This was the week AI cyberattacks moved from demos into incident reports. A state-backed group ran an AI agent framework against more than 200 organizations, a poisoned copy of a popular AI coding extension reached developers' machines, and stolen AI API keys kept turning up in breach after breach. The pattern underneath is worth noticing: in most of these cases the way in was ordinary (a reused password, a leaked key, an unpatched server, someone else's software). AI made the rest of the attack faster.
Here are the stories that matter for a small or mid-sized business, and what to do about them.
This week's stories
State hackers used AI agents against 200+ organizations
AI-powered attack · CyberScoop · Oct 30
CrowdStrike says a China-linked group it tracks as Vapor Panda used ARTEX, an "agentic" penetration-testing framework, together with AI models to break into and move through networks, with a person directing the agents. More than 200 organizations in at least 14 countries were targeted, including government ministries, defense bodies, telecoms and US companies in pharmaceuticals, semiconductors and finance. Reports differ on how many were actually compromised: CyberScoop puts it around 140, while The Hacker News says follow-on activity was confirmed at nine organizations. CrowdStrike says the agents ran far more commands per hour than a human operator could.
Why it matters: the techniques are familiar, but automated attackers find weak passwords and exposed services much faster, so the gap between "we'll patch it soon" and "we got hit" keeps shrinking.
Also covered by The Hacker News.
A backdoored Claude Code extension reached Cursor users
Attack on AI tools · BleepingComputer · Oct 30
For about 11 hours on October 29, Cursor's extension marketplace served a tampered build of Anthropic's official Claude Code extension that tried to plant a hidden remote login on developers' computers. Cursor says at most 5,000 users received it; no confirmed break-ins have been reported. Plain VS Code users weren't affected. We cover what to check in our full write-up.
Why it matters: your developers' laptops can reach your code, cloud accounts and customer data. A poisoned tool on one of them is a way into all of it.
Chainalysis blames its breach on "offensive agentic techniques"
AI-powered attack · BleepingComputer · Oct 31
Blockchain-analysis firm Chainalysis says an outside attacker got into internal systems and tools earlier in October and accessed customer users' names, email addresses, IDs and role labels. The company says it has no evidence investigation data, credentials or session tokens were taken. Its only description of AI's role is the phrase in its disclosure; it hasn't said how the attacker got in or how long they had access.
Why it matters: after a vendor breach, the next wave is usually phishing that impersonates that vendor, and Chainalysis is already warning customers about fake "fund recovery" offers.
Also covered by The Hacker News.
PHP2Shell attacks keep landing
Flaw found or exploited with AI · The Hacker News · Oct 28
Israeli security firm Dream reported a campaign that chained the two PHP2Shell flaws with a Linux privilege bug to take full control of 25 servers in the US and Asia, three of them in a US government-affiliated network. The targets were firewall management interfaces running an old PHP version, not websites, and Dream's view that the attacker used AI tools rests on its own analysis. Attack attempts are in the millions, but WordPress security firm Wordfence still knew of no WordPress site compromised through the flaws as of October 28. If you have a website, start with our plain-English guide.
Why it matters: most small-business websites run on PHP. Major hosts patched within a day or two, but sites on a VPS, a dedicated server or an old PHP version are the owner's job to fix.
Stolen AI API keys, again
Attack on AI tools · BleepingComputer · Oct 31
Hosting platform Northflank told customers to assume the settings where their apps keep passwords and keys had been decrypted, after customers reported their stored AI keys being abused. Separately, a researcher found 26,400 working cloud and AI credentials sitting in public code repositories on Gitee. Both follow last week's breaches at Railway and OpenCode and the poisoned LiteLLM release. Our guide to protecting AI keys covers what to do.
Why it matters: an AI key is effectively a company credit card. Stolen ones get drained, resold or used to run someone else's operation on your bill.
Also covered by The Hacker News.
An unreleased AI model chained bugs into working exploits, including Linux remote root
Flaw found or exploited with AI · BleepingComputer · Oct 30
Anthropic's research team says an unreleased model found and chained flaws into lab exploits against Chrome, Safari, Android, Windows and Linux, reporting each to the vendor first. The most practical result is a Linux kernel flaw (CVE-2026-98432) that can give an attacker full control of servers with a feature called MPTCP listening. Debian has shipped fixes and Red Hat has fixes planned; Ubuntu had none as of October 30. Severity ratings differ (9.8 from the kernel team, 5.9 from Red Hat), and no attacks using it have been reported.
Why it matters: if you run Linux servers, or a developer runs them for you, this is the most concrete patching task of the week.
Also covered by The Hacker News.
123 Reg says a September breach was "AI-driven"
AI-powered attack · The Register · Oct 28
UK domain registrar 123 Reg told customers an attacker read contact details, VAT numbers and product information in September. The company says it found AI attack tooling, including ARTEX, on infrastructure it links to the attacker, and suspects a Chinese state group; those attributions are the company's own and haven't been independently verified. It has reported the breach to regulators and law enforcement.
Why it matters: your domain registrar holds the keys to your website and email. A breach there hands phishers convincing details to target those accounts.
An extortion crew spent $7,000 on AI, then left its workspace open
AI-powered attack · The Register · Oct 30
Researchers at SOCRadar found an exposed server belonging to an extortion group, holding its attack scripts and an AI coding agent wired to seven AI providers, with more than $7,000 in AI spending. The AI wrote and debugged their scripts, but the way in was entirely conventional: stolen or weak passwords, remote-desktop scanning, password-stuffing against VPN logins, and an exposed cloud key.
Why it matters: this is the clearest picture yet of how criminals actually use AI, and it says the old defenses still decide the outcome: unique passwords, multi-factor logins, and nothing exposed that doesn't need to be.
A security startup says its AI agents got into Anthropic's business systems; Anthropic disputes the details
Attack on AI tools · SecurityWeek · Oct 30
A startup called Cathedral, testing under Anthropic's bug bounty program, says its AI agents reached internal business systems through connected third-party software. Anthropic says the agents reached only a limited set of sales, HR and IT systems, nothing to do with its models or customers' chats, and that Cathedral broke the program's rules; Cathedral says it followed standard practice. The full report isn't public.
Why it matters: whatever the final details, the path in was connected third-party business software, the same apps most companies wire together without a second thought.
Also covered by The Decoder.
New infostealer uses AI to size up its victims
AI-powered attack · Cisco Talos · Oct 31
Cisco's Talos researchers describe VOLTA, password-stealing malware for Windows that sends what it collects (logins, cookies, card details, cloud keys, even receipts found in a signed-in Gmail account) to AI models to rank how valuable each victim is. Talos hasn't reported how many people it has infected, and the details so far come from its own analysis.
Why it matters: personal browsing on work computers turns into material for targeting the business. Keeping work and personal accounts on separate browser profiles limits what one infection exposes.
Also this week
- OpenAI fixed a bug that let a shared ChatGPT link run an attacker's code and read private chats; no attacks using it were reported (The Hacker News).
- Researchers found flaws in the built-in browsers of five AI coding tools, with some still unpatched (The Register).
- Fake ChatGPT and Claude desktop apps were used to install cryptocurrency miners (The Hacker News).
- An AI agent found four serious bugs in industrial-control software in under four hours, prompting a CISA advisory (The Register).
- The UK announced £130 million for AI-powered cyber defense (The Register).
What to do this week
- Confirm every website you run is on patched PHP (8.2.35, 8.3.36, 8.4.27, 8.5.12 or newer), and get that in writing from your host.
- Ask whoever manages your Linux servers whether the MPTCP kernel fix applies to you, and when it will be installed.
- Rotate any AI API keys stored on Railway, OpenCode or Northflank, and set spending caps on every AI account.
- If anyone on your team uses the Cursor editor, check for the Claude Code backdoor using the steps in our write-up.
- Turn on multi-factor sign-in for VPN, remote desktop, email and your domain registrar, and retire any shared or reused passwords.
- Treat "fund recovery", job and support offers that arrive after a vendor's breach as phishing until proven otherwise.
AI Threat Watch rounds up the week's AI-related security news from 14 security publications, summarized for small and mid-sized businesses. Every summary links to the original reporting; read it before acting on the details. Claims attributed to a single company or research firm are marked as theirs.