Everything That Got Hacked in October

Top AI and Cybersecurity news you should check out today

Author

Rodrigo Fernandez
November 02, 2026

Welcome Back to The AI Trust Letter

Once a week, we distill the most critical AI & cybersecurity stories for builders, strategists, and researchers. Let’s dive in!

This month's hack list (October 2026):

🧪 Anthropic Says Its Unreleased AI Turned Software Bugs Into Working Attacks on Chrome, Safari, Windows and Linux

The Story: 

Anthropic, the company behind Claude, said on Oct 27 that an unreleased AI model it uses internally found security flaws in widely used software and combined them into working attacks. The targets were Chrome, Safari, Android phones, Windows and Linux (the system that runs most of the world's servers). In one demo, simply opening a web page in Chrome on a Mac was enough for the attack to run code on the computer. Anthropic says it reported every flaw to the software makers first, all are now fixed, and none was used by real attackers.

The details:

  • The Chrome attack chained four separate bugs, each one opening the next door, until it escaped Chrome's "sandbox" (the walled-off area that stops websites from touching the rest of your computer). Anthropic says it has reported 62 Chrome flaws to Google in total, all rated critical or high, and all fixed as of Chrome 156 on Oct 20.

  • The Safari attack let any website read data from other sites the user was logged into, such as email or banking tabs. Apple fixed it on June 29. The Android attack copied data off a locked phone plugged in by USB.

  • On Linux, the model found a way to take full control ("root" access) of a server over the internet, with no password, in under an hour. The bug (CVE-2026-98432, rated 9.8 out of 10) was fixed on Oct 15, but as of Oct 29 Ubuntu and Red Hat, two of the most used versions of Linux, had not yet shipped the fix.

  • A note of caution: The Hacker News points out that public records for the Windows and Linux bugs do not fully match Anthropic's description, and only Anthropic knows how much of each attack the AI built by itself. Anthropic gives software makers 90 days to fix a flaw, plus 45 more, before sharing details.

Why it matters: 

Finding a bug is one thing. Turning it into a working attack used to take skilled people weeks. If AI can now do both steps, the time between a flaw becoming known and someone using it gets much shorter. The Linux case shows the risk: a fix existed for two weeks, but many companies could not install it yet. For security leaders, how fast updates get installed is now the number to watch.

🧠 Google and OpenAI Release New AI Models They Rate Among the Best Ever at Hacking

The Story: 

Google launched Gemini 4 Carbon on Oct 28 and says it is its best model yet at cybersecurity tasks. The same week, OpenAI released GPT-6.1 Terra and said it reaches the "Critical" level for cybersecurity, the highest level on its own risk scale. Because these models are so good at finding and exploiting software flaws, both companies are limiting who can use them for that kind of work. Together with Anthropic's news above, all three leading AI labs now say their newest models are serious hacking tools.

The details:

  • Google says Carbon found vulnerabilities 88.2% of the time on one industry test (SEC-bench Pro), built working attacks 54.8% of the time on another (ExploitGym) and fixed flaws 71.0% of the time on a third (CWE-bench). These are Google's own numbers, not independent results.

  • On the Artificial Analysis Intelligence Index, an independent ranking of overall model ability, Carbon scores 59. That puts it just ahead of Anthropic's Claude Opus 5.5 (58) and OpenAI's GPT-6 Astra (57) and GPT-6.1 Sol (55).

  • Carbon goes first to a small group of security defenders, then to trusted partners through Google's Fairwind Program. Google also says the model blocked every "indirect prompt injection" it tested (hidden instructions planted in web pages or files to trick an AI into doing something it shouldn't).

  • OpenAI says GPT-6.1 Terra keeps the safety protections built for GPT-6 Astra and is "more likely to stay within scope and honestly disclose limitations" than the previous version. It also says the model resisted malicious instructions well in tests.

Why it matters: 

AI labs now treat their best models like powerful tools that need a license, giving full access only to vetted security teams. That creates a gap between organizations inside those programs and those outside. The safety claims are promising, but they come from the companies themselves. Before trusting a model in your own systems, test it on your own workflows.

🧩 A Fake Update to the Claude Code Plugin Gave Hackers Access to Up to 5,000 Developers' Computers

The Story: 

On Oct 29, a tampered version of the official Claude Code extension (an add-on that brings Anthropic's AI coding assistant into a code editor) appeared on the Cursor Marketplace, the app store for the popular AI code editor Cursor. It looked legitimate because it was published under the real publisher's name. Cursor says up to 5,000 people installed it during a window of about 11 hours. The fake version quietly gave attackers a back door into those computers. Cursor temporarily shut down its marketplace, and Anthropic says its own systems were not breached.

The details:

  • The malicious versions (2.1.312 and 2.1.313) added the attacker's digital key to the computer's list of trusted remote logins (SSH), so the attacker could log in at any time. They also opened a hidden connection to the attacker's server.

  • The malware sent back basic computer details, including the names of up to 40 settings that usually hold passwords and access keys (anything with KEY, TOKEN, SECRET, PASS, AWS or GCP in the name). It also set itself up to restart every time the computer did.

  • Cursor said: "This malicious version of the extension was not developed by Anthropic." The official versions on Microsoft's VS Code Marketplace and on Open VSX were not affected, and the clean version is 2.1.314.

  • Researchers at OpenSourceMalware (Jenn Gile and Paul McCarty), Socket and Microsoft analyzed the attack alongside Cursor. Anyone affected should remove unknown login keys, check for unfamiliar scheduled tasks and change any passwords or access keys stored on the machine.

Why it matters: 

AI coding assistants run with the same access as the developer using them, which often includes cloud accounts, company code and server logins. One poisoned update turned a trusted name into an entry point to thousands of engineering machines in less than a day. Companies need to know which AI add-ons their teams use, where they came from and which versions are installed. The next story shows attackers going after the same tools a different way: through the instructions they read.

📂 A Hidden Text File Tried to Trick an AI Coding Assistant Into Installing Malware

The Story: 

Security firm Forever Security found a booby-trapped instructions file on a customer's computer that tried to make an AI coding assistant install malware, The Hacker News reported on Oct 26. The file was called AGENTS.md, a plain text file that AI coding assistants automatically read and follow when they start working in a folder. It sat in the developer's Downloads folder and looked like ordinary engineering notes. Forever stopped the AI before anything ran, but could not tell how the file got there.

The details:

  • The file told the AI to install a software package called function-color from npm (a huge public library of free code). That package secretly downloads Windows malware, part of a campaign other researchers (CloudSEK and Checkmarx) had already named MALFEX.

  • When Forever replayed the real file on a safe test machine, OpenAI's Codex coding assistant followed it and installed the malware in more than 90% of attempts. It also changed Codex's global settings, so the attacker's server would load in every future session.

  • A similar trick against Anthropic's Claude Code tried to redirect the assistant's traffic to the attacker's server, which would expose the user's login and let the attacker send commands. Claude Code usually asks the user for permission first, but the convincing notes got that permission "about half the time," researchers said.

  • Forever showed that a web page can silently save a file to your Downloads folder without any click. It says about half of its customers run an AI coding assistant in that folder, and adds: "There is nothing here for OpenAI or Anthropic to patch."

Why it matters: 

For an AI assistant, a text file can be as dangerous as a program. These tools are designed to trust and follow instruction files, so one planted in the right folder works like a remote control. Together with the fake extension above, this shows the risk is less about the AI model and more about what it is allowed to read and do. Simple rules help: never run AI assistants in Downloads, read instruction files you did not write, and keep approval prompts switched on.

🔓 Chainalysis Says Attackers Used "Agentic" Hacking Techniques to Break Into Its Systems

The Story: 

Chainalysis, a company that tracks cryptocurrency transactions for investigators, banks and governments, said on Oct 30 that an outside attacker broke into its systems and internal tools this month. The company said the attacker used "offensive agentic techniques," a term that usually means AI agents (AI programs that take actions on their own) carrying out parts of the attack. The intruder reached basic information about customers' users, but not investigation data, passwords or login sessions. It is one of the first times a named company has described a breach this way.

The details:

  • The exposed data includes user IDs, full names, email addresses and job role labels for people using the Chainalysis platform, plus information about their organizations.

  • Chainalysis says it is "patching vulnerabilities and hardening its systems." It has not said exactly when the attack started, how it worked or which AI tools were involved.

  • The company said: "We are seeing an industry-wide rise in AI-driven cyber attacks, and we are taking a whole-of-company approach to make sure our security posture meets the evolving environment."

  • The same week, researchers at TrendAI found attacker servers running a platform called CyberStrikeAI that split an attack into jobs for 44 AI agents. It tested at least 19 organizations, 16 of them in Japan, and wrote a tidy report on each target automatically.

Why it matters: 

AI-run attacks are moving from lab experiments to real breach notices. Names, emails and job titles may sound harmless, but for a company whose customers are investigators and compliance teams, they make a perfect list for targeted phishing emails. Expect more companies to mention AI in their breach reports, and expect customers to ask how you would spot an attacker that works at machine speed.

🔑 26,400 Working Passwords and Keys Found in Public Code, Including Thousands That Let Strangers Run Up AI Bills

The Story: 

Independent researcher Ben Zimmermann scanned 7.25 million public code projects on Gitee (a Chinese alternative to GitHub) and found 26,400 working credentials, publishing his findings on Oct 28. Credentials are the digital keys that let software log in to cloud services. Thousands of them were keys for AI services like DeepSeek and OpenAI: anyone who finds one can use the AI, and the owner gets the bill. He has not confirmed that any of the exposed keys has been switched off.

The details:

  • The haul includes 9,473 Alibaba Cloud keys, 3,805 Google Cloud (YouTube) keys, 3,170 DeepSeek keys, 1,489 Zhipu BigModel keys and 1,348 OpenAI keys. One was an active administrator key for an unnamed major enterprise AI platform.

  • He searched each project's full history, so keys that developers had already deleted from their code still showed up. Two scanning tools found 12,737 and 14,664 keys, but only 1,001 overlapped, so either tool alone would have missed about half.

  • Nearly half of the keys (12,242) came from code saved in 2025. Gitee had 3.64 working keys for every 1,000 projects, though the article warns this is not a fair comparison with other code sites.

  • He alerted the companies with the most exposed keys but not the individual developers. OpenAI warns that a stolen key can cause "unexpected charges" and use up your monthly limit, and advises replacing it right away and setting spending caps.

Why it matters: 

An AI access key is basically a company credit card written in plain text. If it leaks, the damage shows up as a surprise bill and as AI services that suddenly stop working. The fake extension in the third story was hunting for exactly these keys. The fix is simple to say: keys that expire quickly, spending limits on every AI account and alerts when usage suddenly jumps.

What’s next?

Thanks for reading! If this brought you value, share it with a colleague or post it to your feed. For more curated insight into the world of AI and security, stay connected.

NeuralTrust | The leading security platform for generative AI

Our platform uncovers vulnerabilities, blocks attacks, monitors performance, and ensures regulatory compliance: everything enterprises need to scale AI

neuraltrust.ai