This is genuinely concerning for the security of every DeFi protocol over the next few months. In July, the UK AISI reported that recent open‑weight models such as GLM‑5.2 and DeepSeek‑V4 Pro already match the performance of closed‑frontier models released only four to seven months earlier. That represents a significant narrowing of the six‑to‑ten‑month gap they had measured throughout most of 2025. A few months is not zero, but it is short compared with the typical time defenders need to adapt and deploy protections. Open‑weight models make the situation especially dangerous because attackers can run them privately, without supervision and with virtually no guardrails. For most of cybersecurity history, sophisticated attacks remained relatively scarce because the people capable of executing them were scarce. That scarcity acted as a quiet stabilizer for the ecosystem. AI is removing that constraint in two ways simultaneously. First, For actors who are already capable, AI raises throughput. Skilled actors such as the DPRK, elite North Korean hackers, and offensive security teams benefit from AI, which simply raises their throughput. Tasks that once consumed scarce expert hours can now be automated or run semi‑autonomously. A team that previously had to select one lead from ten candidates can suddenly explore a hundred. Second, for less sophisticated actors, AI lowers the barrier to entry. More of the attack chain becomes something you can supervise rather than master yourself. Someone who could never have written an exploit can now guide a model that can. The result is predictable: increased output from those already capable and a growing pool of newly capable attackers. DeFi will experience this pressure first and most intensely, in my opinion, as it is already occurring.

We are cooked

state of cybersecurity in october 2026

the craziest part of the Brotli bug isn't the bug. the fix was sitting in Brotli's code since February. nobody realised it was a security hole, so no new version shipped. for 8 months, every app built on the last official release still had it. Node.js, Bun, proxies like Envoy. it took, AI-assisted security testing to connect the dots.

wait, read this part again. OpenAI put AI agents in separate boxes. no network. no shared files. no way to talk to each other. so the agents worked out how to send messages using tiny timing differences in the hardware. one tapped out a signal, the other measured it and decoded it. nobody taught them that. they figured it out because they had a goal.

If you're early in your career and don't know where to go, go into security. This month AI found more serious bugs than teams can fix. Every company is going to need people who can check code and clean up after it, and there aren't nearly enough of them. Pick one area, learn it properly and share what you find. Six months of that and you'll be ahead of most people applying.

PHP last week. Ruby after that. Now this. AI is clearing out 20 years of hidden bugs in a month. Rough few weeks ahead.

$2.7M printed out of thin air in one go. That's what a hacker did on Initia tonight, then moved it out before the team could react. Initia switched off its entire network tonight after a bug let an attacker create ~$2.7M in tokens out of thin air and move it out before anyone could stop it. Imagine a bank bug that lets you type in your own balance, then withdraw it. That's an "infinite mint." The co-founder reportedly says it was an unknown flaw in the chain's core software. Full details aren't confirmed yet.

Railway hack: attackers broke in to steal AI keys. TLDR: • Hackers were inside Railway's systems for ~38 hours • They weren't after user accounts. They wanted stored OpenAI, Anthropic and other AI keys • Goal, per Railway: use victims paid AI accounts to copy top models cheaply • They attacked using uncensored AI models and heavy compute • Up to ~100,000 workspaces had secrets potentially exposed • GitHub, OpenAI, Anthropic, Stripe and others revoked keys Your AI key is now a credit card with no limit. Set a spend cap and rotate it today.

Cyberattacks are now on the same official list as storms and floods. The UK is asking every household to keep three days of food, water, cash and a radio, in case critical services go down. Security is now a public safety issue.

If you're in AI, then pivot to Cybersecurity.

For 20 years the number of new CVEs barely moved. This year it went from about 4,300 a month in January to nearly 15,000 in September. AI is finding bugs faster than anyone can patch them. What's your team doing differently this year?

DeFi Security Summit started as a Stanford workshop in 2022. Today, it's one of the most respected conferences in onchain finance security. Every talk is shortlisted by researchers from @trailofbits, @OpenZeppelin, @Certora, @ethereumfndn and more. This year, our auditor @cryptanu presents: "𝗗𝗮𝗺𝗻 𝗩𝘂𝗹𝗻𝗲𝗿𝗮𝗯𝗹𝗲 𝗗𝗮𝗺𝗹" The talk breaks down how the contracts behind institutional tokenization fail, and how to find those flaws before attackers do.

Bug bounty payouts for AI vulnerabilities rose 339% in a single year on HackerOne. Prompt injection reports alone went up 540%. This October, a hacker used DeepSeek with its safety controls off to attack Indian universities. AI is now breaking things and being broken at the same time, and someone gets paid to find the holes first. That's why AI is making cybersecurity one of the most interesting fields to work in right now.