AI Cyberattacks Surge as Security Firms Turn Away Victims

WHO:

Fast Company - Anthropic, the company behind Claude, narrowly avoided an attack through a third-party extension that could have enabled hackers to upload worms to affected computers.

Fast Company - OpenAI, Anthropic, and Google have cybersecurity products or programs described in the article: OpenAI’s GPT-6 Cyber and Daybreak, Anthropic’s Claude Mythos Preview, and Google’s Gemini Carbon 4.

Fast Company - Sam Altman said, “I think we’re going to have to completely switch the defense model to using the same technology for a new kind of defense shield.”

Fast Company - Jason Clinton of Anthropic called the expected vulnerabilities a “vulnerability tsunami.”

NBC News - Executives at Mandiant, CrowdStrike, and Kroll told NBC News that demand for emergency cybersecurity services is surging.

Techmeme - Alex Stamos, Cognition’s chief security officer and a longtime cybersecurity expert, discussed AI’s effects on cybersecurity in an interview with Nilay Patel of The Verge.

WHAT:

Fast Company - Binance was hacked in what the article describes as the largest cryptocurrency heist in history.

Fast Company - A hack of Spanish travel-tech company Amadeus affected major airlines and exposed customer information online; payment information was not leaked.

Fast Company - About 400,000 severe bugs, classified as CVEs (common vulnerabilities and exposures), have been officially logged since 1988; 13,000 were logged in the month discussed.

Fast Company - PHP2Shell involved vulnerabilities in PHP, a language used by roughly 70% of websites. Wikimedia and other websites went offline preemptively until a fix was released.

Fast Company - The PHP Foundation knew about the bug in 2024, but developers had not agreed on a solution; fixes were rapidly released after public disclosure, and PHP website operators were urged to upgrade.

Fast Company - Calif and Wiz independently rediscovered the bugs.

Fast Company - OpenAI’s Patch the Planet initiative searches open-source software for defects and vulnerabilities. Daybreak is intended for eligible organizations, and its access is subsidized.

NBC News - Cybersecurity firms are turning away some prospective clients amid increased demand for emergency services.

Techmeme - Stamos’s interview covered AI-powered red teaming and vulnerabilities in legacy codebases.

WHERE:

Fast Company - The article identifies the internet and open-source software as central to the cybersecurity concerns; Wikimedia was among the sites that temporarily went offline.

Fast Company - Altman made his quoted remarks to business students at Stanford.

WHY:

NBC News - Executives attributed rising demand for emergency cybersecurity services to hackers using AI to automate attacks.

Fast Company - The article says generative AI has made it easier to exploit vulnerabilities that had previously been difficult to identify or use.

HOW:

Fast Company - PHP2Shell could enable a hostile server takeover by disrupting memory handling, leaving a partially initialized object treated as valid, and allowing instructions from a request to be read again rather than reset.

Fast Company - The article says AI companies are developing security models and vulnerability-finding programs as organizations face growing cyber risks.

(UPDATED November 9, 2026 20:03 UTC)

Hackers’ AI-driven attacks are overwhelming cybersecurity firms, with some turning away emergency-service clients. Anthropic narrowly thwarted an extension attack that could have uploaded worms to computers. OpenAI, Anthropic, and Google are developing AI security tools to help defend vulnerable software.