About This Video
A 25-minute video from Nate B. Jones (channel "AI News & Strategy Daily | Nate B Jones"), published October 24, 2026. He walks through a week of security incidents he calls "Black October," explains why AI API keys now behave like cash, and lays out what individuals, builders, and defenders should do.
Summary
Jones argues that agents are native to computers, so they find old bugs quickly and cheaply, for attackers and defenders alike. He covers the PHP fixes of October 21st, a certificate company with trivially weak keys, and a poisoned release of an AI gateway tool. He then shows how to investigate such an incident with AI help, why defenders should use the strongest available model, and ends with five personal steps and guidance for builders.
The Incidents He Describes
- PHP (02:25). PHP released fixes for two critical vulnerabilities on October 21st. With Apache's mod PHP setup, an attacker can get code to run before the website's own application code starts, which lets them hijack the platform. UK and European agencies told organizations to consider isolating or taking down affected systems they cannot update or mitigate quickly.
- Certificate company (03:31). Eight of its private keys were trivially weak. Researcher Scott Helm recovered them in under a second, and one supposedly secret key was the number four. Because the company was a trusted root issuer, one mistake cascaded across the internet (04:14). Helm says he got Claude to recover the keys with a single prompt.
- Microsoft (05:20). Microsoft documented a China state aligned group using an AI agent framework against hundreds of organizations. Most attempts failed, but some reached privileged cloud access in a couple of hours. One vector is a proxy attack that reuses credentials customers already trusted.
- LiteLLM (12:40). A tool that connects applications to AI models had a release containing credential-stealing malware, after an earlier compromise in March. The advice is to treat the environment as compromised, follow containment steps, and rotate secrets.
- Posty (17:00). A small AI startup founder paused his service for a few hours on October 21st after warnings that the company's Anthropic and Stripe keys were compromised, as part of the Railway hack.
Key Ideas
- Agents are native to computing (01:50). LLMs are tool-using inhabitants of computer systems and never get tired, so the best agents must be on the defense side.
- Offense and defense look the same (06:45). Reading unfamiliar code, noticing something suspicious, writing a test, running it, and retrying is the same loop for both. Some model safeguards against offense trip up defenders (07:15), so defenders should confirm they have access to the strongest models.
- Attack cost is tied to computation (07:48). A target should assume it may face a cheap, well-equipped operation run by a single person.
- Time to fix is shrinking (08:50). PHP's maintainers saw signs of one problem in 2024, and the fix stalled. Jones says AI removes the time defenders used to have for a two-year tradeoff conversation.
- Scale of exposure (09:40). Anthropic reported more than 29,000 candidate vulnerabilities from six months of scanning important projects, with about 6,000 manually reviewed so far.
- An AI key is like cash (15:55). A stolen key lets someone else do work and charge you for it, so investigations should check whether keys were used or billed.
- Reduce surface area (20:30 and 21:00). Anthropic's work across 25 projects identified almost 500 opportunities to reduce exposed code and unsafe configuration interactions. In OpenSSH, Claude helped identify signature-handling code reachable before authentication, and version 10.6 removed code an unauthenticated client could previously reach (21:36).
The LiteLLM Walkthrough
- A customer app sends requests through an AI gateway that holds provider keys, and build jobs use the same gateway (13:20).
- The source repository looks clean and the running gateway has been upgraded, but the disclosure says the official source tag was clean while the distributed release held malicious files (13:44).
- The malicious release ran in a build job that finished hours ago. No process is left to stop, but that job's identity could retrieve production provider keys (14:30).
- To choose a model, give candidates the same evidence and tools in a safe replay of an incident where you know the answer, then see which one goes past the clean repository to the build record and the credentials (15:00). Jones says this is not a place to be cheap.
- LiteLLM also said it saw Claude Code put a user's GitHub credential into a response that could end up in logs, and believes attackers got credentials from internal deployment logs (17:45).
Five Steps for Individuals (23:51)
- Update your browser, phone, computer, and apps, and finish any required restart.
- Open connected app settings for important accounts, starting with email and files, and remove connections you do not use.
- Review browser extensions, remove unused ones, and restrict site access for the rest.
- Use a password manager with unique passwords, turn on multifactor authentication, and add a voice passphrase for family.
- When a breach notice arrives, check what was exposed and act at once: change passwords, revoke app connections, and rotate API secrets if you are a developer.
Guidance for Builders and Defenders
- Lean toward transparency with customers (24:34 onward): explain what you know, what is uncertain, and where access has stopped (19:40).
- Use the LiteLLM scenario as a test bed in a test environment, run against different models (25:17).
- Patching faster is necessary but not enough. Understand chained relationships in your systems and shrink what attackers can reach before the next bug (22:20).
- Funding may be needed. Jones notes Bank of America took a charge of a couple of hundred million dollars last quarter to hire cyber defenders (23:07).
Reflect
- Which apps and extensions have access to your email and files, and do you still need each one?
- If a tool you depend on shipped a bad release, which keys could it have reached?
- How would you test whether an AI model can follow an incident past the obvious clean answer?