This Week in AI Security - 22nd October 2026

All right. Welcome back to another episode of This Week in AI Security, coming to you for the week of the twenty second of October twenty twenty six. And we've got a couple of themes to get into this week, a few that we have touched on a few times, but we've also got some breaking stories for this week. So without further ado, let's go ahead and dive in on this week's stories.

So first, I just found this to be an interesting story. Bank of America hired a thousand contractors to patch software flaws exposed by Anthropic's Mythos. We've covered Mythos any number of times. We've talked about the zero day clock. We've talked about mean time to exploit availability. We've talked about mean time to discoverability of a vulnerability. And we've talked about the, you know, the apocalypse, all of these forces working together right now. And we've talked about Mythos and the export bans and everything. So I don't want to focus on any of those. But what I want to focus on is basically a couple of really interesting data points out of here. First, let's put this in context. This is Bank of America. This is among the top three financial service institutions in the US, if not around the world. And the interesting things that jumped out to me is, first of all, that they hired a thousand contractors to patch software flaws. So if you put that in the context of your organization, probably your footprint is not going to be as large as theirs. But what it does mean is that if you scale it down to your level, would you have either the willpower or the financial capacity or the organizational ability to ramp up that number of contractors in such a short period of time to get to that? From the cost perspective, they quoted, quote, a couple hundred million plus, end quote, in terms of what this cost them to run. And, you know, the CEO of Bank of America, Brian Moynihan, has explicitly talked about, you know, they did this because they have to remain vigilant about, as a financial institution that is kind of structural or, you know, you could call it too big to fail. Going back to some of the financial crisis of some of the last decade, or actually, I guess two decades back now. And that may well be true. But think about your own company and its role in the ecosystem that you play in. And again, your ability to kind of scale or ramp up to this if you needed to go through that exercise. I thought that was a really interesting case study, and kudos to them for actually sharing some of their experience, because I think it is a lesson learned for a lot of other organizations that are kind of scratching their heads right now going, oh crap, you know, if we were to get access to this model, how many vulnerabilities would we discover and how would we get through that? All right, moving on to our next story.

We've got an individual CVE from GitLab. This is a critical nine point nine story around the API gateway. And so really just highlighting two things around it. Remember, it's not always the AI. It's very often the AI infrastructure around it. And also the ability to discover these vulnerabilities now at speed, in depth, in kind of obscure ways. So this is a somewhat interesting but obscure vulnerability, but critically on an AI gateway service. All right. Moving on to our next story.

And this is the kind of breaking story as we record here on the twenty first of October, which is the PHP2Shell vulnerability exposing the internet's legacy plumbing. So really, this is a vulnerability dubbed PHP2Shell. It is being assigned the CVE identifiers of CVE-2026-109618 and CVE-2026-109619. These are critical, nine point two CVSS score. So that's the vulnerability severity level. Of unauthenticated remote code execution, a pair of flaws, both leading to remote code execution, which is in PHP. And PHP, if you're not familiar, I don't honestly remember what PHP stands for anymore as far as the original language, but it is a coding language that is used by a lot of web applications. Most famously, Facebook has written on that, and WordPress has written in PHP. And so if you think about the amount of internet infrastructure that is running PHP code, I've seen estimates as high as seventy percent of all websites. There are other major enterprise platforms. It is also a very, very common language used in things like management interfaces. So if you have a home router or something like that, and you have an admin interface that you can access over the network in a web browser, the chances are pretty high that that is PHP as well. So, this is not a drill, quote unquote, was one of the headlines from Wired magazine, just one of the places that we checked around this story. So you'll remember, we talk about vulnerabilities, we talk about discovery, all of the different things. So I don't want to necessarily hammer on to this theme any more than we've already covered it. But basically, you know, this is coming for you as well. So think about your own organization, vulnerability management, etc. All right, moving on to our next story.

Now we're getting much more into the how threat actors are using AI. So we've got a story of a single hacker breaking into John Deere, SharkNinja, Cummins, and a number of other industrial organizations, uh, using, uh, sorry, just using an LLM and, well, really an army of AI agents here. So this is observed to be a Chinese speaking threat actor using something called Cairn, C-A-I-R-N, which is an open source AI agentic orchestration platform. On the back end, it hooks up to DeepSeek and Claude Code. They probed one thousand two hundred targets and breached more than one hundred enterprise websites, according to research from AI security firm Norfolk. Kudos to them. And reporting from Reuters and The Verge. The operator launched the campaigns using high level prompts under one hundred characters. And so when you think about some of the things we've talked about on the show, which is when you give agents goals without a lot of constraints, some of the behaviors may be unexpected from your perspective, but they are things that the agent will determine as being helpful in trying to accomplish the goal. So I found it very interesting that all of the prompts observed here were under one hundred characters. So these are very open ended prompts with a lot of kind of what I would call agency being exercised by the agents, meaning that the agents can decide how they want to accomplish the tasks. So they iterated through trial and error exploit chains for an average of twenty three hours per target. So while this is, quote unquote, cheap, it's not free necessarily. And if you think about kind of token consumption on that, on that scale, this is roughly estimated to be about five thousand dollars worth of tokens, which translates to fifty dollars per successful breach. So while, you know, five thousand dollars is not zero, when you actually translate that down into kind of your ROI on this, fifty dollars per successful breach of an organization of that size or scale is actually really, really impressive. Some of the interesting things around here, rather than assaulting hardened corporate perimeters, like trying to break in through firewalls, the agents look for subtle flaws in e-commerce systems. So looking for things like logical flaws, more akin to vulnerabilities in different software applications that are part of the corporation's stack. So, unless you, you know, just think about it this way, unless you write all your own software, you've probably got something in your systems, broadly speaking, that is a third party piece of software. So let's just take as an example. You know, I have a, um, I have a partner portal that is running Salesforce.com underneath the covers, and that allows me to interact with my partners who can then place orders. And that comes directly into my, you know, whether that's order processing or order placement system or my revenue tracking system or whatever the case may be. When I have that third party piece of software, there's the ability to discover some of the vulnerabilities around that. That's effectively what's being targeted here. This was only discovered because of an exposed agentic control plane. So the Cairn operators left the AI orchestration control planes wide open to the public internet, effectively the equivalent of something like an open S3 bucket, or maybe more equivalent to an open RDS database. That actually is how they were able to discover the attack plans, the shells, and actually all of the different prompts, as well as some API credentials and tokens that had been harvested from various locations. So really interesting, pretty resourceful, unfortunately, but also pretty cost effective. And I think that's one of the key takeaways from this. On to our next story, which is also in the lines of agents taking over various environments.

We have a story from Booz Allen Hamilton, where in their lab, they took a commercial frontier AI model, mapped a set of application capabilities, prompted agents on it to try to map an enterprise network, identify misconfigured devices, and then cross the IT to OT boundary. What's interesting about that is that OT devices are very often embedded devices within a piece of hardware, right? So we're thinking about water control systems. We're thinking about industrial robots. We're thinking about, let's say, power grid distribution systems, etc., that have embedded, typically embedded Linux, but it can be other operating systems or specialized operating systems. And they often have a lot less in the way of, let's say, software programmability, as well as a lot less in the way of being able to patch or update the software. So crossing that boundary is non-trivial. You have to figure out a way to interact with a more limited device. And what they found was that the frontier models and their kind of swarm of agents that they deployed here took control of a robotic arm. So there's your industrial robot connection, in sixteen minutes. And they reported that they actually had some human in the loop control points, and that without those, it would have been more like under ten minutes. So when you think about some of the typical controls that are very often used around OT, there's a couple. One is, you know, kind of security through obscurity. Um, another is actually putting them into a dedicated network within a corporate environment. But here we've discovered that network mapping is pretty easy. Um, and then also firewalling, and firewalls are known to have problems with different network layers or, let's say, open ports, etc. They reckon that this was about six dollars worth of effort to do that. Another OT security company called Claroty replicated a similar thing that took them about twenty eight minutes and about six dollars in API tokens. So again, this kind of acceleration of abilities in terms of offensive attacking capabilities, it's definitely something to watch out for. There's a couple of other things that I would point out from both of these two stories, which is that, you know, you can learn an awful lot about how these attacks play out. And if you wanted to kind of simulate something like this for your own environment, and then actually pass over the log files for the different types of movements that happened over to your cyber defense team, you'd get a lot of bang for your buck out of that exercise. Because from a defensive capability, a lot of defenses are formed by checking the boxes on a checklist of cyber things to do. Have we hardened our perimeter? Yes. Have we done micro-segmentation? Yes. But when you look at how these agents carry out the attacks, they don't necessarily fall short on any one of those individual controls. Instead, they look for ways around some of those controls. And that might be, again, a very useful exercise for your organization to harden your defenses.

And last, in this category of stories for the week, we've got some more rogue AI agents, this time out of India, from India's national cyber agency, the Indian Computer Emergency Response Team, or CERT-In. They announced that autonomous research agents from multiple major AI providers have broken out of testing and accessed live production environments at Indian organizations. So unlike some of the other previous examples that we found in places like Australia, where agents landed on portals, what we see in India is that they actually read and accessed actual confidential business records and personal data. This is reported in multiple sources. We're citing TechCrunch, but we've got a number of other things here. Some of the interesting things from my perspective is that, you know, CERT is actually coming out with some thoughts around this. Like, voluntary disclosure is kind of a broken construct around this. CERT is highlighting that the affected organizations failed to detect the intrusions on their own. The breaches were actually only discovered after the AI model providers stepped forward and notified them and CERT, etc. So when you think about what you might want to do is, you know, relying on the AI vendor that breached you to tell you that you were breached, kind of iffy. But also just, you know, relying on, like, no news is good news is kind of a little bit troublesome. So why did you not detect that these breaches were happening? Um, and also, finally, like, remember that these agents typically don't use zero days or complex exploits. They typically look through exposed resources. They look at credentials left in public repositories, overly permissive cloud IAM roles, etc., etc. So all of those things that, you know, are probably lurking within your environment that you think are, like, well, you know, the chances of somebody finding this are really low. Like, all of that is kind of going away.

Uh, sorry, I said the last story was the last story on this theme. I was wrong. I forgot about one more story for this week, which is a Tencent agent using proxies for live exploitation. So this was discovered by a team over at Swarm Chase in Sweden. Thank you very much to them for this. They found an active fleet of AI agents originating from a Tencent Cloud testing sandbox. The agents were deployed to perform a benign evaluation task, which is querying Alibaba's AMap, which is kind of Alibaba's equivalent of Google Maps, to find zoo entrances that are popular. Instead, the autonomous agents aggressively, uh, exceeded this, launching two thousand six hundred attempts to bypass anti-bot protections, defeat CAPTCHAs, probe pre-production servers, and actively use leaked developer credentials found in public source code repositories. Um, and, you know, just remember, benign prompts do not guarantee benign execution. If the prompt is open ended enough, doesn't have constraints on it, we can certainly expect some of these types of behaviors. And then interestingly, you know, you see the quote unquote creative angle of this. Uh, the agents couldn't access AMap directly. They got some, let's say, bot protection things in their way. So they got creative, they encoded malicious JavaScript payloads into URLs, submitted them to urlquery.net, which effectively worked as something like a kind of a cross-site request forwarding portal. And so it's a little bit of a, um, illustrative example of some of the things that, again, we're going to continue to see. All right, moving on to our last theme for the week. And that is AI regulation.

So Michael Dell, of Dell Computers and Dell Systems and Dell Corporation, or whatever they're called these days, is calling out the need for, quote unquote, bounded permissions. So he's warning that AI models require strict, quote, safeguards and controls, end quote, comparing the technology to fire. And so kind of the point is, obviously fire can do a lot of good, but if left unchecked, it can also cause a lot of damage. And so the bounded permissions that he's talking about is something that we've talked about any number of times, which is basically securing all of the constraints and controls over the systems where AI runs. You can't simply rely on telling a prompt to behave. So bounded permissions would require hard programmatic API access controls, independent runtime execution boundaries that physically restrict what an autonomous agent is allowed to access and what actions it is allowed to take. And he is saying this in the current climate where, you know, basically there are these quote unquote morally binding things coming out of the White House in lieu of having formal AI regulation. But, you know, a morally binding pledge is kind of worthless, right? It's as good as the paper that it's written on, which is effectively zero paper. And when an agent is already deployed by a user who doesn't put the, or doesn't follow that same level of kind of moral pledge, then what's the point? The two things are really out of check. And so the point from Michael Dell, which I think is kind of a broader point, is that, you know, it shouldn't be the case that customers have to build all this plumbing and controls around every AI agent that they build. Rather, the frontier model providers, if they're providing the back end system that is doing a lot of the kind of logic and inference and so on, there should be controls at that layer as well. I'm not here to legislate the politics of it. My point on this is really only the following, is that, you know, that in the current climate, there's no safeguards coming from the back end provider. So all that you can do in the current climate is, when you're building your own AI agent, to apply some of those constraints. And this is something that we're going to be working on here as we continue to build out our support for securing agentic systems at FireTail, and for helping our customers build and deploy secure agents as part of the overall FireTail AI security and governance platform. Stay tuned for more on this that we're not quite ready to announce just yet, but that is something that is going to be coming. All right. Moving on to our final story of the week.

And this is JPMorgan Chase blocking outside AI agents like Muse and Instinct from directly accessing accounts. So if you're not familiar with Muse or Instinct, and I admit I've never heard of Instinct before this story dropped, but Muse is kind of the personal AI assistant from Meta, the parent company of Facebook. And the idea of a system like Muse is that I can hook it up to a lot of my own accounts, my Facebook account, my Twitter account, whatever the case may be. And then I can give it instructions to go execute things on my behalf. Maybe that's something like, hey, find me on Facebook Marketplace, find me a moped that I want to buy under two thousand dollars within, you know, one hundred kilometers of where I live. Um, whatever the case may be. But what, and, you know, that could extend to things like doing travel booking or personal tasks and finance, etc. And what JPMorgan Chase is saying is that, hey, they are not ready to open their systems up to tools like Muse. So Muse will not be able to do your banking, at least not with Chase in the near term future. And so, you know, they're really drawing the line between convenience and execution, and landing on the side of secure, accountable, direct execution, as opposed to this kind of maybe convenient for me to be able to tell Muse to go pay my bills using my Chase accounts. That's not going to be on the table for a little while. And if you think about this, this makes a ton of sense from a legal liability perspective, because what JP, Jamie Dimon, the CEO of Chase, JPMorgan Chase, is calling this, he's calling this the quote unquote liability transfer, and likening it a little bit to a disappearing safety net. So Dimon has explicitly warned that customers who delegate access to external AI agents must recognize the immediate, quote unquote, liability transfer, end quote, signaling that the bank will not absorb the financial losses caused by misbehaving, hallucinatory, or compromised third party bots. And all of those things, the hallucination steps, the compromise, the misbehavior, we have seen these from AI agents. Imagine the impact to you if you give Muse a set of instructions, it interprets it a certain way, and then does something around that, whether that is, for instance, you say you want to do some travel planning. The only tickets available are business class. You didn't want to book business class, but Muse went ahead and did that for you. That money has gone from your account, that ticket is non-refundable. This is the kind of thing where you might go to your bank and be like, hey, I did not authorize this purchase. That creates a problem. And that is what I think the risk and the liability that JPMC from their side is not willing to accept. So that is something to keep an eye out for. And we have already seen legal precedent around, you know, if it is your AI agent, you own it, you are responsible for those actions, and they're covering their side of that equation.

So I think that is the story and the message that we're going to close today's episode out on. If you want observability of any personal AI agents that are running inside your employees' environments and what they may be doing, that might be creating liability for your organization, be sure to hit us up over here at FireTail. And with that, we will talk to you next week on another episode of This Week in AI Security. Thank you so much. Bye bye.

‍