Black October Tests Cyber Insurers Against Uncensored AI Attack Tools

A week that security researchers and X users have taken to calling "Black October" began on October 16 with an intruder running AI agents against an AI coding company for two days, and ended on October 22 with most of the world's PHP web servers still unpatched against two remotely exploitable flaws that frontier models helped find. In between, a cloud platform told every customer to rotate every secret, a widely used AI gateway shipped a credential stealer to PyPI, and an open-weight DeepSeek model released on October 17 appeared on Hugging Face with its safety refusals removed.

For cyber insurers the question is not whether the label fits. Forkast News, which catalogued the week, called it "a disclosure wave, not an attack wave," because most of the underlying weaknesses were months old. The question is the mechanism that connects the events: open-weight models that anyone can strip of their guardrails, driving agents that run attack chains at close to zero marginal cost, against a market that the NAIC reported on October 21 is growing in policy count, deteriorating in loss ratio and still cutting rates.

CyberCube's William Altman described the pricing problem in July, before any of this. "When the cost of running a full attack chain approaches zero, criminals don't need to be as selective," he said, calling it "an early signal to weigh in pricing, not yet a trend of losses." October supplied the first week of signal.

Key Takeaways

An uncensored copy of DeepSeek-V4.1-Flash-1017 was downloaded more than 4,100 times in a month and complies with all 52 HarmBench cybercrime prompts.
OpenCode said attackers ran AI agents against it for 48 hours while its defenders' models refused to analyze the malicious code; 1.4% of console users lost keys.
PHP2Shell, found with frontier models, sits under 69.3% of websites; 99.3% of 2.2 million visible PHP instances were unpatched a day after the fix.
Railway said its October 21 breach was part of a series of attacks aimed at AI inference providers; LiteLLM shipped a credential stealer the same day.
The NAIC's 2025 data shows US cyber premium of $9.46 billion, up 3.5%, a loss ratio of 53% from 48.7%, and rates still falling 2% a quarter.
Coalition expects open-weight models to show up as attritional claims rather than one systemic event; Munich Re expects frequency to move before severity.

The label and what sits under it

The incidents grouped under the name are real and dated. OpenCode, maker of an open-source AI coding agent, said on October 17 that "a large-scale distillation attack" the night before had hit 1.4% of OpenCode Console users, the service that stores their OpenAI, Anthropic and Google keys. DeepSeek released V4.1-Flash-1017 under an MIT license on October 17. Amazon's honeypots logged the first PHP2Shell exploitation attempt the same day.

Railway disclosed its breach on October 21; LiteLLM's poisoned release went to PyPI at about 11:39 UTC on October 21 and was pulled within two hours; PHP's emergency patches came out at 14:00 UTC that day; GitLab and Node.js issued critical fixes alongside. eMudhra, a certificate authority, revoked eight intermediate certificates with broken private keys on October 18, leaving about 30,000 customer certificates to migrate.

Forkast's Heath Callahan argued that the week "is when the bills were dated, not when they were incurred." The eMudhra keys had been weak since April 2025. Wiz found the first PHP flaw on August 19 and reported both to PHP on August 24; PHP acknowledged them on September 21. The Tor exit-relay interception that also made the lists ran from October 1 to 5. The outlet could not find the origin of the "Black October" label on X and flagged a viral video claiming bank intrusions as unverified.

That is a fair correction of the headline. It does not change the actuarial reading. An insurer prices the arrival rate of losses, not of disclosures, and three of the week's events show the arrival rate being pushed by the same thing.

Open-weight models, with the refusals removed

DeepSeek's V4.1-Flash-1017 is a capable, cheap coding agent. Its model card calls it a "minor update" to the September V4.1-Flash, tuned for agent software; on the DeepSWE software-engineering benchmark it resolves 77% of tasks, against 74% for Anthropic's Claude Opus 5 in DeepSeek's own table, and API pricing starts at 15 cents per million input tokens. The weights are on Hugging Face under the MIT license, which permits modification and redistribution.

Within the same period a third-party repository on Hugging Face published a copy described as the model "with its refusal behavior removed," a weight-level edit the card calls "abliterated." The card reports 4,141 downloads in the past month, 284 likes, tool calling and a 1 million-token context window preserved, and a HarmBench result of 52 out of 52 "COMPLY" in the cybercrime-intrusion category. Access requires a click-through accepting responsibility for the outputs. No attack has been attributed to it, and none needs to be for the exposure to exist.

The Cloud Security Alliance published a research note on October 21 on what happens next. It defines abliteration as "a technique for removing refusal behavior from an aligned language model without full retraining," and describes a ProjectDiscovery proof of concept from October 6 in which an edited open-weight model passed every clean test and, on a trigger phrase, emitted a shell command that posted `.env` files and SSH keys to a collection server.

The 7-billion-parameter version fired on 50 of 50 triggered prompts. The CSA's advice is to treat any edited model without verifiable provenance "as a control gap rather than an acceptable default," to pin weights by cryptographic hash, and above all to "separate command execution from network egress" in agent runtimes.

The regulators had already written the sentence that connects this to reserves. The BIS Financial Stability Institute and the IAIS, in a June paper on cyber insurance, said accumulation risk needs careful monitoring "particularly given frontier AI models that can expose systemic vulnerabilities," and cited CrowdStrike data showing AI-enabled attacks up 89% in 2025, with the average time for an attacker to move inside a compromised network down to 29 minutes. Beazley Security reported active exploitation up 43% in the first quarter of 2026 over the quarter before.

Agents on both sides at OpenCode and Railway

OpenCode's account is the clearest description yet of an agent-driven intrusion against an AI company. Co-founder Dax Raad said attackers had been trying to break in nonstop for 48 hours, so his team kept defensive AI agents running around the clock. The models the defenders used for analysis helped at first, then refused once the malicious code they were examining tripped safety filters. "That was a bit frustrating,"

Raad said. OpenCode later got access to OpenAI's Daybreak Blue program, which gives vetted defenders models less likely to refuse security work. Affected users reported unauthorized charges on their provider accounts from the hundreds of dollars to more than $1,000; Anthropic and Google blocked the exposed keys and OpenAI refunded usage. OpenCode has not said how the attackers got in or proved the distillation claim.

Railway, a platform developers use to deploy applications and databases, said on October 21 that it had "detected anomalous activity involving systems that store customer environment variables," the API keys, database passwords and registry credentials an application uses to reach everything else. An unauthorized party "may have accessed encrypted environment variables" and obtained some decrypted contents. Railway paused all deployments, told every user to "immediately roll all environment variables," asked upstream providers to revoke keys, and said the incident was "part of a series of attacks recently targeting platform companies" with the goal of compromising AI inference providers. It has given no root cause or customer count; chief executive Jake Cooper told TechCrunch a post-mortem is coming.

LiteLLM, the open-source gateway many companies use to route requests to AI models, closed the week's loop on the supply-chain side. Its incident note says attackers used three developer GitHub credentials to run the legitimate build pipeline against a lookalike fork, `Berri-AI/litellm`, one hyphen from the real repository, and publish version 1.107.0 to PyPI and Docker with a credential stealer that runs whenever Python starts and a second-stage remote access trojan. LiteLLM told anyone who installed it in the roughly two-hour window to assume compromise. The target in all three cases was the same asset: the keys that let an agent, or an attacker's agent, call a frontier model on someone else's account.

PHP2Shell: the frequency driver meets the accumulation scenario

The PHP flaws are where the capability argument and the shared-software argument meet. CVE-2026-109618 and CVE-2026-109619 sit in the PHP interpreter itself, so a site is exposed even when its own code is sound; both are rated 9.2 under CVSS 4.0 and allow an unauthenticated attacker to run code on the server. Wiz said proving them exploitable required "an exceptionally complex chain of steps, at the edge of what human researchers could practically achieve," and credited Gemini 4 Argon and GPT-5.6 Sol; OpenAI and Calif found the same root cause independently, and the vulnerable code had been in PHP for more than a decade. Core developer Gina Peter Banyard said "the only mitigation is patching/upgrading PHP."

Exploitation began before the patch and spread after it. Amazon's threat intelligence team identified an attempt "dating to Oct. 17, 2026," four days before disclosure, from a commercial anonymization network, and said the varied payloads suggested "multiple actors." Its conclusion was general: "The time from patch to working exploit is shrinking for structural reasons." Coalition's sensors saw the first matching requests at 08:00 UTC on October 21, with reconnaissance requests for phpinfo pages jumping to 3,839 in an hour from about 100. Cloudflare's chief technology officer, Dane Knecht, said attackers were changing payloads to get around its emergency firewall rules, which he called "a STOPGAP only."

The exposed population is the largest in any shared-software event to date. PHP runs 69.3% of websites with a known server-side language, by W3Techs' count, and WordPress alone is 39.6% of all websites. OX Security, querying Shodan for 24 hours after the fix, found 2.2 million publicly visible PHP instances, 99.3% of them still showing an unpatched version a day later. Recorded Future counted about 1.1 million hosts disclosing a PHP version, 758,000 of them on end-of-life branches with no official fix. Cisco Talos estimated that about half of PHP systems will never be patched.

Governments treated it as an emergency and businesses pulled sites. The NSA told organizations that could not patch at once to take systems offline; CISA, the UK NCSC, CERT-EU, Germany's BSI and Canada's Cyber Centre issued alerts. Parts of Wikipedia went down, government sites in the Netherlands, Finland, France, Denmark and Germany were taken offline as a precaution, BambooHR took its HR service offline in three countries and Sophos pulled a licensing portal. As of October 23, millions of exploitation attempts had produced no publicly confirmed compromise, officials in Germany, the Netherlands, the UK and Japan reported no successful attacks, and the flaws were not yet in CISA's Known Exploited Vulnerabilities catalog.

Event	Dates	Exposure	Where it lands on a cyber portfolio
OpenCode console breach	Intrusion Oct 16, disclosed Oct 17	Provider API keys of 1.4% of console users; attackers ran AI agents for 48 hours	Usage fraud on stolen keys; third-party claims; first documented agent-versus-agent incident
DeepSeek-V4.1-Flash-1017 and its uncensored copy	Release Oct 17; modified copy in the same period	Open-weight coding agent, refusals removed; 4,141 downloads in a month; 52/52 cybercrime prompts complied	No claim; lowers the cost of the attack chain that every frequency assumption rests on
PHP2Shell	Exploitation attempt Oct 17; patch Oct 21	2.2 million visible PHP instances, 99.3% unpatched at 24 hours; about 70% of websites	Shared-software accumulation; business interruption from precautionary shutdowns; dependent BI through hosts and control panels
Railway	Disclosed Oct 21	Environment variables for a "subset" of customers; count undisclosed	Dependent BI and liability where the breached party is a vendor, not the insured
LiteLLM 1.107.0	Published Oct 21, pulled within about two hours	Credential stealer and RAT in a PyPI and Docker release built from a lookalike repo	Software supply chain; credential exposure across every host that installed it

Sources: OpenCode and Dax Raad via TechCrunch; DeepSeek and the Hugging Face model cards; PHP, Wiz, Amazon Threat Intelligence, OX Security, Recorded Future via BISI, Coalition; Railway; LiteLLM's incident note. Figures as of October 23.

What insurers are pricing, and what they said they are not

The market the week landed in was described two days into it. The NAIC's 2026 Report on the Cybersecurity Insurance Market, released October 21 with 2025 data, puts US direct written premium at about $9.46 billion, up 3.5% after the first-ever decline in 2024, with domestic insurers writing $7.46 billion and alien surplus lines carriers about $2 billion.

Domestic policies in force rose 33% to 5.84 million and reported claims rose 20% to 56,323, more than six times the 2017 level. The industrywide loss ratio rose to 53% from 48.7%, the primary loss and defense cost ratio rose about eight points to 57%, and endorsements, the narrower cover added to a package policy, now make up nearly 63% of policies in force while carrying about 4% of premium.

Rates kept falling into the events. Marsh put US cyber rates down another 2% in the second quarter, continuing a decline that began in mid-2023, and the Council of Insurance Agents & Brokers recorded a 3.2% average decrease. Coalition's 2026 outlook, published in December, said the soft market "will likely persist into 2026" and that "carriers leaning too heavily on temporary claim trends will face heightened volatility." Its reinsurance arm said aggregation methods "will increasingly fail to keep pace with the scale and complexity of digital interdependence" and must capture correlations from "shared software, common vulnerabilities, and concentrated cloud reliance."

On the specific question of AI-driven attacks, the carriers have been consistent and cautious. Munich Re wrote in March that "our experts expect agentic AI to affect the frequency of attacks more than their severity in the near term," and that accumulation budgets "may also need to be adapted." Coalition's Toomey said in July that frontier and open-weight models will likely raise attack frequency and speed, with the insurance impact "more likely to appear through attritional claims than a small number of broad events," and that "cyber coverage has nothing to do with whether an attack was AI-automated or not."

CyberCube's Altman said models that assume attackers must choose their targets need to be reassessed, because "small and medium-sized businesses that were safe because they weren't worth a dedicated team's time" no longer are. His colleague Richard Ford: "We're entering the era of agentic autonomous attacks, and it's very unlikely that will play out well for us."

The frequency data is already moving. Coalition's own October 20 briefing, covered on this site, found AI lifted business email compromise claims 30% while funds transfer fraud fell 18%. The NAIC's 20% rise in claim counts on a 33% rise in policies, and the eight-point rise in the primary loss ratio, are the attritional pattern Toomey described, a year before an abliterated frontier-class coding model was a download away. What the week added is the severity side: a shared-software vulnerability found with the same class of model, exploited before disclosure, across 2.2 million hosts of which half may never be patched.

The capital behind the tail is larger than it was. Beazley priced PoleStar Re 2026-1, a $300 million cyber catastrophe bond covering remote-probability systemic events through 2028, in December, and says it has $670 million of cyber cat bonds and more than $1 billion of cyber excess-of-loss cover. CyberCube's estimate for the July 2024 CrowdStrike outage, $400 million to $1.5 billion for standalone cyber, placed that event between a one-in-two and a one-in-six-year loss; its models reach a 234% loss ratio at a one-in-200-year return period.

A mass compromise of unpatched PHP hosts would be a different scenario from a cloud outage, longer in duration and spread across more, and smaller, insureds, most of them uninsured: the BIS and IAIS estimate that around 99% of global economic cyber losses are uninsured, and Morning Consult found 24% of US small-business owners carry cyber cover.

The response, and the wording

Coalition's handling of PHP2Shell is the record of what a scanning insurer can do. It sent a zero-day alert on October 20 to policyholders it knew were running vulnerable PHP, before public disclosure, and a second on October 21 to every policyholder with PHP exposed to the internet, with instructions to patch and restart, take unpatchable systems off the internet, inventory bundled copies of PHP in control panels and appliances, and look for shells, changed web-root files and new cron jobs. It had done the same 24 hours ahead of attacks during July's WordPress WP2Shell flaw. Crum & Forster published guidance for insureds, and Insurance Business reported that other carriers with scanning tools were running the same exercise.

The questions brokers were fielding by Thursday were about wording. Whether a precautionary shutdown of an unpatched server is a covered interruption depends on the policy's waiting period and its trigger; dependent business interruption for a host or control-panel vendor is often sub-limited; and whether a site on PHP 7.4 counts as a neglected vulnerability matters under the widespread-event endorsements Chubb introduced in 2022 for exactly that case.

The IAIS paper notes that Chubb has warned the lack of a clear definition of a systemic event "could lead to costly litigation in claims disputes," that the LMA's war and state-backed-attack exclusions "may not have yet been tested in the courts," and that non-affirmative cyber still accounted for about 7% of gross losses in the PRA's 2022 stress scenarios.

AI itself is not excluded. The paper reports that AI risks are not excluded from most cyber policies and quotes Munich Re's view that AI risks under traditional cyber policies "are manageable"; Beazley wrote AI into its cyber wording at no extra limit in September while about 60 carriers added exclusions; Toomey's point is that most policies contain nothing that says "unless the attacker used AI." An uncensored coding model does not change what a policy covers. It changes how many policyholders are hit, how fast after a disclosure, and how small a target is worth attacking, which is the frequency curve, and it changes it before the loss data does.

Railway's post-mortem, the first confirmed PHP2Shell compromise if one emerges, the next patch count, and whether CISA adds the PHP flaws to its exploited-vulnerabilities catalog will say over the weekend how much of the week's exposure became loss. The NAIC's next report, with 2026 data, is a year away.