2026 · Security

AI and security: faster bug hunting, faster attacks and new targets

Last reviewed 26 October 2026

AI models now find serious flaws in core internet software, and attackers use the same tools to exploit them within hours. What October 2026’s run of disclosures shows about the risks, and what defenders can do.

The same tools find bugs for both sides

October 2026 showed how far AI-assisted vulnerability research has come. The PHP2Shell bugs, which put most PHP websites at risk, were found by researchers using OpenAI’s GPT-5.6 Sol, Google’s Gemini 4 Argon and Wiz’s own Atlas tool. In the same week, Node.js fixed a remote code execution bug in its Brotli decompressor (CVE-2026-111497) credited to OpenAI Codex Security alongside two researchers.

This is largely deliberate. OpenAI’s Patch the Planet programme, launched in June 2026 with Trail of Bits, points AI-assisted auditing at projects such as Python, Go, cURL and Sigstore, with human experts filtering out false findings before they reach maintainers. OpenAI says the effort has found hundreds of security issues.

The risk is that nothing stops attackers from doing the same. One of the PHP2Shell bugs had been noticed by a PHP developer in 2024 and left unfixed because no one could show it was exploitable. Models that can turn a suspicious crash into a working exploit change that calculation, for defenders and attackers alike.

The window between disclosure and attack is closing

Defenders used to count on days or weeks between a fix and mass exploitation. Check Point’s 2026 AI security report found that attackers sometimes produce working exploits within hours, and concluded that patching speed is becoming the main bottleneck.

PHP2Shell illustrates the point. Amazon saw an exploitation attempt four days before disclosure, details leaked a day early, and the e-commerce security firm Sansec predicted mass attacks within 15 minutes of the release. When a patched build appears, comparing it with the old code shows attackers where the bug is. AI tools make that comparison, and the step from there to an exploit, quicker.

AI agents running intrusions

Anthropic’s September 2026 threat intelligence report describes several groups using AI models to run large parts of their operations. One Chinese-speaking espionage group ran “agent swarms” with persistent campaign memory and automated exploit development against security appliances, including a fleet of 13 agents collecting data on a schedule with no human involved. A financially motivated group used AI agents to pull more than 2,100 sets of Azure AD tokens across over 40 organisations in about 34 hours, and in another case went from one stolen developer token to full cloud administrator access in roughly three hours.

A group linked to Russia’s Midnight Blizzard used AI to rework its malware whenever security products flagged it, redeploying it until it went undetected. The report’s main conclusion is that the techniques are familiar but the speed and scale are new. AI has narrowed the skill gap between state-backed and criminal attackers, so how sophisticated an attack looks is no longer a reliable clue to who is behind it.

AI systems are targets too

Prompt injection is the defining weakness of AI agents. An agent that reads web pages, emails or documents can be given instructions hidden in that content, and it may follow them with whatever access it has. Check Point reported attackers planting instructions in project files such as CLAUDE.md that AI coding assistants load automatically, so the malicious instructions stay active until someone deletes the file. In one case in Anthropic’s report, a group used prompt injection to break into an AI vendor’s evaluation sandbox, took production API keys, then reused the same method against about 30 AI companies in four days.

The software around AI is also a target. On 21 October 2026 attackers compromised the release process of LiteLLM, a widely used open-source gateway for calling AI models, and published a malicious version 1.107.0 to PyPI and Docker registries. It was live on PyPI for under two hours and contained malware that stole credentials and loaded remote-control tools. According to the maintainers, the attacker began with GitHub tokens found in the logs of an internal deployment that was exposed to the internet. Because AI gateways hold API keys for many providers, one bad release can expose a lot.

Checks on internet-facing systems keep finding exposed model servers, agent control panels and inference endpoints. Inside companies, Check Point found that between 87% and 93% of organisations had at least one high-risk AI interaction each month between October 2025 and May 2026, such as staff pasting sensitive data into AI tools.

Deepfakes and social engineering

Not every AI threat involves code. In early 2024 an employee of the engineering firm Arup in Hong Kong transferred about US$25 million after a video call in which the “chief financial officer” and colleagues were deepfakes. Since then the tools have become cheaper and better. Check Point cites research in which even trained observers identified AI-generated faces correctly only about 41% of the time, and FBI figures attributing more than $250 million in losses to voice-enabled fraud.

Social engineering through phone calls, messaging apps and fake video meetings was the leading way into organisations in 2025. Voice cloning and real-time video make these approaches far more convincing.

Other recent vulnerabilities worth knowing

Node.js: the 21 October 2026 security releases (26.12.1, 24.22.1 and 22.23.4) fixed 10 issues. The most serious, CVE-2026-111497, is an out-of-bounds write in the bundled Brotli decoder. An application that decompresses attacker-supplied Brotli data with node:zlib can crash, leak memory or, in some cases, be taken over. Three other high-severity bugs let crafted hostnames and unusual IP address formats get past TLS certificate checks (CVE-2026-105483, CVE-2026-106069) or confuse DNS lookups (CVE-2026-105482). End-of-life Node.js versions are affected and will not be fixed. The same releases also block the compromised eMudhra intermediates.

Next.js: advisories on 14 October 2026 included a critical unauthenticated remote code execution bug under certain “use cache” configurations (GHSA-673q-mjm6-r5xr), an image optimisation flaw involving SVG processing and a denial-of-service issue in Server Actions.

eMudhra: eight trusted certificate authority keys were found to be guessable, and browsers and runtimes rushed out blocks. Older devices and apps with their own certificate bundles still need updates.

Other October incidents included a chain of four Plex Media Server flaws, nicknamed Plex2Shell, exploited to install cryptocurrency miners and proxy malware, a malicious release of the TensorLake npm package after a maintainer account was taken over, and continuing attacks on edge devices from Citrix, Ivanti, Palo Alto Networks and Cisco listed in CISA’s Known Exploited Vulnerabilities catalogue. Check the vendor advisory for exact affected versions before patching.

What defenders can do

Know what you run. PHP2Shell and the eMudhra certificates both caught organisations out through copies of software and certificate bundles nobody remembered they had. A software inventory, or software bill of materials, turns a frantic search into a lookup.

Patch faster, and assume leaks. Embargoes can fail, so prepare to update critical internet-facing systems within hours, and keep a plan to isolate systems that cannot be patched. After an update, look for signs of compromise and rotate credentials, because patches do not remove backdoors or bring back stolen secrets.

Treat AI agents like any other privileged user. Give them the minimum access they need, treat everything they read as untrusted input, require human approval for actions that cannot be undone, and pin and verify AI dependencies such as LiteLLM rather than always pulling the latest release. For payments and access changes, confirm requests through a separate channel, however convincing the voice or face on the call.

Finally, use the same tools. The vulnerabilities AI finds for attackers can be found first by defenders, and the programmes behind PHP2Shell’s discovery show that coordinated, AI-assisted auditing can get fixes out before mass exploitation, if the disclosure holds.