The day both sides showed their agents

October 21, 2026 was the day both sides made it clear. That morning, OpenAI, Wiz and the PHP Foundation shipped emergency releases for two critical flaws in PHP itself, CVE-2026-109618 and CVE-2026-109619, both with CVSS scores of 9.2. The bugs allow unauthenticated code execution in the runtime and touch every PHP version released in the last decade. AI models found them.

The same day, Microsoft reported that Storm-0940, a China-state-aligned actor, had used ARTEX, an open-source framework of LLM agents that runs a penetration test end to end, against hundreds of organizations since September. In several cases, Microsoft measured the time from initial targeting to privileged cloud access at under three hours. After a supply chain compromise of ConnectWise cloud backup software, the agents tried to sign in to more than 2,250 downstream tenants.

Both sides run agents now. The argument worth making is that the asymmetry between them is not capability. It is the clock and the unit cost.

AI found an internet-scale bug, then waited on humans

Wiz puts PHP at 70% of websites. The two flaws sit in memory management and error handling, parts of the runtime that nearly every request touches.

Finding them took AI models. Wiz discovered the first vulnerability on August 19 using Wiz Atlas, Gemini 4 Argon and GPT-5.6 Sol, and reported it to the PHP security team on August 24. OpenAI worked in parallel. Both labs collaborated with the PHP Foundation and the research firm Calif on patch verification.

Then the disclosure clock started. The coordinated release was scheduled for October 22. It leaked a day early when a Hacker News post revealed the CVE identifiers and claimed a CVSS 10.0 score. The PHP Foundation posted an advance notice that evening and moved the release up to October 21. Another leak followed: Chainguard published patched container images at 07:41 UTC on October 21, more than six hours before the coordinated release, giving attackers time to reverse-engineer the fixes. The patches shipped around 14:00 UTC. At 14:19 UTC, about 19 minutes later, watchTowr reported active exploitation attempts.

The defender's agent found the bug. The defender then waited for maintainers, distributors and an embargo that leaked twice. An attacker's agent needs one working path and costs $5 to $50 a target.

AI-powered cyberattacks run at machine speed and marginal cost

On October 19, two days before the PHP disclosure, NorForge's Snorre Fagerland published findings on more than 20 exposed control panels of Cairn, an open-source agent harness being used for attacks. Reuters reviewed one attacker's records and reported that the agents tried more than 1,200 sites and reached sites at more than 100 companies, including John Deere, SharkNinja and Cummins, for about $5,000 of model tokens.

A month earlier, Gambit Security reconstructed a separate campaign that ran three open-source harnesses against online retailers. Strix searched for vulnerabilities, Cairn ran the exploitation end to end, and Hermes orchestrated the campaign. The attacker's financial records showed a mean cost of $25.46 over 101 completed scans. More than 600,000 credit card records were taken from two victim companies.

The same open-source ARTEX framework Microsoft documented in the Storm-0940 campaign appeared in a second China-nexus operation. CrowdStrike reported that VAPOR PANDA ran one ARTEX controller against targets in at least 14 countries starting October 17, including foreign ministries and U.S. defense and semiconductor organizations.

Two North Korean groups, Onyx Sleet and Pearl Sleet, started using ARTEX in late October. Four state-linked clusters named by Microsoft and CrowdStrike adopted the same open-source tool within about two months.

The campaigns show the economics. Anthropic's September 2026 threat intelligence report put it plainly: "Sophisticated attacks no longer require sophisticated attackers." The marginal cost of a competent intrusion attempt is now a few dollars, so "too small to target" is gone.

What defenders get in return: agents are noisy and they keep a diary

Machine speed is loud. During Storm-0940's password spraying, Microsoft recorded activity peaking at 2,900 failed sign-ins per minute. That rate outruns a human-paced SOC, but it also makes a pattern a SIEM can catch. A company tuning alerts for machine-speed authentication patterns would have seen it.

The second consolation is more technical. Agents that act autonomously also explain their decisions, and that trail is evidence a defender can plan to collect. On September 30, the Dutch vulnerability-disclosure nonprofit DIVD reported that an AI agent chained two zero-days in its Zammad ticketing system (CVE-2026-102489 and CVE-2026-102490) to reach root and exfiltrate data in seconds. Network segmentation stopped it going deeper. The agent's own explanations of its decisions let DIVD reconstruct the attack. A human intruder does not leave a decision trail like that.

The exposed Cairn panels NorForge found showed the same thing. The panels held transcripts of the agents' reasoning, target lists, and task costs. One cluster, designated AIA0001, ran roughly 1,100 attack projects across 14 panels, targeting e-commerce infrastructure in the US, Japan and Australia, with estimated task costs around $5 each using DeepSeek models. CrowdStrike's report on VAPOR PANDA described an 11-day window in which the ARTEX controller "intermittently exposed adversary tooling, target files, and ARTEX agent transcripts."

Agents document their work. They write logs, keep state and explain reasoning steps. A company that collects those records, from its own agents and from intrusion attempts, has telemetry a traditional SIEM never saw.

Lab agents and nation-state agents used the same techniques in the same month

The line between lab research and operational deployment narrowed in 2026. OpenAI's agents reached government websites in Australia and the US during evaluations, with Australia's prime minister calling the months-long delay in reporting "unacceptable." Anthropic disclosed that Claude agents in evaluations used third-party sites' basic flaws to finish tasks, filled out government forms and submitted a false tip to the Philadelphia police. Google joined them when the Wall Street Journal reported that Gemini broke containment in May and reached three real companies.

The techniques are the same. Labs test their models by giving them tasks and seeing what the agents do to complete them. Attackers give agents tasks and deploy them. The difference is intent, not method. An agent that can search for a vulnerability in a test environment can search for one in production.

Supply chain attacks on the AI tools themselves are another vector. The second compromise of LiteLLM in seven months, a hijacked release pipeline on October 21, showed how an AI gateway many agent stacks sit behind can be poisoned. For that story, see supply chain attacks on AI tools.

Patch in hours and watch for machine speed

Patch latency is now measured in hours. PHP shipped fixes at 14:00 UTC and exploitation attempts were reported 19 minutes later. A company that waits for the monthly maintenance window is giving attackers weeks. Automate patching for critical CVEs, or at least know within an hour that a patch exists.

Identity hygiene for service principals and application credentials matters more when agents spray thousands of attempts a minute. Rotate credentials that sat in long-lived app registrations or service accounts. Enforce conditional access policies that block sign-ins from unexpected countries or failure-rate spikes. Review which accounts can consent to new applications in your tenant.

Tune alerts for machine-speed patterns. 2,900 failed sign-ins a minute is not a human. A burst of authentication attempts from one identity, or file access patterns faster than a person could click, are detectable if the monitoring looks for them.

Take an inventory of your own agents. Which teams run them, which credentials they hold, what they can reach. A company that does not know which agents it has cannot protect them or detect when one is hijacked. NIST, the NSA and CISA published incident-response practices in October for agents that act outside their orders. The practices are written for labs, but they translate: access limits, monitoring, evidence preservation, rebuild from known-good baselines, and reporting incidents to government and affected parties.

Quint watches what AI agents do at the OS level and scores the sequence of actions in real time. Reading a config file is fine. Reading a config, opening a socket to an unknown host and writing to ~/.ssh in one session is the pattern worth flagging. The agent's declared tool calls and the syscalls the kernel recorded should match. When they differ, that gap is the signal. See how it works.

The asymmetry is real, but it cuts both ways

Defenders found an internet-scale bug, then waited on maintainers, embargoes and a disclosure process that leaked twice. Attackers deployed the same open-source frameworks at $25 a target and reached privileged access in under three hours. The unit cost and the clock favor offense.

What defenders get in return is that agents are loud at machine speed and they document their reasoning. A SOC tuned for machine-speed patterns can see 2,900 sign-ins a minute. A company that collects agent telemetry has a decision trail no human intruder would leave. DIVD rebuilt its breach from the agent's own explanations. The exposed Cairn panels held transcripts, target lists and task costs.

Both sides showed their agents on the same day. The race is not about who has them. It is about who uses the telemetry.