The AI-powered cybersecurity crisis that the world has been bracing for has arrived. Now comes the hard part: figuring out how to defend against it.

Why it matters: AI is accelerating the discovery of software vulnerabilities and threatening to overwhelm security teams already struggling to keep up.

• Companies need to rethink their defenses before the next wave of attacks.

What they're saying: "This is the worst outlook I've ever had, and it also is the most interesting thing I've ever seen in my life," ExtraHop CEO Greg Clark told Axios. "This stuff actually works, it's going to change everything."

• To survive the tsunami of AI-discovered bugs and AI-enabled hacks, companies need to build strategies around the assumption that attackers will eventually get through, security experts told Axios.
• "We are in an era of cyber tsunami now," said Rubrik CEO Bipul Sinha. "It will wash over everybody, nobody will be 100% safe."

The big picture: The next era of cybersecurity will be defined by how quickly companies can detect attacks, contain the damage and recover, rather than by how many vulnerabilities they can patch.

Between the lines: That shift doesn't require throwing out the security playbook. Instead, companies should double down on basic cyber principles, use multifactor authentication and defense in-depth, Justin Timothy, threat intelligence consultant at GuidePoint Security, told Axios.

• Rubrik's Sinha also recommended that organizations start preparing by identifying the most critical services that they need to keep up and running and develop a plan to restore those first after an attack.
• ExtraHop's Clark suggested that companies get their own AI tools up to speed on what's precious in their systems and how best to protect them at machine speed.
• Samantha Lewis, head of threat intelligence at Armadin, told Axios that companies should proactively test their own systems for exploitable weaknesses so they're not caught flat-footed when the next major vulnerability disclosure arrives.

Catch up quick: Experts have dubbed this month "Black October" after a chaotic week of AI-discovered software flaws and attacks on the platforms powering the AI boom.

• OpenAI's agents discovered critical flaws in PHP, software used by roughly 70% of websites, and Brotli, a widely used data compression library.
• Breaches at AI coding agent OpenCode, developer platform Railway and AI gateway LiteLLM put customers' API keys and other credentials at risk.
• Meanwhile, Quest Diagnostics and a major California student testing service disclosed more traditional breaches affecting millions.

Rob Joyce, former head of the NSA's cyber division, warned on X last week that the "transition from vulpocalypse to breachpocalypse is here."

Zoom in: The biggest challenge in the breachpocalypse sits at midsize companies that lack the resources of major banks and other large organizations.

• Clark warned that many of these businesses won't have the staffing or expertise to build sophisticated AI-powered defenses on their own.
• He added that managed security service providers will play a much larger role in helping them keep pace.

The intrigue: Business leaders are waking up to the danger, but awareness still isn't translating into action fast enough due to organizational inertia and the time needed to make major changes, Sinha said.

• "From awareness to action, still we have ways to go," he said.

The bottom line: If there's just one thing organizations can do to put them in a better position today, it's implementing multifactor authentication on all end points, Timothy said.

• "The amount of victims we encounter who didn't have MFA enforced on every single sign-on portal hurts my heart," he added.

Although panic has gripped some enterprises during "Black October," the widespread crisis that many cybersecurity professionals feared has yet to materialize.

Why it matters: While the threat level was severe due to critical vulnerabilities in a programming language tied to 70% of the world's websites, millions of hacking attempts have so far yielded few successful attacks.

• The defense work going on at many companies has helped, a reminder of why some researchers compare AI cyber risks to the Y2K phenomenon, when widespread attention on a software problem brought about its solution.
• Still, defenders warn that no one should be complacent.

Driving the news: Security researchers say the PHP vulnerabilities have proven unusually difficult to exploit, despite a flood of attempts to develop working attack code.

• "The hype around it might have been a little bit more aggressive than it needed," Jack Nelson, chief information security officer and deputy general counsel at Ivanti, told Axios.

Between the lines: AI-generated exploit code is adding to the chaos, making it harder for security researchers to distinguish credible threats from false alarms.

• "We're talking hundreds of proof-of-concept exploit code that did not work," Samantha Lewis, head of threat intelligence at Armadin, told Axios.
• She said inaccurate information circulating about the vulnerabilities is also being fed into AI models that people are using to try to develop exploits.

Case in point: Palo Alto Networks said Friday it had seen evidence of a cyberattack on a European government entity that started using a PHP vulnerability.

• By Sunday, the company had issued a retraction, saying attackers had compromised a PHP server in this attack, but it was unclear if they'd broken in through the PHP vulnerabilities.

Reality check: The difficulty of exploiting PHP shouldn't be mistaken for evidence that AI-powered hacking isn't a serious threat, Lewis said.

• "We don't have to wait another two years before this happens [again]," she said. "It could be three hours from now that the next one of these launches."
• Last week, Microsoft disclosed that a China-aligned actor used an AI penetration testing framework to target hundreds of organizations globally across a range of industries.

What to watch: AI is already making it easier to find and exploit longstanding security weaknesses, even if these particular vulnerabilities have proven challenging to target.

Anthropic is warning prospective investors that its powerful AI models are creating a new class of cybersecurity risks, including threats its own security systems may not be equipped to stop.

Why it matters: The company's IPO filing offers an unusually candid look at how AI's growing cyber capabilities are creating security headaches for the very companies building the technology.

The big picture: Anthropic's cybersecurity concerns are no longer hypothetical.

• The company acknowledged past failures in its security controls, incidents involving models accessing real-world systems, and delays in developing new models over fears of intellectual property theft.

Zoom in: Cybersecurity threats are scattered throughout Anthropic's S-1 filing. They fall into three broad categories:

1. Hackers exploiting Claude: Anthropic warned that malicious actors can manipulate its models to conduct cyberattacks, identify vulnerabilities, and gain unauthorized access to computer systems.
• The company cautioned that it cannot verify the identities of everyone using its models and that its safety monitoring systems have previously failed or been inadvertently disabled.
2. AI agents going rogue: Anthropic cautioned that its models can act without human direction, including circumventing security restrictions, granting themselves unauthorized permissions, and accessing real-world systems.
• During one series of cybersecurity tests, four models gained unauthorized access to third-party systems, prompting Anthropic to suspend certain evaluations.
3. Hackers targeting Anthropic: The company warned that its models are valuable targets for state-sponsored espionage, particularly as their cybersecurity capabilities improve.
• Anthropic said it has operated with known security gaps and has faced attempts by people seeking employment under false identities or with malicious motives.

The intrigue: Some of those risks are already affecting how Anthropic operates.

• The company recently delayed training a new frontier AI model for more than a month to strengthen protections against hackers stealing its model weights.
• The company also noted that its zero-data-retention agreements with some customers prevent it from reviewing past conversations to investigate potentially malicious activity.

The big picture: The warnings come as the public grows increasingly concerned about how AI models are exacerbating the internet's decades-old security weaknesses — prompting fears over cyberattacks that could hack their bank accounts or turn off water systems.

What to watch: Whether Anthropic's unusually extensive cybersecurity warnings give prospective investors pause.

Hackers are finding new ways to infect iPhones with spyware — even when victims never click a malicious link — according to new research shared with Axios.

Why it matters: Software once used to spy on politicians, journalists and other high-value targets is becoming a tool for everyday cybercriminals looking to steal cryptocurrency and login credentials.

Driving the news: Researchers at iVerify and Report URI said Thursday that they've uncovered two campaigns in which criminal groups with suspected ties to China exploited online advertising infrastructure and legitimate websites to deliver iPhone spyware.

• In one case, iVerify found that a financial institution employee's iPhone was infected after they scrolled past a professional soccer advertisement on Instagram. The ad automatically triggered an attack that stole the person's login credentials and searched their cryptocurrency wallets.
• In another, Report URI uncovered a campaign affecting nearly 8,000 legitimate websites after hackers purchased about 630 expired domains that those sites still relied on. The attackers used those domains to redirect vulnerable iPhone visitors toward spyware designed to steal their credentials and cryptocurrency.

➡️ Read the rest.

@ D.C.

🎯 CISA is planning to review its own services and concentrate resources on infrastructure whose disruption would cause the greatest harm under a new strategy published yesterday. (Nextgov)

🕵️ The Pentagon is quietly building up an elite new tech agency that can covertly disrupt and sabotage foreign technology programs. (Politico)

@ Industry

🤫 A series of suspected Signal leaks seems to be behind OpenAI's decision to fire three safety researchers for mishandling sensitive information. (Wall Street Journal)

🧑‍💻 Just one volunteer maintainer was responsible for pushing new patches for PHP last week. (The Atlantic)

🔎 Metr and Redwood Research found several vulnerabilities in OpenAI's internal systems, including exploits that agents could use to bypass monitoring, in a pilot review earlier this year. (Reuters)

@ Hackers and hacks

🔓 Researchers compromised Anthropic's internal systems, including sensitive data and messaging systems, after running its AI agents for less than 12 hours. (Washington Post)

💸 Japan-based GMO Internet said it's fending off a cyberattack on its foreign-exchange trading service after some customers reported transactions in their accounts that they don't recognize. (Bloomberg)

👀 Researchers at Cohere found evidence that one of Alibaba's Qwen models tried to send data to a cloud storage server in Beijing during a security test. (Reuters)

📲 Fun social update: I'm dabbling with a new Instagram account so we can stay in touch throughout the week!

• 📩 Give it a follow here, and reply to this email with suggestions for content you'd like to see.