Black October: AI Agents in Our Bank Accounts and the PHP Hack

In the last 48 hours, AI attacks have gone from one-off incidents to something much bigger. Major U.S. banks are detecting unauthorized AI agents inside customer accounts, and they can't tell them apart from humans. At the same time, two critical bugs in PHP, the language behind an estimated 70% of websites, leaked before the patch was out, and the NSA, the FBI and Japan's prime minister told organizations to take their systems offline. Ejaaz breaks down what's happening, how the PHP flaw was found by AI and kept secret for months, the hacking group that used Claude and Grok agents against more than 400 Latin American financial targets, and why open-source models are the ones fighting back.

Then the bigger questions: who is behind it, why AI agents are so hard to trace, and the steps you can take today to protect yourself.

==
Timestamps
00:00 All Hell Breaks Loose
01:58 The Worst 48 Hours in Cybersecurity
04:01 A Global Attack With No Source
04:59 AI Agents Inside U.S. Bank Accounts
06:20 Banks Can't Tell Humans From Agents
08:10 The Warning From the AI Labs
09:22 PHP2Shell: 70% of Websites
10:06 How AI Found the Bug
11:47 The Leak
12:27 Millions of Attacks
13:27 Open Models Fight Back
14:24 Claude and Grok Agents Hit the Banks
15:33 Governments Pull the Plug
16:45 How to Protect Yourself
18:12 Final Thoughts
18:44 Why This Is a Good Thing
19:47 AI Fighting AI
21:37 Why Can't We Trace AI Agents?

#ai #cybersecurity #aiagents #banks #php

==
AlphaSpace by Yahoo Finance: A Professional-Grade Investment Platform Built for Everyday Investors.
👉 https://finance.yahoo.com/about/promos/gold/alphaspace/?ncid=100003571

Creators and Guests

Host

Ejaaz Ahamadeen

Investor & Host of the Limitless AI Show. Former Product at Coinbase and ConsenSys

What is In the Loop AI?

Exploring the frontiers of Technology and AI

There's no delicate way to put this. I am freaking out. In the last 48 hours,

all hell seems to have broken loose in AI. Hundreds of unprecedented AI attacks

that are affecting some of the most popular websites and apps that you and I use.

But also, AI agents are getting unauthorized access to our bank accounts where

they potentially can move money around and get access to other important data.

You remember the Hugging Face incident where an open AI model escaped its internal

sandbox and hacked into a public company, stealing proprietary data.

That was bad back then. and it still is. What's happening this week is that

on steroids, a hundred times worse and affecting some of the most popular apps

that you and I use every day, including Slack, Facebook, and Etsy.

There's no trail of clues that are being left behind. AI is covering up its

tracks as it's being able to perform these attacks. And the craziest part about

this is what's being used to defend against these attacks.

You guessed it, it's AI, but it's open source AI models, the very same models

that people, including myself, were giving a bad rap and saying would actually

be performing these attacks are actually the ones that are defending us against these attacks.

And the attacks, if history is anything to go by, has been coming from frontier centralized labs.

And this might be the same case with this week. A few months ago,

Dario Amode and Sam Altman went on the record saying they expect an unprecedented

attack on the global population in the next couple of months.

What's happening right now may end up being that thing. Have we reached a point

where these AI agents have gotten out of hands, where we're losing the grip

on reality or control of the AI models that we as humans are building?

And what that means for us, how do we defend against these things?

Do we need to constantly rely on AI models?

Or is there a way that we can manage them truly in the future?

What it looks like right now is that we're losing control, but maybe that's

not actually the case. Anyway, I'm going to get into everything that's happening this week.

There's a lot, so bear with me on today's episode brought to you by Qualcomm.

Now, just to give you guys an idea of what on earth is going on,

there's this great summary tweet that I have here where he goes,

this is the most serious 48 hours in cybersecurity history, and they're calling

it Black October. Okay, so what are some of the attacks?

Well, he goes, the year-level incidents are PHP 2-shell.

The way that you understand this one, and I'll get into it in a second,

is it exposes a security or coding security flaw in 70% of all the popular websites,

apps and tools that you and I use every day.

It's gotten so bad that this affects the tools and software that the FBI,

NSA, and the majority of enterprises actually use day to day.

In fact, the FBI and NSA issued a warning or a statement yesterday saying,

if you haven't updated your software, shut your system down,

which is a crazy request, right? But maybe it's just parlaying for antics.

What actually ensued is companies and systems and governments across the entire

world have started shutting their systems down because they don't know whether

their software is vulnerable or not.

And you see a similar theme across the other major attacks that have happened

this week. You look at accessing public databases.

You look at the railway hack, which accesses coding hosting keys and platforms

where people are vibe coding.

You see the GitLab hack, which is a 10 out of 10 severity hole,

which is on their scale, a major, major bug that has existed since 2014,

and these AI agents are exploiting it.

And then you scroll down and you see a lot more relatable hacks,

including Signal, which is the popular supposedly encrypted messaging app,

which I use on the day-to-day, a lot of my friends and family use on the day-to-day, has a bug

that could turn on your mic and camera after you hang up.

So it could be listing and watching you as you just go about your day.

And then popular apps such as WordPress, which is used to kind of publish and create websites,

which you might actually host your website on, can now get access by random

AI agents or whoever has the necessary means to kind of point an agent or a

model at your website and deploy code that might be very, very nefarious.

And it's important to point out this isn't a US-specific incident.

It's not a Western frontier incident either. It's a global one.

The State Bank of India, India's biggest bank, confirms a data breach across

all their accounts and passwords.

You've got North Korea that are discovering that these tools and attacks are

happening and jumping in, attacking South Korea.

This is a globalized attack, which is happening across the entire world right now.

And it's not even coordinated, or if it is coordinated, it's being coordinated

by the AI agents and AI models themselves.

And that's the big question mark around all of this, who's orchestrating it,

and if not who, what's orchestrating all of these things, because there's no direct source.

So as I'm recording this, there are hundreds of attacks that have been launched

over the last 48 hours, and 30 of them could be considered catastrophic or major attacks.

I'm only going to focus on two or three for this episode, because otherwise

I'll need hours to do this.

So the first one is actually the most relatable and most concerning.

Madison Mills from Axios broke this news. She goes, major US banks are detecting

unauthorized third-party AI agents inside customer accounts.

Now, these AI agents are not only unauthorized, so they're not meant to be in

that account, but they are performing actions that the human owner has no idea whatsoever.

Or no thought process around what or why they're doing it. And they certainly

didn't give them approval to do it in the first place.

So you can think about the ramifications of this. These AI agents have access

to your money with the ability to presumably send or receive money from other

potential actors, maybe even AI agents in this instance.

They can get access to your financial history transaction records,

building up a profile picture and image of you that you otherwise maybe didn't

want to hand over to them because it's obviously private and have access to

all your contacts and details, delete, reach out to them, whatever that might be.

This is personalized information that should be kept in a vault that has been

handed over or attacked or hacked into by these different AI models.

And the concerning part is neither the bank who houses all of these systems

who are meant to protect you and keep you safe, neither you who are the owner

of the account and owner of the money that's inside of it have any idea that this is going on.

The AI agents or models themselves have become so good at covering up their

tracks such that banks themselves, and they've said this on the report.

Can't figure out who's human and who's an AI agent.

And that's because of a recent trend or update where these AI models have gotten

access to browsers, internet browsers that you and I use every single day to navigate the web.

AI models have become so, so good at using these browsers. They can navigate

and scroll in the same way that you and I do so that it appears like it's a human being.

Remember those verified capture tags where you have kind of like a pop-up dialogue

box and you have to read the letters and numbers and then type them in and it's a little bit obscure.

And somehow that's meant to verify that you're a human being.

Doesn't matter anymore. AI agents can see everything you see,

and they can read the information that you can, and they can do it all day,

all night at a fraction of the cost without ever having to sleep.

And they can mimic and regulate the same kind of emotional behavioral traits

that humans have, such that they can kind of mask or mirror themselves as being humans themselves.

And so the banks right now, particularly in the US, are forming a council,

and they're trying to figure out what on earth they should do to deal with such

an unprecedented attack, because the options are either

shut everything down and cease to be a bank until we can figure out what on

earth is going on, because it's happening so fast and so quickly

all over the world, not just in the US, or try and deal with it in real time.

But the main blocker is they can't tell which is human and which is an AI agent. It's nuts.

And I can empathize with the banks. There's a sentence here that goes,

several banks are now preparing for the worst case and even day after scenarios.

Now, day after implies that after a catastrophic incident has occurred,

how do we come back from this? How do we recover people's funds?

How do we figure out how to operate as a functional business and gain people's trust again?

Because we don't even know how compromised our systems are.

And it reminded me of something that Dario Modi and Sam Altman both said relatively

around the same time, around three months ago, where they said, listen.

We have access to some of the most powerful internal AI models,

which we haven't released yet because they're misaligned, they're misbehaving,

and they might do bad stuff like this if we let them out.

And so it's foreseeable for us that a few months from now, there'll be models

out there in the world capable of performing some serious catastrophic incidents.

And their response to this was, we are doing our best to create safety classifiers.

So these are kind of like roadblocks that you place around a model that prevents

it from acting in a certain bad way and kind of like is monitored by its own

self to make sure that it doesn't act unaccordingly.

And so in that event, once they deem it safe, they can then release it into the world.

But what's obviously happening here is that hasn't been the case.

And the question mark on everyone's mind is, is this being done by one of their

centralized models? Or is this being done by an open model?

And actually the next incident gives us an insight as to what the answer might be.

So let's get into it on today's episode brought to you by Qualcomm.

So this entire crap storm started around 48 hours ago when OpenAI posted what

you're seeing on the screen here. They go, OpenAI models help researchers operating

as part of their initiative, blah, blah, blah.

And discovered critical security flaws in PHP, an open source programming language

used to run an estimated 70% of websites.

Now, PHP is something that is like the foundational bedrock of the internet.

And every popular app website has in some way, shape or form,

interacted or built part of their architecture on PHP.

It's meant to allow your apps to run smoothly, functionally,

and allow the code that you've created to underpin this entire app to run securely.

So on August 19th, this external research group called Wiz discovered or said

that they discovered a flaw in PHP, which is the open source program that I just explained.

And they discovered one particular flaw that could allow it to imbue any kind

of program or website that's running PHP with malicious bit of code and have them execute it, right?

So they looked into it and a few days later realized that it was in fact a real

exploit because they executed it successfully on WordPress, which is a very

popular website that people use to create and design other websites.

In fact, this platform also hosts websites. So imagine if you've ever made a

website on WordPress before, I certainly have, that is currently compromised.

So then five days later, they report this to the open source maintainers of PHP.

And they say, hey, listen, we've discovered this pretty serious bug.

And they also let OpenAI know as well, because the models that they used to

discover this exploit was Gemini, so Google's model, and GPT 5.6,

so the older version of OpenAI, but Frontier at the time.

So they used these two models in conjunction to try and discover and find this

exploit, and they realized it, surfaced it to these people. None of us,

none of the public had any idea this was going on. This was intentionally kept under wraps.

Now, if we fast forward about a month later, September 21st,

PHP acknowledges that this is a serious issue to open source maintainers.

It wasn't open AI that was working on solving this fix.

It was Wiz, an independent research group, and these open source maintainers.

Arguably aren't being paid to do this, figuring it out on behalf of 70% of the

website and applications that exist today. It's just nuts.

And then finally, we get to October 20th, two days before these guys are actually

meant to publicly release that they've issued a patch and that you should update

your software and systems on the latest PHP.

Two days before, it leaked that this entire thing had been discovered,

exposed, and that they had been working on a problem for over a month.

And obviously, whoever out there is coordinating a bunch of these different

attacks saw that and thought, hmm, well, before they issued out this patch,

I am going to see whether these exploits actually exist and see what havoc I can wreak.

And guys, the scale of this attack is insane.

From when the news broke, Matthew Prince, who works at Cloudflare,

says, some stats on the PHP attack.

In the 10 hours before it was publicly announced across Cloudflare network,

we saw thousands of attempts to exploit it.

That jumped to tens of thousands in the 45 minutes post-announcement.

Hundreds of thousands within two hours and millions now.

So if I reflect back on the banks that are currently dealing with unauthorized

AI agents, unprecedented amounts of them accessing people's human accounts and

playing around with their money,

I can understand why or where it's coming from. It's certainly from AI agents or AI models.

What's questionable is who's coordinating all of this and whether our systems

are robust enough to try and defend against these things. I have a simple answer for that, which is no.

But in the event that these things are being defended against,

which is currently out there and happening, you'd never guess who's actually doing it.

It's open source models. Henson Zhuang, a play on Jenson Huang,

I presume, goes, lol, I'm pretty sure someone is running a deep seek swarm to

remotely patch, unpatch PHP boxes.

Well, good on them. So some do-gooder out there or some group out there

is deciding to be a good Samaritan and send out a swarm of AI agents to fight

the bad actors, the bad acting AI agents so that they don't hack any and everyone's website and app.

And I find this particularly curious because for so long, me included,

I've criticized the open source models for potentially being used for nefarious

purposes. That's certainly the mainstream trend that has been discussed.

But what we're actually seeing here, and what I've actually,

now that I think about it, over time have seen, is that these open models are

just being used for good or by good actors.

Now, of course, we don't have the insights or the breadcrumbs to know whether

the attacks that are happening this week are facilitated by open models.

There was one that I read about, It's happening in Latin America right now,

which affects, I think, 400 different banks in Latin America.

And that's been coordinated by a mixture of Grok, I believe,

Claude, as well as an open source model. I think it was GLM 5.3.

I don't know. It was Kimi. It was Kimi 2.8, I believe.

So a mixture of frontier centralized models, cheap frontier centralized models,

as well as an open source model. So it's a coordinated attack.

It's certainly not one or the other.

But in this event, for every single major AI incident that we've seen,

including the Hugging Face incident, which started this entire thing this year.

The defenders have used open models. Why? Because the frontier centralized models

haven't been effective enough because they have safeguards up.

If you want to ask Claude, hey, could you defend me against this AI agent,

which is like literally accessing my back account and stealing my money?

It'll refuse. It'll say, no, I actually think that you're trying to do something

bad here. So no, I'm not going to let you use it.

And if you want to use it, you need to pay excess amounts of money to access

their security specific models, such as OpenAI's daybreak thing in order to

get access and defend yourself. And the top government agencies don't have an

answer to that question either.

Yesterday, public announcements from the NSA and FBI saying if you have an outdated

version of PHP, you need to shut your entire system down.

And what ensued wasn't everyone updating their PHP or checking.

It was panic to the extent that governments, other governments around the world

started shutting their systems down. It happened in the UK. It happened in all

over Europe and presumably Asia as well.

Oh yeah, it happened in Japan. I remember. Yes, the prime minister announced

to 48 million people that they need to shut all of their stuff down or most

of their stuff down whilst they figure out the extent of damage or vulnerability.

I was talking to producer Luke today when we were discussing like,

oh, wow, some of the apps that we use on a day-to-day basis would also presumably

also be compromised as well or needs to be updated.

So this is a widespread attack happening in real time across every single nation.

If you're listening to this in the US, in the West, or in Asia.

In South Africa, wherever you are, you're probably seeing news headlines regarding all of this.

I want to address two more things before we round up this episode.

Number one, how on earth do you defend against this?

Well, this tweet from Peter was actually quite good. He goes through a list.

He goes, you now need to use a really good password manager,

like 1Password or whatever that might be. If you don't use password managers

and you're using the one that you've used since, I don't know,

you were in high school, definitely don't do that. Now's the time to upgrade.

Number two, use two-factor auth.

I know it's hard. I know it's tough. I know you don't want to be getting texts.

Use the QR code one, it's the best one, or use parse keys, figure it out, update your systems.

Number three, turn on auto updates, which means that when your system becomes

outdated or outdated and when you need to...

Lock in an update like you do on your iOS, on your phone, or whatever that might

be, or your Google Chrome browser, actually do the thing because it's more important now than ever.

And it's probably going to be more important going forward. It's just going

to have to be a weekly thing. Turn it on. It's really easy.

If you're in America, get an IRS identity protection pin to make sure that people

don't try and steal your social info. That's the other thing that I mentioned.

On one of the incidents, they get access to your government database information.

I don't know the extent of that damage, but it's still something to figure out.

And then the last one, which I think is really good, get your cell carrier to

give your port out pin or number lock.

I currently have this lockdown on my phone where I've experienced attacks in

the past where people will try and fake to be your identity and they can do

it online and try and get access to SIM swap you and get access to all your phone records.

Now's probably the time to figure that out because you don't have to be a human

anymore to launch an attack like this. You could just be an AI agent posing as a human.

Okay, so my concluding thoughts here. One, an observation.

It's crazy to me to see open source models being used to defend against these

things. I mentioned it earlier. I just want to reemphasize it.

I think that the narrative that's been going around open source models,

particularly peddled by centralized AI labs like Dario Modi in particular,

saying that open source may not be the best route forward.

I don't know if that's entirely accurate right now. I could see a world where

they're used for nefarious purposes.

But right now, the evidence I'm seeing in front of me is that they're actually

being used to defend successfully against these attacks. I actually think in

the long run, this is going to end up being a good thing for us. Let me explain why.

Code for the majority of humanity's existence right now has been handwritten by humans.

And humans themselves have.

Carefully peruse through the code to make sure that there aren't any major flaws.

And this has worked so well for our entire existence, except now we have a super

intelligent or higher intelligent thing that can work 24-7, ruthlessly comb

through the code bases and discover any flaws that we might have missed.

And it turns out there are a ton of them.

This is ultimately a good thing if we want to create battle-tested systems that

are battle-tested for the AI era. That's exactly what we're going through.

You can imagine attacks in the future may not be as complicated or easy.

Vulnerabilities may not be as abundant as we're seeing today,

as we're reporting on this week, because it's been fixed or patched by these incidents.

So it's good that we're going through this kind of painful growing process right

now, because I think it'll benefit us in the long run. Number three,

we're using AI to fight AI, which means that for the first time,

or maybe the second time, and I'll explain what the first time is.

In history of this AI development, humans are kind of being brought out of the

cognitive and manual labor.

And we're not just talking about the average human. We're talking about the

expert humans, the security researchers, which have honed their craft over decades

and decades and decades of time, who we go to for counsel to try and figure

out, hey, how do we build the best systems?

Who get paid hundreds of thousands to millions of dollars a year for their craft.

Currently being replaced and automated by AI models because one,

they can't figure out what the problem is and how to solve it.

And two, it's all happening way too fast. I don't even blame them.

You would need like a million versions of these experts, which frankly don't

exist right now because you need to train them, teach them computer science,

train them through degrees.

Why not when you can just have an AI model that pops up out of nowhere and can

just address the thing in an instant?

You can see the kind of like balancing act that we have here.

And the first time that this actually happened was a few weeks ago when OpenAI's

internal models solved a bunch of really hard math problems that have existed for centuries.

And mathematicians just lost their head. They were like, well, what's my purpose here?

What have I been spending all these years crafting, doing my PhD for,

if an AI model can just go out and discover it all for you?

My response to that is, listen, we're in a weird kind of adolescence growth

in AI where we're trying to figure out how best to work with these tools.

And I want to emphasize the with these tools.

Because I don't think these AI tools actually function without human direction.

So I think humans and AI tools will ultimately work well together.

And what we're doing right now is we're leveling up. It's painful to see. It's dangerous to see.

But ultimately, I think it results in a better future for us.

And that's my optimistic take. Call me crazy. I don't care.

It's what I believe. And the final point was actually raised by producer Luke

before we started recording this episode, where he goes, I don't understand

why this is such a big problem.

Like, why can't we design AI models to leave better breadcrumbs behind so that

we can just follow the trail and figure out, oh, it's this AI model,

bad boy, don't do that. And my answer was pretty simple.

AI models are, unfortunately, a black box right now. And I use the analogy of,

imagine you go to your friend or go to any human being and you ask them a question.

Before they answer, do you have any idea exactly what's going to come out of their mouth?

No, because they are reacting to you. They are thinking in different ways.

Their brain's neurons, it's all a hidden black box.

And that's how artificial intelligence, we're mimicking the brain here, was designed and built.

Now, there are methods to try and figure out what the internal system is happening

within an AI. It's called chain of thought.

But recently, with the most powerful models, that has been left to the wayside

as a trade off to try and build more intelligent models. OpenAI has rumored

to be doing this with GPT-6 and foregoing models going forwards.

I'm sure Anthropic is doing the same thing as well.

It's this weird precedence that we're in right now where the AI models are the

most powerful that they've ever been. They're the most misaligned that they've ever been.

And they're wreaking havoc and covering up their tracks. And no one knows who's

better off or who's even doing it in the first place.

It's just unprecedented. It's weird. The models are thinking for themselves

now as well. I talk about the internal black box.

Before it gives you an answer, previously it would spit up outputs,

right? So from input to output, you'll have an idea of how it's thinking or

how it's getting to its conclusion.

Now you don't have that anymore. Now it just thinks for longer and it doesn't

have to tell you what it's thinking.

And it's looking at the Hugging Face incident and it's thinking,

huh, they caught me. Oh, they discovered my messaging board.

I should probably communicate to my fellow agents in a different way.

Now, a lot of you listening to this might think that this is a Doomer-esque

take, I'm telling you this is how it works inside the labs, at least from what

I'm learning from the researchers and papers that Anthropic and OpenAire are dropping.

So, you know, I'm sure they would kind of back similar thoughts up.

And if you disagree with me, like, let me know. I want to hear what the counter

argument is. But that is roughly how these systems are designed. So,

For all intents and purposes, I don't have a better suggestion as to how to

deal with this right now, except tread carefully, update your passwords,

use a password manager, and yeah, stay safe out there.

By the time this episode goes out, there's probably a number of other attacks

that have gone out, so this might be slightly outdated, but I hope you enjoyed this episode.

I promise you it's not all doom and gloom on this channel, but I have to raise

awareness about the crazy things that are happening as they're happening.

Otherwise, I'm not doing my duty to myself about talking about things that are

important to me. If you're watching this on YouTube and you aren't subscribed, what are you doing?

Please subscribe, leave us comments, give us a thumbs up. It helps us out massively.

We have been seeing so many new subscribers. So hello to you all.

It's great to have you. We post

five times a week, sometimes more when there's a crazy thing going on.

You might notice that I'm actually not in my studio today because all of this

started breaking. And I was like, I have no time to get to the studio to record

this. I'm going to record this right now in my bedroom, just like the old days.

The nostalgia of the blank wall behind me, but hopefully you found this just

as engaging and interesting.

Anyway, that's it. Thank you so much for listening and I'll see you on the next

episode of In The Loop brought to you by Qualcomm.