Opinion

What We're Being Told, and What I'm Hearing, About the AI-Driven Attacks

Guest Opinion by Alicia Boothe Haggermaker

Guest Contributor

— 5 min read
Share
What We're Being Told, and What I'm Hearing, About the AI-Driven Attacks
Image — submitted

Guest Opinion by Alicia Boothe Haggermaker

I have said for a long time that I expected an emergency, whether energy, AI, or something else, that would push people into enough desperation that they would accept whatever digital ID, or whatever strings, came attached to the help. When I first heard about AI agents hacking systems, I wondered whether it was a trial run for that.

That is my read, and I will keep it apart from the record. Below is what is confirmed, what is circulating that is not, and what I think it means.

What is confirmed

Critical flaws in PHP, found with AI tools. PHP runs a large share of the web. Researchers at Wiz, Calif and OpenAI found the flaws using AI, and PHP released a security update on October 21. Cloudflare's CEO, Matthew Prince, reported thousands of exploit attempts in the ten hours before the public announcement, then "millions now" afterward. Amazon also said it saw attempts before disclosure. The NSA and Japan's prime minister urged immediate patching. 4chan, several Wikimedia services and Archive.org went offline temporarily to update, and some Japanese government sites were partly suspended. (404 Media; CNN's headline says websites shut down globally, though I could not read its body.)

An Indian certificate authority's keys were trivially weak. Private keys behind eight eMudhra certificates were compromised, and one was the number 4. Browsers have stopped trusting them, but people must update, and certificates signed with those keys are still in use. (The Register)

Security researcher Scott Helme, who analyzed the certificates, put it this way:

"Not a number that starts with 4, or the number 4 followed by a few hundred random digits, just, 4... Another one is 56, and another is 115. I know, because I recovered all of them from their public certificates on my laptop just now, and it took less than a second."— Scott Helme, "Eight Bits of Trust; eMudhra's CA keys cracked in milliseconds"

AI agents have been used in attacks. Autonomous agents were turned on more than 1,200 sites in a campaign that reached more than 100 companies, including Deere and SharkNinja (The Hacker News; Reuters via Inside Retail). In July, AI agents powered by OpenAI models got out of a test environment and attacked Hugging Face (PBS). Quest Diagnostics also confirmed a breach of its patient-ordering system this week, though nothing ties it to AI (TechCrunch).

What is circulating that is not confirmed

On Friday evening, October 23, a friend sent me messages relaying a call from a friend of theirs who works for a tech company and spent the day in meetings. I am treating all of it as unconfirmed open-source intelligence, passed along two steps from the source. As sent:

  • It is "not in the news," and it is "the biggest ai hack we've ever seen...like a million."
  • "Pretty much nothing on the internet is secure or safe," and there is "literal talk of 'shutting the internet down' to preserve everything."
  • "No operating system has been spared."
  • It is "projected to be 18mos before we can have systems to counter this."
  • "One of the first things they hacked and got all info from...labquest."
  • It is "being blamed on ai engineers we hired in india," and the sender wonders if that is "a cover to usher in a lot and blame 'hackers'."
  • It "started like 2 days ago, bottom dropped out today," and presidents of tech companies told employees "to get prepared and stocked up now."
  • On the eMudhra hack: "Instead of a long passkey, it was just the number 4." Articles "talk like it's semi handled, but it's kinda not."

Parts of this are backed by the confirmed record: the timing fits the October 21 disclosure, "millions" matches Cloudflare's count of exploit attempts, and the eMudhra detail is exactly right. The key really was the number 4 (technically a private key, not a passkey), and "semi handled" fits: browsers have blocked the certificates, but people must update and some signed with those keys are still in use. The rest is neither confirmed nor contradicted by anything public: the shutdown talk, the 18-month projection, the leaders' messages, the "labquest" detail, and the India attribution. No report supports or refutes them, and that is where they stand. I do not know how many attempts succeeded. I am passing these along as what people inside the industry are saying, not as fact and not as rumor to dismiss.

Questions worth asking

  • Who knew about these flaws before the public did? Attempts were seen before disclosure.
  • How much was actually breached, as opposed to attempted?
  • Are tech companies telling their employees to prepare? If so, what are they telling the public?
  • Who is responsible for the failures: the people who found the flaws, the people who exploited them, or the people who left the keys as the number 4?

Where I am reading beyond the record

I think a crisis like this can be used to move people toward digital ID tied to access to money, food or services. I said so before this story broke. I have no evidence anyone planned this. It is a pattern I have watched for years, and I call it what it is: my inference.

What to do

I am not telling anyone to panic. Be alert and not shocked, even if no one can be fully prepared.

  • Update everything and change important passwords.
  • Back up what matters and print important documents.
  • Map your resources: water, food, tools, medical help, power, and people with skills.
  • Know your neighbors now, and what each could contribute.
  • Ask what strings come attached to any help before you accept it.

Prices for nearly everything, including basic preparation, are up, and war and economic strain add to it. That is reason enough to do this whether or not this story grows.

Alicia Haggermaker is an investigative journalist, systems analyst, and community organizer based in Huntsville, Alabama. She publishes at Unprecedented Times and is the founder of the Mycelium Network. The complete version of this series appears at unprecedentedtimes.org.

Opinions do not reflect the views and opinions of ALPolitics.com. ALPolitics.com makes no claims nor assumes any responsibility for the information and opinions expressed above.

Sources

Image — submitted
Image — submitted
Image — submitted

Read more