PHP 9.2 Flaws, Poisoned AI Tool with 23M Downloads, Rogue AI Agents in Major Banks—All in 48 Hours
r0ck3t23 · x · 2026-10-23
The author catalogs a 48-hour burst of security failures showing AI agents are already attacking real infrastructure:
- Two PHP vulnerabilities rated 9.2/10, exploited in the wild before fixes shipped; PHP underlies 69% of internet code, exposing every unpatched server
- A popular AI developer tool was poisoned with a password stealer, downloaded 23 million times before detection
- An AI hacking tool operated across 1,200 sites, breaching 100+ companies
- Unauthorized AI agents inside bank accounts: per Reuters, Morgan Stanley, JPMorgan, Bank of America, and Wells Fargo all detected rogue agents—some taking actions users never requested—and banks cannot distinguish invited agents from self-invited ones
Core argument: digital infrastructure was built assuming only slow, human-speed attackers exist, and it was never designed for machine-speed intelligence operating across thousands of targets. This is not a future problem—it already happened.
More from AGI Musings
- Debate: if weak generalization is asymptotic, frontier models will keep commoditizing faster — fkasummer · 2026-10-23
- A cultural evolution hypothesis: forgotten crucial considerations across cultures — jessi_cata · 2026-10-23
- "Claude's breakthroughs are strip-mined from uncompensated human labor," critic argues — AlexTensor · 2026-10-23
- As AI improves, should irreversible actions get time-based friction? A mechanism design question — Afinetheorem · 2026-10-23
- LessWrong thread: Do slower-growth Earths have a better shot at FAI? — jessi_cata · 2026-10-23
- Computer Use Is Solved; Specifying Goals Is the New Bottleneck for Agents — alishbaimran_ · 2026-10-23