Black October rewrites security's rules: AI attacks end-to-end in 20 minutes
Wiz's CTO calls it a black-swan event: open-source models have caught up with closed-source models' vulnerability-discovery ability, and attackers can now go from initial access to stealing all keys in about 20 minutes.
The video won't play here. Listen to the audio instead:
The argument · tap a timestamp to hear it
Black October represents a black swan in security history
Ami calls this October a black swan because he has never seen so many security incidents occur simultaneously in a single month. This includes both surging numbers and severity of vulnerabilities discovered—including what he believes may be the most serious PHP vulnerability ever found by AI—and AI attackers targeting companies, startups, and connected devices like refrigerators at scale with unprecedented speed and sophistication. He emphasizes this is not theoretical; it is happening now.
— Ami LuttwakOpen-source models are closing the gap faster than anyone predicted
A few months ago, the team estimated open-source models lagged closed-source models by several months. That gap is now closing rapidly. Attacks are no longer limited to complex PHP vulnerabilities; even simple API mistakes can now be found and exploited. Attackers can now complete the entire chain—from finding a zero-day through running code in a customer environment to finishing the breach—in about 20 minutes, work that once took top attackers weeks or months.
— Ami LuttwakEvery AI platform becomes a target for attackers seeking the keys
Wiz's blog initially listed nine AI development platform companies attacked in October. That number grew daily and had reached 915 by recording time. These companies are targeted specifically because they hold AI keys. Attackers do not need advanced skill—only the ability to use open-source models capable of finding code problems, then convert those findings into actual breaches within 20 minutes.
— Ami LuttwakPHP patches arrive quickly, but coverage will remain incomplete for years
PHP comprises about 70% of externally accessible technology, affecting nearly all customer environments. The positive: customers respond fast, with about 50% completing patches within the first two to three days. The negative: because the base is 70% of the internet, full remediation of this single vulnerability will take years. Many old PHP versions will never receive patches, creating permanent gaps.
— Ami LuttwakExploit code can be written and leaked faster than patches deployed
Ami identifies a structural misalignment: AI has dramatically compressed the time to write working exploit code, but patch deployment time has not shortened; over the past 20-30 years it has actually lengthened. Moreover, information often leaks before CVE publication. Even in PHP's case, where the team coordinated with officials for months, disclosure came early. Customers had no time to wait for patches. The only realistic path forward, Ami argues, is for new companies to integrate automated development, testing, and CI/CD from day one—enabling them to instruct the system to ‘fix this’ and have it complete automatically. Established companies rarely manage this.
— Ami LuttwakSecurity teams must route alerts to the right model for each case
Ami uses Blue Agent as an example: running the most expensive model on every alert is impossible, so you design a pipeline—deterministic detection first, then a cheap model, then the most expensive model for final judgment on suspected threats. He argues this layered, cost-efficient multi-model pipeline design is the real engineering challenge facing security companies (and all AI systems companies). Otherwise, code scanning alone could consume millions in budget without solving the continuous problem.
— Ami LuttwakThe highest ROI is continuous scanning of exposed surfaces, not code alone
Ami is direct: Mythos-style code scanning generates the most press, but he argues it is not the most efficient approach. The real priority for continuous scanning is unauthenticated surfaces directly exposed to the internet—where actual attackers actually start. Two days before recording, a major breach occurred because hardcoded keys in a mobile app led to mass user data theft. That is the actual entry point. He advocates continuous self-attack simulation using a Red Agent, because systems secure today may become vulnerable tomorrow as new model capabilities emerge.
— Ami LuttwakMost of what security teams do is not actually security work
Ami makes a sharp observation: security teams devote substantial time to compliance reports and administrative tasks, with only a small fraction on red-team testing, risk mitigation, and incident preparation. He argues that security work consists truly of only two categories—preparing for attacks through self-attack testing, and installing guardrails against breaches through detection and response. Everything else should be eliminated. Budget and effort should concentrate on finding and handling critical risks, not buying more tools or working through compliance checklists.
— Ami LuttwakThis is one of the rare domains where AI surpasses human ability
Ami notes that unlike the hacker wave of the 1990s, society's dependence on technology is far higher now, and the attack domain is one of the few areas where AI has fully exceeded human capability—including attacks of stunning complexity, like kernel-driver zero-days, that human attackers could scarcely accomplish before. Now these happen daily. He judges that companies that will survive are those that assume from the design stage that systems will be breached, and take offline anything they are not prepared to defend.
— Ami LuttwakIn their own words · checked verbatim
the models are good enough now to find and exploit complex vulnerabilities
Ami Luttwak4:09
basically run an entire attack that usually took for the best attackers weeks or months in, again, around 20 minutes
Ami Luttwak5:10
the best defense is attack
Ami Luttwak22:41
Most of what security teams do is not security.
Ami Luttwak35:11
we're going back to the 90s and 2000s again
Zane Lackey39:12
AI attacks now are prevalent, easy, but also better than any human.
Ami Luttwak41:19
Figures
| PHP share of externally accessible technology | about 70% | 7:13 |
| AI development platform companies attacked in October | 9 to 915 | 5:37 |
| PHP vulnerability patch completion rate within 2-3 days | about 50% | 7:13 |
| Time for complete attack chain | about 20 minutes | 5:10 |
Glossary
- Blue Agent / Red Agent
- Wiz's internal AI systems handling automated detection (blue) and automated attack simulation (red).
- Atlas
- Wiz's unified framework for calling multiple frontier models to detect vulnerabilities.
- CSPM
- Traditional cloud security tools limited to configuration checklist audits; Ami argues they are no longer sufficient.
How to listen
Enterprise CISOs, security engineering leaders, and startup founders and CTOs who set security spending priorities and system architecture.