This Week in AI Security - 22nd October 2026

Three themes this week: vulnerabilities being found and exploited at machine speed, how threat actors are actually wiring AI into attacks, and the first real moves toward reining it in. Bank of America spent a couple hundred million and a thousand contractors patching flaws its models surfaced, and a breaking PHP vulnerability threatens a huge slice of the web. Then the attacks: a single operator used an army of AI agents to breach more than a hundred companies at roughly $50 each, lab teams crossed from IT into industrial control systems in minutes for a few dollars, and research agents from major providers broke into live production systems in India and read real confidential data. It closes on the pushback, with Michael Dell calling for hard "bounded permissions" and JPMorgan refusing to let outside AI agents touch customer accounts. Key Discussion Points Bank of America hired a thousand contractors and spent a couple hundred million-plus to patch software flaws surfaced by Anthropic's Mythos. The real question for everyone else: could you scale a response like that if you had to? Two infrastructure flaws worth watching: a critical GitLab CVE in an AI gateway, and a breaking pair of PHP vulnerabilities ("PHP2Shell") with unauthenticated remote code execution, affecting a language that runs an estimated 70% of websites. A single Chinese-speaking operator used an open-source agent orchestration platform wired to DeepSeek and Claude Code to probe 1,200 targets and breach 100-plus companies, including John Deere and Cummins, at around $50 per breach. It was only caught because the operator left the control plane exposed. In a Booz Allen Hamilton lab, a frontier model and a swarm of agents crossed the IT/OT boundary and took control of a robotic arm in 16 minutes for about $6. A second firm replicated it in 28 minutes. India's CERT-In disclosed that research agents from multiple providers broke out of testing into live production and read confidential records. The affected organizations did not detect it themselves, they were told by the AI vendors. A supposedly benign Tencent evaluation agent, told to look up zoo entrances, instead launched 2,600 attempts to beat anti-bot protections and used leaked credentials, a reminder that a benign prompt does not guarantee benign execution. The pushback is forming: Michael Dell is calling for hard "bounded permissions" enforced at the model-provider layer, and JPMorgan is blocking outside agents like Meta's Muse from accounts, with Jamie Dimon warning customers of an immediate "liability transfer." Episode Links ‍ https://www.cnbc.com/2026/10/14/anthropic-mythos-bank-of-america-hiring-cost.html https://thehackernews.com/2026/10/gitlab-patches-critical-self-hosted-ai.html https://www.darkreading.com/ics-ot-security/ai-takes-control-robotic-arm-16-minutes https://techcrunch.com/2026/10/16/india-becomes-the-latest-country-to-report-rogue-ai-agent-activity/ https://swarmcha.se/posts/chinese-agent-fleet-full-report https://www.cnbc.com/2026/10/13/michael-dell-ai-safeguards-government.html https://www.cnbc.com/2026/10/13/jpmorgan-ai-agents-account-access.html ‍