On 29 October, about $6.3 billion was stolen from Binance, most of it in twenty minutes. TRM Labs pinned it on TraderTraitor, a North Korean group analysts count as part of Lazarus. Two days later the FBI attributed it to North Korea under the same name.
Binance first pointed at one compromised laptop. Its initial findings tell a longer story. In June, a wallets DevOps engineer searched for a popular AI coding tool and installed it through a tampered Homebrew download. Security caught it and replaced the machine, but the exposure had already happened. In September, a second engineer took a fake job interview and ran the “technical test” on a work computer. The malware got past endpoint protection. On 20 October, working from the second engineer’s compromised computer, the attacker used an internal AI tool to take over the first engineer and a third, and found a token that could deploy containers. On 29 October, the attacker deployed one and reached the wallet signing service. That is Binance’s own account, published before the independent review.
In February I wrote about AI agent platforms turning developer machines into an entry point, and named Lazarus among the groups patient enough to use them. No target, no date. Binance’s account has an AI coding tool as one lure and an internal AI tool as the springboard, though it does not say how June fed into October.
Some of that is hard: previously unseen malware, a staged recruiter, an on-chain trick I will come back to. Most of it is old. An installer from a search result, untrusted code on a work machine, a deploy token on a laptop, a container that could reach the signing service. And an internal AI tool that could be turned against other engineers’ machines, which Binance has since rebuilt with tighter access controls. The model was not the attacker. It was a tool with too much reach, an old problem with a new label. My reading, from a handful of cases, is that where a model shows up in these stories, the access around it decides how bad it gets, and so does whoever checks that access. I have watched the same thing happen in my own repository.
The way in
I have made this point before, in September and again in late October.
Hours before Binance, Polymarket paused trading after malicious code was served through a third-party monitoring script, reported as DebugBear’s. A wallet tied to the theft held about $2.65 million.
On the night of 11 October, someone put the refrigeration in at least 350 French supermarkets into forced defrost and pushed temperatures as high as 50°C. Stores threw out stock, and several had fires. Danfoss said many of the affected controllers ran outdated firmware or were past end of life.
In late July, more than 30 Minnesota water systems were targeted in a campaign that changed addresses and passwords on internet-facing controllers. Braham ran on its water tower while the controls were down. LevelBlue traces the campaign to exposed PLCs, some with configurations from the same third-party providers. In 2023, the campaign that hit Aliquippa went after Unitronics controllers with default passwords or none.
Last December, Amazon’s Kiro agent took down AWS Cost Explorer in one region, and Amazon’s own verdict was misconfigured access controls; it now requires peer review for production access. At Vercel in April, a compromised third-party AI tool, Context.ai, used an OAuth grant to reach an employee’s account. In both cases an AI product sat in the chain and the damage ran through access.
None of the public accounts makes a new model capability necessary to explain the entry. Some needed patience.
The entry is boring. What follows it often is not. Binance says the attacker used the signing service to move funds outside the normal withdrawal process, then used Ethereum’s EIP-7702 to hand a contract it controlled partial rights over a hot wallet. Those rights lived on-chain, so pausing withdrawals did not stop them, and with a multi-party wallet there was no single key to revoke them fast. Sophos’s Rafe Pilling told Reuters this group is expert at learning how a company’s systems and staff approve money transfers. The laptop was only the first door. Months went into getting through the rest, and an authorization trick into what came after.
The bug that does not fit
On 21 October, a day early, PHP shipped fixes for two remote code execution bugs rated 9.2, CVE-2026-109618 and CVE-2026-109619. Under the right conditions they need no login. CISA says they affect every PHP install serving web requests, and listed both as exploited on 26 October.
This is not a default password. One bug corrupts memory when PHP aborts a request that ran out of it. The other leaves global state pointing at another request’s memory. The oldest affected path goes back to PHP 5.4.0.
Models helped find them. Calif audited PHP through OpenAI’s Patch the Planet programme, starting from a researcher’s hypothesis, with a model doing the analysis and no special harness. Its first bug dates to 1 August. OpenAI reported the same root cause independently, and Wiz added further attack vectors.
Then the boring part. The CVE identifiers leaked on 20 October, so PHP moved the release up a day, and a demo video posted by mistake later that day gave away a little more. The PHP Foundation says Chainguard broke the embargo by publishing patched images six hours early, which Chainguard disputes. Amazon’s honeypots logged an apparent exploit attempt on 17 October, before any known leak, and Amazon said at the time it did not know how the sender got the details. Cloudflare’s Matthew Prince counted thousands of attempts before the announcement and millions after. Tenable found working exploits had to be fitted to each target’s exact PHP setup, except on devices that share one build, and its own AI agents sped the work up while producing at least one convincing false positive.
PHP2Shell complicates my argument. PHP’s own developers saw the first signs of the out-of-memory problem in 2024, suspected it might be exploitable and found no concrete way. Researchers working with models proved there was one. Here the models sit on the side that finds hard bugs, steered by someone who knows where to look. October’s headline breaches came in through weaknesses that did not need a model to find.
Where vibe coding comes in
Where the public record shows the way in, most of these were a password, an exposed panel, code or credentials in the wrong place, or a missing access check. The question is who catches them before an attacker does. Vibe coding, meaning accepting what the model writes without reading it, removes that person by design.
Veracode runs models through 80 security-sensitive tasks. Across more than 100 models over four years, the average pass rate is 56%, and Veracode says it has not moved. GPT-5.5, the leader in Veracode’s Summer 2026 dataset, still fails about one security task in three.
GitGuardian counted 28.65 million new secrets in public GitHub commits in 2025. Commits co-written with Claude Code leaked them at 3.2%, against 1.5% overall, though GitGuardian warns against reading that as a simple tool failure.
CodeRabbit found AI-co-authored pull requests carried about 1.7 times as many issues as human ones and 1.57 times as many security findings. The 2.74x that gets quoted is XSS only.
Georgia Tech researchers tracking CVEs with traceable AI involvement counted 35 in March by the 20th. One of them, Hanqing Zhao, told The Register he estimates the real number at five to ten times that. None of these numbers isolates unreviewed code. They document problems that review is supposed to catch.
Moltbook is the exposure. Wiz quotes its founder saying he wrote none of the code. A Supabase key in client-side JavaScript is normal; what made it a way in was the missing row-level security behind it. Wiz got read and write access to the production database, with 1.5 million API tokens and 35,000 email addresses in it.
Same broad class of failure, default or missing passwords in the Unitronics campaign and missing access checks at Moltbook.
None of October’s operational breaches has been traced to unreviewed AI-generated code. Vibe coding only has to keep producing these entry points at volume, with nobody placed to notice.
What this does not prove
The market is growing. Cursor alone was reported at $2 billion in annualised revenue in February. Calling these tools stillborn does not survive that, though revenue says nothing about how much of the use goes unreviewed.
Most of the numbers come from vendors. Veracode sells security testing, CodeRabbit sells review, GitGuardian sells secrets detection. Their methods are published and their results point the same way, which is why I use them, with a discount.
Older research was kinder. In a study first posted in 2022, Asare and colleagues found Copilot reproduced the human-written vulnerability only about a third of the time. Older models, snippets rather than whole apps, but it belongs on the table.
AI also defends. Mozilla says Claude Mythos Preview helped it find 271 vulnerabilities fixed in Firefox 150. SecurityWeek counted three CVEs naming the model; Mozilla later explained that it groups internal findings into combined CVEs.
Hacked and harmed are different counts. The Minnesota systems went to manual operation, and as of early August no damage to water quality had been confirmed. A wiper hit Polish renewable sites and a heat and power plant in December 2025. The UK and the EU attributed the attack to Russia’s FSB. It caused no disruption, though London says it could have cut power to 500,000 people in winter. In PHP2Shell’s first days, TNW reported that officials in Germany, the Netherlands and Japan had seen no successful attack.
And the dollars are lumpy. Through April, TRM put North Korea’s share of crypto hack losses at 76%, from two attacks. By those figures, Binance alone is several times all 2026 crypto hack losses TRM counted through April.
From the trenches
I am building a side project on Opus 5.5, and it is a very good model. I wrote the first version without taking part. Prompt, accept, move on. It worked, and it was so inefficient and so badly built that I could not look past it. I rewrote it from scratch, and the rewrite is still going.
The model wrote every line of both versions. What changed is who validates the result and the process.
One project and my own judgment, so treat it as an anecdote. The first version had no secrets in the code. Across the project, I found several of the access failures discussed here. On a case-insensitive disk, an uppercase spelling of the secrets file’s name slipped past the guard. A flag meant to scope access to one part of the job widened it to all of them. A search over the repository root could reach the secrets file. The agent that wrote the code could also write its own review verdicts. One tool permission failed open until the second security review.
Those holes closed once I put review into the process and decided what got fixed. Profiling during the rewrite found one call eating 634 ms per unit of work. Replacing it made the main job five times faster, from 169 seconds to 33, with byte-identical output. That is a speed result.
I build knowledge-base software for enterprise clients, and most of the security work is access. Who can read which document. Which token reaches which system. What still holds rights a year after the person who needed them left. None of it earns an essay, and most of the breaches in this piece went through some version of it.
The diagnosis I can defend is narrow. Most of these entry points have sat on checklists for years. The bug that should worry people most was proven exploitable by researchers working with models, and an apparent exploit attempt arrived four days before the patch. Someone competent has to own the boring layer, meaning patching, credentials, exposure, what a laptop can reach and, after Binance, what an internal AI tool can reach. For PHP, that means exposure and patch speed once the fix is out.
The boring layer has a code half and an operations half. Vibe coding hands the code half to models that pass a little over half of Veracode’s tasks on average, sometimes for founders who, like Moltbook’s, say they wrote none of it. The operations half stays with whoever is left. Most of those apps may never be attacked. Each one is another possible boring way in.
We need more talented engineers. I will keep saying it.