Recommended actions

For individuals

1. Update browsers, devices, operating systems, and apps, and reboot where required.
2. Review connected-app permissions on important accounts, especially email and file services; revoke unnecessary access.
3. Remove unused browser extensions and restrict the site access of extensions you keep, where possible.
4. Use unique passwords stored in a password manager and enable multi-factor authentication. The speaker also recommends a family voice passphrase to help guard against deepfakes.
5. When notified of a breach, find out what was exposed, change affected passwords, revoke suspicious access, and—if you develop software—rotate API keys and follow any further response guidance.

For organizations and developers

• Treat a potentially compromised environment as compromised: isolate it, follow incident guidance, and rotate passwords and keys.
• Investigate past executions, build tasks, permissions, and access to production credentials—not just the current state of the repository or service.
• Check for evidence that exposed AI keys were used and assess possible billing consequences.
• Test candidate AI models in a safe reproduction of a known incident. Give them the same evidence and tools, then see whether they trace the incident beyond a clean repository to the actual deployed package, build history, and credentials. The speaker recommends prioritizing strong code-understanding and reasoning models rather than saving money on weaker ones for security work.
• Communicate transparently with customers about what was vulnerable, what remains uncertain, whether access has been cut off, and what customers should do. The speaker says temporarily stopping a service can be responsible when needed to regain control and investigate.

Guides and resources mentioned

• The speaker says the accompanying Substack post includes two prompts: one to audit accounts and devices and produce a report, and another to repeat the check after future incidents.
• He describes a detailed LiteLLM incident breakdown that companies can use as a test exercise, along with conversation plans for discussions with a board, CFO, engineers, and suppliers.
• Nate’s Library MCP is presented as a way to connect Claude, ChatGPT, or Gemini to the speaker’s posts, guides, and prompts.

Main speakers and sources

• Main speaker: Nate B. Jones.
• Sources and organizations discussed: Scott Helme; Anthropic; Microsoft; PHP; eMudhra; Mozilla; Cloudflare; Vercel; LiteLLM; Post; Railway; OpenSSH.