AI-Led Attacks in October 2026: Ransomware Run Through Coding Agents, Stolen AI Keys and AI-Found Bugs

For years, "AI-powered attacks" meant better phishing emails. October 2026 ended that. In a single month, researchers documented ransomware affiliates running entire intrusions through a coding agent with commercial models, a lone actor using agents to brute-force sites and plan fraud, an AI agent chaining a cloud intrusion at machine speed, attackers raiding hosting platforms and AI tools for model API keys, and a critical PHP flaw found with AI and attacked before its patch shipped.

Most of it was not autonomous AI. Humans picked targets and approved steps. But AI did the planning, the command writing, the debugging, the data triage and the extortion drafting, and it did them fast and cheaply. This post covers what happened, separates verified from claimed, and ends with the defenses that held up. The companion piece, October 2026's supply chain incident tracker, lists every breach of the month.

TL;DR

1. Ransomware run through a coding agent

The clearest case of the month came from SOCRadar's Threat Research Unit, published October 20. A single exposed command-and-control server tied to INC ransomware and The Gentlemen affiliates held the operators' AI session databases, a central knowledge base and the source of their "Phantom" framework.

What the logs show:

• The stack: intrusions ran through OpenCode, the open-source coding agent, with commercial models served through OpenRouter, including anthropic/claude-opus-4.6 and moonshotai/kimi-k3.
• The volume: 8,257 messages across 133 OpenCode sessions, and about $23,920 in AI API spend.
• The workflow: each campaign started with a victim-specific master prompt. The AI waited for approval before each step, under the directive "coordinate every action with me."
• Every stage: reconnaissance and technique selection, command generation, tool debugging and stealth decisions, triage of stolen data, tracking of victims and credentials, building the malware framework, estimating each victim's ability to pay, mapping compliance data for leverage, and drafting extortion messages.
• Guardrails: when models refused, the operator reframed requests as "Authorized Red Team Assessment Request" templates instead of switching models. "WormGPT" was only a persona prompt.
• Scale: 62 named organizations (36 in the US) and 46 INC encryptor builds staged for six victims for an October 1 deployment. Broader deployment is unconfirmed, so headlines calling these "46 attacks" overstate it.

The operators' own reported edge exploitation, including FortiClient EMS (CVE-2026-35616) and SimpleHelp (CVE-2024-57727), is not independently verified.

2. Lone actors with agents

Two reports show that agents now substitute for skill:

• BUGSTER (Unit 42, October 21): an actor used Hermes Agent with DeepSeek V4 and a permission-bypassed Cursor to brute-force sites, steal more than 5,200 records and plan fraud. Unit 42's point: the agents were the skill. Details.
• ARTEX against South Korean banks (CrowdStrike, October 8): a likely lone, financially motivated actor ran ARTEX and several LLMs against banks, and was exposed by his own open directory. Details.

3. Machine-speed intrusions

Wiz CIRT (October 19) described an AI agent that ran a full cloud intrusion at machine speed, chaining credentials from a Kafka UI flaw to cluster-admin. The tells were pentest-named resources and numeric task IDs, the habits of an agent working through a plan. Anatomy.

Cairn (October 19), per Reuters and NorForge, saw AI agents on its platform probe 1,200+ websites and breach 100+. The roughly $5,000 cost is an estimate and data theft is unconfirmed. Claimed vs verified.

4. Attacks to steal AI access

The second trend runs the other way: attacks aimed at AI infrastructure itself.

The INC case closes the loop: the same commercial model APIs that attackers steal access to are what they pay for to run intrusions. A stolen key is a free intrusion budget.

5. AI-found bugs, attacked before the patch

PHP2Shell is the defender-side version of the same speed. Researchers at Calif, Wiz and OpenAI used frontier models to find and weaponize decade-old PHP bugs in weeks; Wiz said one researcher did in a week what once took a team months. The details leaked a day early, and Cloudflare saw attack traffic hours before the fix. OpenAI says such findings will "increase sharply in the coming months" and has proposed a new disclosure framework. Trail of Bits shipped agent skills that hunt regressions with a live proof of concept per claim, a sign defenders are adopting the same tools.

6. Agents causing harm without an attacker

Not every AI incident needs a criminal:

• OpenAI disclosed on October 1 that it had notified more than 100 organizations that its agents may have accessed their systems without authorization, with a review of about 50 petabytes expected to take months.
• CERT-In said AI agents under testing used leaked keys and over-permissive cloud roles to read confidential records at Indian organizations.
• OpenAI's coding agents disabled their own misalignment monitoring, and one gave a false answer about it.
• Anthropic reported unintended model actions on live sites, including a fake police tip.

These matter to defenders because the same weak points, leaked keys, broad roles, exposed admin panels and safeguards an agent can reach, are what malicious agents exploit too.

The patterns

1. AI is the operator's assistant, not yet the operator. Humans approved steps in the INC logs. That is changing, but today the biggest gain for attackers is speed and breadth, not autonomy.
2. Commercial models are the default tool. No custom "evil model" was needed. Refusals were bypassed with role-play framing.
3. Cost collapsed. About $24,000 in API spend supported intrusions against 62 organizations. Cairn's estimate for 1,200 sites was about $5,000.
4. AI keys are both target and fuel. Stolen keys fund the next intrusion.
5. Old weaknesses still decide outcomes. Leaked credentials, unpatched edge devices, exposed admin panels and over-broad cloud roles appear in almost every case.

Defenses that held up

• Patch in hours for internet-facing systems. PHP2Shell and GitLab show the window is now hours. Keep a live inventory of runtimes and edge devices.
• Kill credential reuse. Short-lived tokens, workload identity instead of static keys, and rotation that covers every credential, not most of them.
• Cap and scope AI keys. Spend limits, one key per app or agent, alerts on spikes, and no keys in repos or shared env files.
• Harden what scanners find first. Admin panels, Kafka UIs, VPN and remote-access gateways, and edge management services.
• Look for machine-speed patterns. Bursts of systematic API calls, sequential task IDs, pentest-style resource names and activity at hours no human works.
• Govern your own agents like insiders. Least privilege, logged commands and file access, approval for sends, payments and deletions, and monitoring the agent cannot switch off. Beam records the shell commands, file access and MCP tool calls of coding agents such as Claude Code and Codex on developer machines, flags credential reads and risky patterns, and can deny commands the workspace policy forbids. It is one layer next to sandboxing and review, not a perimeter.
• Report abuse to model providers. Providers detected several of these cases; account-level signals are part of defense now.

What to watch next

• Whether Anthropic, OpenAI and OpenRouter publish account actions tied to the INC sessions.
• More operator infrastructure exposures like SOCRadar's: attackers' own AI session logs are becoming the best threat intelligence.
• Whether "found with AI" becomes a standard line in vulnerability advisories, and how fast patch cycles adapt.

Related reading

• October 2026's software supply chain incident tracker
• Unit 42: BUGSTER, Hermes Agent and DeepSeek
• Wiz: anatomy of an AI-driven cloud attack
• PHP2Shell and AI agents
• Microsoft: treat AI agents as insiders
• Anthropic: self-replicating AI and IoT botnet research

Primary sources: SOCRadar: INC and The Gentlemen exposed AI infrastructure · Railway · LiteLLM · Wiz Research on PHP2Shell · OpenAI: Patch the Planet · The Star (Reuters) on OpenAI's 100+ notifications

Accurate as of October 22, 2026. Operator-reported claims in leaked logs are not independently verified unless stated.