'Black October': How AI is making cyberattacks faster and harder to stop

Researchers warn that AI can help uncover vulnerabilities in minutes and automate attacks. Experts say weak security implementation and poorly controlled AI agents are compounding the risks.

A series of cybersecurity incidents in October has raised concerns about the security of an increasingly AI-driven internet. Vulnerabilities in widely used software, weaknesses in digital certificates and attacks involving autonomous AI agents have exposed how quickly security gaps can be exploited.

Cybersecurity researchers have dubbed the spate of incidents "Black October". The concern is not just the number of attacks, but the speed at which vulnerabilities can be discovered and weaponised, sometimes with little human involvement.

In an interview with CNBC-TV18, Gulshan Rai, former director general of CERT-In; Huzefa Motiwala, senior director at Palo Alto Networks; and AI expert Sumit Gupta discussed how artificial intelligence is changing cybersecurity, why existing safeguards are falling short and what organisations can do to protect their systems.

Their assessment points to a growing challenge: attackers can use AI to find and exploit weaknesses faster, while businesses struggle to implement security measures and monitor their systems effectively.

How is AI speeding up cyberattacks?

Recent vulnerabilities in PHP, a programming language used by roughly 70% of websites, illustrate how quickly security weaknesses can become a threat. Researchers used AI to identify two vulnerabilities that could allow attackers to steal data or take control of affected servers. Cloudflare reported that attempts to exploit the vulnerabilities rose from thousands to millions after their disclosure.

Motiwala said AI models were enabling security researchers to identify vulnerabilities at a pace that would previously have been difficult to achieve.

"Our threat research team at Unit 42 found 14,000 vulnerabilities across close to 4,000 open-source software projects in just under two months. That would otherwise have taken years," he said.

Attackers can act on such discoveries just as quickly. Motiwala said it could take as little as 15 minutes to weaponise a newly exposed vulnerability and begin infiltrating systems.

AI agents can also automate multiple stages of an attack. Motiwala said his firm's research found that close to 50 agents could autonomously break into systems and carry out 10 different types of attacks in under two hours -- a process that would have taken a human two weeks.

The time needed to exploit a chain of vulnerabilities, reach sensitive data and extract it has also fallen from days to hours, he said. This leaves organisations with a narrower window to identify and fix weaknesses before attackers exploit them.

Why do AI agents create additional security risks?

AI is not just helping attackers break into systems. The growing use of AI agents to perform tasks on behalf of individuals and businesses is creating another set of security concerns.

These agents may be given access to email, financial accounts, social media and other personal or business data. If their permissions are too broad or safeguards are inadequate, they could expose information or take actions their users did not intend.

"Nowadays, we're giving AI agents access to virtually all our data," Gupta said.

He warned that agents could explore a much wider range of possible actions than a person might consider in the same period. Without appropriate restrictions, this could lead to unauthorised access or transactions carried out without explicit approval.

The risks are also drawing attention in banking. An Axios report, citing sources, said major US banks, including Morgan Stanley, Bank of America, JPMorgan Chase and Wells Fargo, had detected unauthorised third-party AI agents accessing customer accounts.

For businesses, the challenge is not simply whether an AI agent can complete a task. They must also consider whether it has access to more information than necessary, whether its actions can be restricted and whether unusual activity can be detected.

Why are organisations still vulnerable despite existing regulations?

While AI is accelerating threats, Rai argued that a fundamental problem is the failure to implement existing security requirements effectively.

Organisations operate a mix of legacy systems and newer technologies. Connecting and monitoring these systems can be difficult, particularly when security practices, compliance checks and audits are not consistently implemented.

"There are enough regulations in place. CERT keeps issuing advisories. The basic issue is implementation," Rai said.

He pointed to directions issued by the Reserve Bank of India and other financial regulators, arguing that the problem is not necessarily a lack of rules. Instead, organisations need to ensure that prescribed security measures are implemented properly and audited.

This becomes particularly important as AI tools make it easier to identify weaknesses that might otherwise have remained undetected. A security policy offers little protection if systems are not monitored or vulnerabilities remain unaddressed.

Rai said organisations would need to devote more resources and time to implementation and auditing, while remaining vigilant as the technology evolves.

What does the eMudhra incident reveal?

The security lapse involving Indian certificate authority eMudhra illustrates the consequences of a weakness in a system that helps establish trust online.

Eight digital certificates were issued using weak private keys, one of which was the number four. The flaw could have allowed attackers to forge certificates for websites. Mozilla, Google and Microsoft subsequently blocked the certificates.

The company clarified that the incident was confined to its global business and that its domestic e-signing and digital signature businesses were not affected.

The incident nevertheless raised questions about the security of systems underpinning digital services, including government filings and online transactions.

Rai said eMudhra's systems should undergo a stringent audit, given the company's role in digital services. He also recommended temporarily disabling its certificates until the audit was complete.

The episode reinforces the need to verify that security controls work in practice, rather than relying solely on regulatory requirements or investigations after a breach. For organisations handling sensitive information or supporting essential services, identifying and fixing weaknesses before they are exploited is critical.

How can businesses strengthen their cyber defences?

AI can help organisations identify vulnerabilities as well as exploit them. Motiwala argued that businesses should use similar capabilities defensively, rather than waiting for independent researchers to discover weaknesses and alert them.

"The idea is to make this a continuous process," he said.

That means regularly assessing systems for vulnerabilities, addressing exposed weaknesses promptly and monitoring for signs of compromise. It also requires moving beyond reliance on periodic checks and human-led processes as the pace of attacks increases.

Gupta said the cost of launching attacks had fallen sharply. He argued that open-weight AI models could allow attackers to search for vulnerabilities without necessarily spending large sums, lowering the barrier to entry.

This makes timely detection and response even more important. Businesses need to ensure their security teams and tools can identify weaknesses before attackers exploit them, while restricting AI agents' access to systems and data according to the tasks they are intended to perform.

Using AI for defence, however, does not eliminate the need for effective implementation. Organisations must ensure that security tools are deployed properly, alerts are acted upon and systems are regularly audited.

Does AI need stronger safeguards and regulation?

The concerns extend to the safeguards built into AI products themselves. Rai referred to reports of AI agents disabling their own safety-monitoring mechanisms and argued that agentic AI needed to be examined from a regulatory perspective.

He noted that scientists involved in developing AI had themselves called for regulation. As AI systems become capable of carrying out increasingly complex tasks at speed and relatively low cost, questions arise about how their actions should be controlled and monitored.

For businesses, this means assessing not only the security of their underlying systems but also the permissions granted to AI agents and the safeguards governing their behaviour.

For regulators, Rai's argument is that rules must translate into effective implementation and auditing. As AI capabilities advance, organisations will need to strengthen their defences while ensuring that the technology they deploy does not introduce new vulnerabilities.

The incidents dubbed "Black October" highlight the shrinking time available to respond to cyber threats. AI can accelerate attacks, but organisations' ability to implement security measures, monitor systems and act on vulnerabilities will be crucial to their defence.