In about ten days last month:
-
-
- Two critical PHP flaws, found with AI tools, forced governments and companies to take sites offline.
- LiteLLM, an AI gateway used by millions, was poisoned by a credential stealer.
- API keys for ChatGPT, Claude and Gemini leaked from several platforms.
- One attacker reportedly used AI agents to breach 100+ companies.
-
The common thread: attackers now get to AI infrastructure and AI agents, not only to servers.
Here is the part nobody is talking about enough. Companies are giving agents keys, tools and permissions. Almost none of them can answer: what is this agent allowed to do, right now, and who approved it?
A stolen key is bad. A stolen key attached to an agent that can act freely is much worse.
“If you think that what we saw last week and this ‘Black October’ is the end, it’s only the beginning. In reality, from this point on, things can only get worse.”
“Black October” is the name given to the scramble to apply patches after researchers using AI models discovered critical vulnerabilities in PHP, a programming language that powers a large portion of the web. Former CISA director Chris Krebs told CNBC on October 23 that 3% of all critical vulnerabilities ever discovered had been found within the last month.
Krebs pointed out that the PHP vulnerability had been known for about six years. It had gone unpatched because no one believed it could be exploited, until AI proved otherwise. Many other known vulnerabilities sit in that same low-priority pile.
Cybersecurity is a responsibility of senior management
Cybersecurity is not maintained solely through technological investments, software, and protective systems.
It also, and above all, relies on human awareness and an organization’s ability to recognize risks and address them before they escalate into an attack. This is where one of the system’s primary vulnerabilities lies: the absence of a genuine culture of digital security.
There is a need to move beyond the idea that cybersecurity is a matter to be delegated to industry specialists.
It must become an integral part of corporate strategy and executive decision-making; it cannot and should not be viewed as an incidental expense or a compliance requirement to be addressed only after an incident has occurred.
A company can fail due to cybersecurity issues; therefore, the matter must be addressed in a systemic way.
A new culture of security
Beyond the responsibilities of companies, however, there is an issue that concerns everyday behavior. Passwords that are too simple, credentials that are never changed, software updates that are put off, and devices connected to the network without proper precautions — often, the most dangerous vulnerabilities stem precisely from such carelessness.
“At the root of it all is often sloppiness, the laziness of people who fail to grasp the risks and, consequently, do not change their passwords. They get annoyed when you tell them they need to change them.”
An attitude that can have far wider consequences than one might imagine.
Even a seemingly harmless, network-connected device can become a potential point of entry if it is not properly secured.
“Refrigerators connected to the network, who would ever do anything to them?” it is precisely this underestimation of risk that leaves systems and organizations vulnerable.
Digital security can no longer be left to the good will of individuals; instead, it must become an integral part of an organization’s operations.
A cultural shift is needed, comparable to those that have already taken place in other areas of collective life.
Just as we have learned to cultivate an awareness of workplace safety or respect for the environment, for example, we must learn to cultivate a culture of cyber protection for our lives. Because that is what we are talking about.
—–
Stay data-hungry. Stay data-foolish.
Your Friendly Neighborhood Digital Consultant
