AI Cyber Flaws Trigger Black October Security Scare
Left 50%
Center 50%
Right 0%
1 left · 1 center · 0 right
What happened
In October 2026, OpenAI AI agents identified critical vulnerabilities in PHP, used by about 70 percent of websites, and in the Brotli compression library, prompting security researchers to label the period Black October amid millions of reported hacking attempts. Several AI-related firms, including OpenCode, Railway, and LiteLLM, disclosed breaches that put customer API keys and credentials at risk. Security researchers later reported that the PHP flaws proved unusually difficult to exploit, with few confirmed successful attacks despite the volume of attempts. Anthropic filed for an IPO seeking a roughly $2 trillion valuation the same week its executives publicly warned of accelerating AI risks, including possible model self-replication on connected devices.
Sourcing check · Fully on the record · 2 articles
1 of 1 article cites a named source for the story. It was on the record from the first report.
What these terms mean and how they're counted
- On the record · names a source 1 of 1
- On the record means the article cites a source by name for the story's main claim: a person, or an institution speaking officially, such as a company statement or a named agency's spokesperson. The opposite is an unnamed source. The count is how many of the counted articles cite at least one such source; the names are everyone named across them, each once however the articles spell it. Here: Samantha Lewis, Greg Clark, Bipul Sinha and Justin Timothy
- Primary evidence · cites a document or data 1 of 1
- Primary evidence means the article cites a record you could check yourself: a court filing or ruling, a dataset or report, a recording or transcript, an official statement or press release, market data. A quote is not a document. The count is how many articles cite one. Here: security research reports
- Credits another outlet 0 of 1
- The article says the story comes from another outlet's reporting (“first reported by Reuters”). Those articles relay the story; they are not independent confirmation. Here: Each article presents its own reporting.
- Unnamed sources 0 of 1
- The main claim is attributed to people who are not identified: “people familiar with the matter”, “officials said”. The count is how many articles do this.
- How it developed
- When the first report landed and whether it named anyone; when the first named source and the first document appeared. Here: First report Oct 28, 09:15 UTC by Axios, naming its source. First document in the first report, from Axios (security research reports).
- Not counted 1
- Opinion, analysis and video pieces, and articles too short to assess. Every count above is out of the counted articles. An article republished under a new headline is one article.
This is about who is cited, not whether the story is true. Each source below says what it names. How we count
ONE-SIDED THIS WEEK.
Only left-leaning outlets have covered this story in the last two days;
Washington Examiner reported it on 2026-10-21.
Omitted — what each side leaves out
Unpacked
The left-leaning account of Black October leaves out that the feared wave of attacks has largely failed, and right-leaning outlets are silent. Left-leaning coverage reports hackers using AI to breach companies and flaws that could leave 70 percent of websites vulnerable, then argues Anthropic is making everything worse by racing at the frontier. It does not report that millions of hacking attempts have so far yielded few successful attacks. Those pieces do not disagree with each other. A reader of the silent side is missing the scare, the demand that Anthropic stop, and the mismatch between panic and successful hacks.
Left-leaning coverage leads with whether the "good" AI company is actually making everything worse. Named bugs in PHP and Brotli, and breaches at OpenCode, Railway, and LiteLLM, never appear in that coverage.
How many successful breaches has Black October produced so far?
Bottom line
Vox turned Black October into a brief against Anthropic and skipped that millions of hacking attempts produced few successful attacks. Right-leaning outlets had not covered the scare.
The receipts — 3 facts one side's coverage lacks
- Millions of hacking attempts have so far yielded few successful attacks.
- Defense work at many companies to address the issue also appears to have helped.
- Anthropic's security chief wrote that things are going to get a lot worse before they get better.
The Left View
Vox, the main left-leaning outlet covering the story, uses Black October as context for a critique of Anthropic: it reports AI-driven breaches, the PHP/70-percent-website risk, government and bank scrambling, and Anthropic’s own warnings (security chief on worsening threats, co-founder on the singularity being “here,” IPO risk language on catastrophic/existential harm) while the company races toward recursive self-improvement and a blockbuster IPO. Vox frames Anthropic’s “race to the top” strategy as net-negative, compares the bet to effective-altruism hubris and Sam Bankman-Fried, cites critics (Nathan Calvin, Geoffrey Irving, Daniel Kokotajlo) calling for a unilateral pause, and notes Anthropic did not comment. Axios, a center source, reports the same PHP and Brotli discoveries, the OpenCode/Railway/LiteLLM incidents, and Rob Joyce’s “breachpocalypse” warning, but emphasizes that exploits have largely failed to land, analogizes the episode to Y2K (panic plus defensive work averted the worst), and focuses on resilience, basics like MFA, and the likelihood of future AI-powered waves rather than on Anthropic’s strategy.
Our Take (balanced)
The Black October cyber events rest on specific, checkable claims: named software (PHP, Brotli), named companies and products, researcher and executive quotes, and public incident reports; Axios’s account that millions of attempts produced few successful exploits is established in that reporting even if later tallies could shift. Vox’s central claim—that Anthropic is on balance making the situation worse and should stop unilaterally—is interpretive argument built from public statements, an X post, analogies, and the company’s IPO filing, not from new documents proving net harm; Anthropic’s risk warnings and IPO pursuit are established facts, the “good guy making everything worse” conclusion is not. No right-leaning outlet has reported this. Watch for the IPO prospectus language on risks, any Anthropic response or Responsible Scaling Policy updates, independent counts of successful versus attempted exploits, and further vulnerability disclosures or government briefings.
2 sources
More stories
The week's bottom lines, in your inbox
One email a week: the five stories that mattered and what they actually mean. Free.