New York:A series of cyberattacks throughout October targeted major technology companies, artificial intelligence platforms, and cryptocurrency exchanges, showcasing the dual role of AI in cybercrime and cybersecurity. The incidents, referred to as "Black October" by cybersecurity company Wiz, involved at least nine AI development platforms reporting security breaches.
According to Anadolu Agency – English, the attacks frequently exploited credentials allowing unauthorized access to AI models, enabling criminals to misuse computing resources, resell access, or extract information. Some incidents reportedly involved autonomous AI agents identifying and exploiting vulnerabilities with minimal human intervention.
The cyberattacks extended beyond AI companies, affecting other sectors, including cryptocurrency and gaming. Binance, a leading cryptocurrency exchange, suffered a $6.3 billion theft, and Japanese video game publisher Capcom reported unauthorized access to nearly 11.8 million customer records. However, these incidents have not been confirmed as AI-driven attacks.
Throughout the month, multiple companies experienced significant breaches. Binance struggled with compromised hot wallets, Polymarket's trading platform was infiltrated via a third-party script, and Cursor's software development platform faced malicious modification of an AI-powered extension. These incidents highlight the vulnerabilities in digital financial infrastructure and the risks posed by third-party software.
AI was utilized defensively as well. Security researchers used advanced AI models to detect vulnerabilities in PHP, a widely-used programming language, illustrating AI's potential in strengthening cybersecurity. However, the same AI capabilities could also simplify the development of sophisticated cyberattacks.
The October cyberattack wave underscores the increasing value of AI credentials and computational resources, with attackers specifically targeting these assets in several incidents. While AI played a role in both facilitating and defending against attacks, no single coordinated campaign or universal use of AI in these cybercrimes has been confirmed.