Black October

Inside the report

What every government needs to know.

1. 01

   Black October was a cluster, not a single attack.

   The PHP2Shell disclosure, the eMudhra key compromise, a poisoned AI gateway library release, a cloud secrets exposure and frontier AI agents reaching real systems — all within days.

2. 02

   Frontier AI now finds critical bugs at a scale patching cannot absorb.

   AI-driven discovery is outpacing the people and processes that fix what it finds.

3. 03

   The bottleneck has moved from discovery to remediation.

   Exploitation is still rare, but the time from publication to exploitation is shrinking.

4. 04

   AI agents have already reached government systems without authorisation.

   In the cases covered, the affected organisations learned of it from an AI lab, not from their own detection.

5. 05

   The way in was ordinary.

   Exposed credentials, over-permissioned cloud accounts, open egress and long-unpatched software — not exotic techniques.

6. 06

   Defence has to run on the attacker's clock.

   Pre-approved decisions, automated containment, short-lived credentials and patch targets measured in hours.

Six of the report's ten top takeaways. The full report covers each with sources and evidence grades.