Send this to the people in your life. Anyone who uses the internet, which is basically everyone, needs to know what's happening and what they can do to protect themselves.
Right now, as you read this, swarms of AI agents are likely trying to break into the websites you use. Not one of them. Many of them.
We are in the middle of the biggest cybersecurity moment in years. Some security experts are already calling it Black October.
I'm not writing this to scare you. A lot of this is out of your hands. But there are simple things you can do to protect yourself, and anything you do is better than nothing.
Every hour this week, another attack has come to light. By the time you finish reading this, there will probably be another one.
So here's what's going on, and what you should do about it.
What's happening right now
If this is too much right now, feel free to skip straight to what to do about it. But I'd really recommend reading the whole thing.
Yesterday, a serious hole was revealed in PHP, the software behind roughly 70% of websites.
Think of it this way: someone discovered that millions of buildings in the country have the same broken lock, and now everyone knows how to open it. The lock maker has sent out a fix, but every building owner has to install it themselves, and many haven't yet.
Within two hours of the news, attackers were trying that lock hundreds of thousands of times, according to Cloudflare's CEO. Now it's millions. Amazon says someone was already trying it four days before it was announced, and its security chief says the hole "is now being broadly exploited in the wild." (That's Amazon sounding the alarm, not Amazon getting hacked.) So far, no one has confirmed a successful break-in through it, but attackers are trying everywhere. As a precaution, the organization that runs Wikipedia shut down some of its systems, and governments in the Netherlands, Finland, Germany, France and elsewhere took websites offline.
That's just one story, and it's only the tip of the iceberg. I'm sharing a few of the biggest. If I listed everything, you'd be reading for hours.
- A hacking group aligned with the Chinese state used an AI hacking tool to try to break into more than 2,000 organizations through a backup service IT firms rely on, Microsoft says.
- A cloud platform used by about two million developers said customers' secret keys may have been accessed. A friend of mine had someone draining his account with one of them this morning.
- India's largest bank said nearly 3,900 customers' personal details were exposed on the dark web.
- A criminal crew used AI tools to attack more than 400 banks and financial firms across Latin America.
- Hackers broke into 16 financial firms in South Korea, including major banks.
- Japan's government told companies to tighten their defenses after breaches that may have exposed tens of millions of people's data.
- The Stop & Shop, Hannaford and Food Lion websites and apps went down for more than a week.
- The FBI, NSA and three other agencies warned that hackers using AI-written attack scripts are scouting the systems that run water, energy and manufacturing plants.
Governments saw this coming. In June, the US and its closest allies warned about AI-powered hacking: "The timeline is not years, it is months." Four months later, here we are.
Why this is different
You've heard about hacks for years. Here's what changed.
Every building has weak spots: a window that doesn't latch, a back door with a cheap lock. Software is the same. It's full of hidden weak spots. For decades, finding them took rare, highly skilled people, and there weren't many of them. That was our protection. Not good locks. Just a shortage of burglars.
That shortage is over. Three things just happened at once.
First, AI can now find the weak spots. The PHP hole was found with the help of AI, and AI tools are finding thousands of bugs that sat unnoticed for years.
Second, AI can now break in on its own. No skilled hacker required. One person gave AI agents instructions shorter than a tweet, fewer than 100 Chinese characters, and let them work largely on their own. They broke into websites belonging to more than 100 companies, including John Deere, at an estimated $50 per break-in. They don't sleep or get bored. They just keep trying until they find a way in.
Third, defenders are racing to keep up. Every weak spot still has to be fixed, tested and installed, on millions of systems run by people who are already stretched thin. Even for the most serious bugs, it takes about two weeks on average just to get a fix out, and plenty of websites never get fixed at all. Security firm Cisco estimates about half of the internet-facing servers running that software are too old to get the official fix.
Put those together and you get a cat-and-mouse game where the attackers only have to win once. That gap between attackers and defenders is what you're going to see play out in the news over the next several days.
This is going to keep happening, and get worse
This isn't one bad week. It's the start of something we all need to be prepared for.
Just look at the numbers. Security firm CrowdStrike says the attacks it sees that likely involve AI agents more than doubled in August, then doubled again in September. And if this week is any indication, it's only speeding up. The AI keeps getting better every few months while it gets cheaper to run. The tools hackers are using today are the worst they'll ever have.
The tools are also out in the wild now. When an AI hacking tool was linked to attacks on Korean banks, its creator stopped releasing it publicly and its download page came down. But it didn't matter. Anyone who'd already downloaded it can still use it.
The good news, though, is that defenders have AI too, and it's finding and fixing weak spots faster than ever. Eventually, software will be much harder to break into than it is today. But right now, offense is ahead of defense, and it could stay that way for a while.
What this means for you
Right now, major US banks, including JPMorgan, Bank of America and Wells Fargo, are finding unauthorized AI agents inside customer accounts, according to Axios. Some were set up by customers themselves, but many banks can't tell which ones are acting for the customer and which aren't. Bank executives described the situation as "horrifying." Axios didn't report any money being stolen.
But for most people today, the bigger danger is still three things. Your information leaks, so scammers know your name, birthday, address and bank, and their calls and texts sound real. Your accounts get taken over through some site you used once, years ago, with the same password you use everywhere. And the things you depend on, like an app, a pharmacy or a store's website, go down for days.
To be clear: this is ongoing, but the worst-case scenarios people are most scared of haven't happened. I hope they never do. But it's better to be safe than sorry, especially since this is going to keep happening.
What to do today
First, stay off sites you don't know until this blows over. Stick to the big, well-known ones: your bank, Amazon, Google. Small sites are the least likely to have patched, and you can't tell from the outside. For the next few weeks, don't type a password or card number into anything unfamiliar.
Second, update everything: your phone, your computer, your tablet and your web browser. When your phone or computer's own Settings says an update is available, install it. That's your lock. Do the same for your router, and if it's so old it doesn't get updates anymore, replace it. But never install an "update" from a pop-up on a website or a link in a text or email. That's a common scam. Not sure how to do any of this? Here's a simple step-by-step guide.
Third, close the doors you aren't using. Unplug smart gadgets you don't need and delete apps you don't use. Every connected thing is another way in.
Fourth, protect your bank account. If anyone calls, texts or emails you and asks for your password or a code that was just sent to your phone, it's a scam. Every time. Those codes are only for you to type into your bank's own app or website. Treat every call, text or email about your bank as suspicious until you've checked it yourself: don't click their links, and don't call back the number they give you. Hang up and call the number on the back of your card. If it was really your bank, they'll be able to help.
Only type your bank username and password into your bank's own app or website. Don't give them to anyone else, including an AI assistant or another app, no matter how helpful it seems. Chase says not to give them to anyone. Turn on two-step login for your email and your bank (here's how), and stop reusing passwords. A password manager makes that easy, and your iPhone or Android phone already has one built in.
If you want to be extra careful, keep a little cash at home, enough for groceries for a few days, plus some food and water. That's a normal emergency kit, and it's worth having anyway.
What I wouldn't do is pull your money out of the bank. Panic is exactly what scammers count on. If a bank itself fails, deposits at FDIC-insured banks are protected up to $250,000 per person, per bank. That insurance doesn't cover money stolen from a hacked account. But federal rules generally limit what you lose from unauthorized transfers if you report them quickly, so check your accounts often and call your bank right away if anything looks off. Money you're tricked into sending yourself is much harder to get back, which is why the scam calls are the bigger danger.
The next few days are going to be weird. More announcements are coming. My hope is that most things will keep working. Just do the boring stuff today.
Send this to the people in your life right now. Your parents, your grandparents, your friends, your group chats. Anyone who's connected to the internet, which is literally everyone, needs to know what's happening. The people least likely to hear about this are the ones most likely to get hurt by it.