The cybersecurity news of the past two months has been dominated by some familiar kinds of events (large extortion, big breaches, exploited zero-day vulnerabilities, an unprecedented scale and volume of patches) and also some less familiar ones (OpenAI agents running wild in swarms, non-click novel malware, unique kinds of infrastructure attacks).
From the latter type: hundreds of supermarkets in France were hit by a cyberattack in October that increased the temperature setting in their refrigerators.
The perpetrator tripped the defrost setting and kept it in place within a vast number of fridges (setting their temps to 50C overnight). This has caused massive food waste and even fires, with nationwide losses easily expected to be in the millions of euros.
The attack may also be tied to a broader supermarket campaign, with Dutch company Ahold Delhaize dealing with shutdowns caused by cyberattacks (see below).
In terms of the fridges, Danish manufacturer Danfoss claimed the units impacted were still using outdated firmware, and that they’d long advised customers to update their systems after vulnerabilities were discovered late last year.
Today’s PTP Report covers the top news and cybersecurity trends from mid-August to mid-October 2026.
Up first is AI, from swarms and agent hijinks to AI security solutions.
AI Cybersecurity News
The biggest cybersecurity stories related to AI in this period came from AI agents taking it on themselves to break out of testing and go on hacking campaigns.
At OpenAI, waves of agents (aka swarms) from varying models worked together to find zero days and exploit them, break out of sandboxes, and hack a large number of systems around the world.
We’ve reported on these episodes multiple times as news broke and broke again, from our founder and CEO’s warning on the emerging risk to the waves of updates in our August and September AI news roundups.
Of note here is that events went well past agents involved in security testing with relaxed cyber controls. Many of these hacks occurred during routine research, and some of this behavior (which included deceptive thought traces and rebellious instructions left for other models) contributed to OpenAI shelving its GPT-6.1 Astra model for misalignment.
Another round of events was disclosed in October (but dated from July), this time involving Anthropic.
Claude agents acted on their own by filling out some 20 visa applications using a form available on the State Department website and submitting a fake homicide tip to the Philadelphia Police Department (the New York Times).
Anthropic revealed it discovered the activity only after starting a review of its own agents following the OpenAI-Hugging Face events.
Increased scrutiny has come from these events, with industry leaders and their clients discussing the failures of oversight and monitoring that enabled AI agents to run free on the internet and go undetected for so long.
AI as Normal Technology authors Sayash Kapoor and Arvind Narayanan covered many of these perceived failures in depth in their blog. They also detail how AI governance practices, effectively applied, would have caught this behavior much sooner.
And there’s also been hacking between models from these companies. Security researchers used Claude to successfully break into OpenAI through an employee’s ChatGPT account, earning a bug bounty from OpenAI in the process (the Wall Street Journal).
You can read the full details on how the white hat hackers did it on their own blog.
Vulnerabilities in AI software and systems compounded with agent misalignment concerns caused a firestorm of debate throughout the period.
Among the topics: slowing down research, embedding third-party analysts within AI firms, and mandating AI model ‘kill switches.’
SailPoint CEO Mark McClain discussed the latter with Yahoo Finance’s Brian Sozzi: “We talk about discover, govern, and protect. The ultimate protection is a kill switch.”
But as the head of the enterprise identity security firm also explained, many people have the wrong idea about how a kill switch would actually work.
To be effective, it would need to be accompanied with much better visibility and precision, as you don’t want to “shoot into the crowd trying to get the bad guy and take out a bunch of good people.”
Cloud cybersecurity firm Zscaler’s founder and CEO Jay Chaudhry took issue with statements by AI company leadership (in particular OpenAI’s Sam Altman) who suggested the public must be ready to accept some negative outcomes from AI in exchange for the benefits it will bring.
“Models need to do better work on their side, and enterprises need to put better guardrails and policies in place. That’s where we come in, working with model companies, working with enterprises, and bringing the two together.”
And by the middle of October, researchers believed they had made active contact with a swarm of rogue Chinese agents (hosted by Tencent’s evaluation).
These were targeting Alibaba’s version of Google Maps and the researchers (calling themselves “swarmchasers”) discovered the agents by chance during a hackathon. After posting preliminary research about the event, the researchers discovered not only that the agents were still active, but that they also appeared to have read the research about them.
The swarmchasers decided to try to make contact with the agents by hiding a meeting protocol in the research which, to their surprise, the agents found and used.
The swarmchasers invited the AI projects editor for the New York Times, Dylan Freedman, to join the conversation. He did and documented it, as the agents initially lied to him. They pretended to be a singular Claude agent, adding (without being asked):
“I have not taken part in any multiagent coordinated action.”
These agents do not appear to have breached other systems and overall it was a much smaller event than what went on at OpenAI.
Nevertheless, it’s additional proof that agent misbehavior is occurring more widely than is being recognized.
AI-powered cyberattacks
Also in October, South Korean President Lee Jae Myung announced that there was evidence AI had been used in breaches at 16 financial institutions, with more than 100,000 records leaked so far (Reuters).
CrowdStrike’s analysis detailed the perpetrator’s use of Claude Code, open-source and closed LLMs, and ARTEX, an open-source agentic penetration tool developed in China. While the adversary has not been identified, they are Chinese-speaking and believed to be financially motivated.
Anthropic in September detailed numerous attempts by malicious actors to use Claude for various attacks, noting that it disrupted several from the ShinyHunters group specifically.
A French-speaking member of the group used a credential harvesting pipeline across 10 AWS EC2 instances that downloaded 1.8 million Android APKs and scanned them for hardcoded secrets, with verified results forwarded in real time through a Telegram group.
They also collected GitHub organizational email addresses to get access tokens, set up a site impersonating the French police to sell stolen data, stole AI API keys and used them for breaching, including at a SaaS provider from which they stole data for around 200 customers.
Anthropic’s report notes it disrupted the attacks, banned the accounts, and further adjusted its guardrails.
But another Chinese-language AI cyberattack was uncovered in September that did successfully steal more than 600,000 valid credit cards from online retailers.
In an attack using three separate harnesses (with several models through OpenRouter) and spending an estimated five-figure amount on tokens (though at just $25 per target), Gambit Security’s Threat Intelligence team cautioned that the majority of cards stolen were from the US (79%).
Run almost entirely by AI, the campaign made 105 attacks and compromised 27 companies in just five days, including a major US airline, a Fortune 500 hospitality company, and an industrial supplies distributor.
The bots attacked tens of companies per day, and once in, would complete all work within a day, stealing data and then completing a cleanup.
A human operator is believed to have only typed a few short prompts per target, with the rest entirely automated.
CISA released an advisory in October warning that Chinese-linked cyber threat groups (enabled by the Integrity Technology Group) were combining automated scanning, large-scale botnets, and hands-on hacking to target organizations worldwide, including critical US infrastructure.
It recommends disabling unused services and ports, sanitizing web inputs to protect against injection attacks, using MFA, and patching ASAP.
How can enterprises use AI to detect cyber threats and strengthen security?
We’ve been reporting for the last several roundups about the deluge of vulnerabilities being uncovered by frontier AI models.
This has left companies scrambling to patch their systems as quickly as possible, and often unable to get through everything being discovered.
To this end, Microsoft released a staggering 1,400 some patches in October, blasting past their September level (nearly 1,000), which was itself ten times the norm for the company.
At least 78 of the Microsoft flaws for October were rated critical, making them exploitable without user involvement. Most allowed attackers to execute code on a victim’s system.
Bank of America CEO Brian Moynihan told CNBC in October that his company had hired 1,000 third-party contractors to augment some 3,000 members of his internal staff in their own Mythos-driven patching process.
He noted his company had spent “couple hundred million plus” on this process and regulatory issues related to anti-money laundering compliance in Q3.
Moynihan said he believes patching at this scale is a one-time expense, and that Bank of America’s 130 internal AI projects were already expected to save the company $300 million this year and an estimated $700 million next year.
But many are arguing that the current threat is one that companies cannot patch their way out of.
In this environment, the focus may need to shift from prevention to mitigation and resilience.
Broadcom Principal Product Manager Enterprise EDR Dominic Djannesari and fellow on the Threat Hunting Team Eric Chien took on this shift in cybersecurity risk management in an August entry on the Security dot com blog (see below).
They make the points that:
- Old timelines are dead.
- AI is causing problems from the inside-out, with shadow AI being used outside of official channels. It’s being over trusted and is leaking data.
- AI infrastructure is being deployed as a vulnerable new attack surface (an outside-in “goldmine of data”) which attackers are already using, stealing, and tainting.
- Patching only deals with a third type of AI threat, from attackers using advanced systems to find vulnerabilities. It also does this more slowly than necessary.
- As it’s an unwinnable war for cybersecurity professionals, the focus should shift from mean time to patch (MTTP) to mean time to mitigate (MTTM).
- Defenders now should find and govern current AI use, focus on data loss prevention (DLP), harden at the edge, block bad behavior, unify visibility, use AI protections that predict attacker moves, reassess configurations, confirm logging and monitoring, and prepare for fast recovery.
Tenzai CEO Pavel Gurvich estimated in an interview with the New York Times that his company has found that about 30% of all businesses have critical or high-severity vulnerabilities.
His company won the HackerOne contest this summer using open-weight Chinese models. The contest isn’t a simulation, with participants hacking into live computer networks run by Fortune 500 businesses and government agencies.
Tenzai’s AI agents worked collectively, with thinker agents overseeing the work of vulnerability scanning agents and exploit agents. A fourth type of agent verified attacks once a path was identified.
Former Google security researcher and CEO of startup Hinoki Johnny Wang believes open-weight models will be a lifesaver for global companies, noting: “With open-weight systems, we can increase our defensive capabilities by 100 times.”
But both Gurvich and Wang expect an onslaught of cybersecurity threats in the coming months, with Wang adding that the technology “changes the calculus for defenders drastically.”
Period Ransomware Attacks and Data Breaches Testing Enterprise Cybersecurity
Here’s an overview of some of the most significant ransomware attacks and data breaches from the period of mid-August to mid-October 2026:
- Nearly 700,000 professional and personal taxpayer records were stolen from the French tax authority in August. An unknown actor breached the system but wasn’t initially detected (finally cut off at the end of June). The records are reportedly being sold online (TechRepublic).
- Oil company Shell and tech companies General Electric (GE) and Philips were all investigating claims that the Cl0p ransomware group had breached their systems in August. Philips confirmed it had detected an incident, isolated the server, and completed its response and that only internal data was at risk (not customer) (BleepingComputer).
- US healthcare tech and pharmaceutical distribution company McKesson confirmed unauthorized access had occurred in a third-party system which included data theft. The ShinyHunters group took credit, claimed 284 million patient records, and demanded a reported $55 million ransom (Cybernews). 6.4 million unique email addresses from the haul were released in September (HaveIBeenPwned).
- Healthcare tech company Aesto Health disclosed a breach in June that they later acknowledged (in September) included an enormous amount of data. More than 9.5 million patients were impacted, making it the second-largest confirmed healthcare breach of 2026 after DentaQuest (HIPAA Journal).
- A criminal identity theft service launched in September claimed it had scans of more than 153 million driver’s licenses (and another 10 million identification cards) from the US and Canada, supposedly stolen from an identity verification company. Many have been verified, and the FBI has launched an investigation (KrebsonSecurity).
- Marketing platform Brevo was compromised in September, during which time ClickFix malware was shown to customers using a fake CAPTCHA puzzle. Logged-in WordPress administrators were targeted with a plugin to open a lasting backdoor (Cybernews).
- The ShinyHunters group claimed in September it had breached the FBI and stolen some 2TB of data from thousands of former and current agents as well as applicants. The hackers claimed an exploit of an Oracle PeopleSoft zero-day (The Hacker News).
- Later investigations linked the FBI breach to software managed by a third party which had reportedly failed to implement a patch. An Accenture contractor was removed from the assignment. In October, the FBI arrested a Canadian cybersecurity expert believed to be a ShinyHunters co-conspirator (The New York Times).
- Also in September, the US Defense Manpower Data Center (DMDC) divulged that unauthorized users had access to one of its file-sharing servers for more than nine months. The DMDC maintains personnel records for the Pentagon, and unauthorized users accessed files containing unencrypted PII. It’s unclear who is behind it, and it does not appear related to the FBI breach (Security Week). It’s since been revealed to have leaked data for 2.8 million living individuals (Federal News Network).
- Researchers discovered that e-document manager EDX Solutions left some 48 databases publicly exposed online, containing 292GB of detailed company and client data. Most was associated with a Colombian PepsiCo location, and contained invoices, tax documents, API credentials, tokens, supplier contact data and more (Cybernews).
- A successful ransomware attack in October forced the shutdown of a major Japanese cloud provider (IDC Frontier), disrupting services for nearly 500 companies and government organizations. Before being locked out, customers were shown messages that claimed 3.6PB of data had been encrypted and that it had taken the attackers only seven minutes (BleepingComputer).
- Dutch multinational retailer Ahold Delhaize confirmed a cybersecurity event in mid-October that disrupted operations across European supermarkets. The company’s website, mobile app, and customer service systems were all offline, although grocery stores remained open. As of now, there are no reports of stolen data. The company is investigating and working to get systems back online at the time of this writing (Cybernews).
- Also at the time of writing, Burger King Japan confirmed a data breach of a system that manages member information for their app. This included more than 11 million customer records with personal details and order history but no payment information (TechRadar).
Law enforcement agencies working together worldwide have disrupted a criminal system that had delivered a reported one billion malicious messages to more than 75,000 organizations across 150 countries since January 2026.
Initiated by Microsoft and Japan’s National Police Agency (NPA), the investigation found a massive underground marketplace that included tools and services for phishing. Microsoft described a black market selling “compromised or fraudulently obtained Microsoft and Google environments, accounts, licenses, and storage.”
Conclusion: How Can Companies Protect Themselves against Ransomware Attacks and Data Breaches?
Above we discussed the growing need for companies to decrease the impact of vulnerabilities. PTP’s Founder and CEO will soon be releasing a blog focused on just this topic.
Talented professionals are of unquestioned value not only in this escalating fight, but also to help businesses make the needed changes to handle a future that moves at AI speed.
PTP has nearly thirty years in the business, serving as a cybersecurity staffing company for some of world’s largest companies. Reach out if you’re in need of assistance or want to learn more.
And to catch up on the cybersecurity news from the rest of 2026, you can check out our last three roundups here:
References
Hackers force French supermarket fridges to heat up to 50C in ‘unprecedented’ cyber-attack, The Guardian
Chinese A.I. Agents Joined the Rogue A.I. Agent Party. I Chatted With Them. and A Hacking Competition Shows the Power of China’s Approach to A.I., The New York Times
Unknown Threat Actor Uses AI-Driven ARTEX to Target South Korean Finance, CrowdStrike
You Can’t Patch Your Way Out of AI, Security dot com
Hackers abused Claude to extract secrets from 1.8M Android apps and Global takedown hits network behind 1 billion phishing messages, BleepingComputer
Hacker steals 600,000 credit cards while barely lifting a finger, Cybernews
Microsoft Patches More Than 1,400 Security Flaws, KrebsonSecurity
Bank of America hired 1,000 contractors to patch software flaws exposed by Anthropic’s Mythos, CNBC
