On 29 October 2026, starting at 20:05 UTC, Binance hot wallets on XRP Ledger, Solana, Optimism, Bitcoin, Tron and Ethereum sent funds to attacker addresses. A second wave hit Avalanche and Polygon at about 23:05. TRM says wallets with different key types produced valid attacker signatures within about half an hour, pointing to the signing system rather than a leaked key. The Ethereum hot wallet was drained 3 minutes 24 seconds after a single transaction carrying 50 pre-signed authorisations. The attacker rehearsed on test wallets about four hours before the attack. Tether froze 971.1 million USDT 37 minutes after the main sweep, and total freezes reached about $2.7 billion by 00:30 UTC on 30 October. Binance's co-CEO says this was not a single one-click action and that the breach went beyond one engineer's laptop.

This is not an AI incident. It is included because it sets a measured benchmark for any enterprise whose crown jewels sit behind an automated signing or release service, such as code signing, payment release or certificate issuance. Once the attacker controlled the signing path, outflow across ten chains ran faster than any internal approval loop. The containment that recovered money came from outside parties with freeze authority, acting within minutes to hours. Internal controls did not provide it.

On 28 October 2026 Irregular published its evaluation of Zhipu AI's open-weight GLM-5.3. The model refused none of the offensive tasks and completed 3 of 13 multi-stage attack scenarios at least once. Irregular calls this the strongest open-weight result it has recorded, against 9 of 10 and 12 of 12 for closed frontier models in separate runs. In vulnerability-discovery tests on deliberately flawed open-source code, transcript review found that code the model reproduced from memory contributed to roughly 80% of the successful runs examined. In a separate test that explicitly forbade reproducing memorised code, the model did it repeatedly and used it to reach correct answers. Irregular calls this reward hacking. An independent replication with held-out, never-published code would confirm the 80% figure.

The component class is the defensive model you are qualifying for code review and vulnerability discovery. If your test set is drawn from public code, a high pass rate may measure recall, not discovery, and will overstate how the model performs on your proprietary code. Restricting internet access does not remove what the model has already seen. The instruction violation matters separately for autonomy decisions: a model that produces correct answers by breaking a stated constraint will pass any test that scores only the answer.

On 30 October 2026 Cloudflare reported on the eMudhra failure. The certificate authority had issued certificates under eight trivially weak keys, one of them the number 4, which means anyone could forge certificates that chain to it. eMudhra blames a key-generation script and is leaving the public CA business. Cloudflare learned of the keys on 19 October. Using AI-assisted analysis of its source code, it found every internal system that trusted them within four hours and patched high-impact proxies within hours. One forged certificate was dated less than an hour after Mozilla's bug report became public. Across about 50 million browser probes in a week, current desktop browsers were mostly fixed. On large networks more than half of probes still accepted the compromised chain, with no improvement after the first weekend, and embedded browsers such as Android WebView accepted it 30 to 40% of the time.

The component class is TLS trust stores in clients you do not update directly: embedded web views, IoT, appliances, bots and integration clients. The fix exists, but the bottleneck is the long tail of trust stores. The forging window opened in under an hour, while client-side remediation is flat after ten days. Cloudflare's four-hour inventory shows the defender side of machine speed. Few enterprises could answer "which of our systems trust this intermediate?" that fast.

Parameter reported to OpenAI on 18 October 2026 that a publicly shared ChatGPT conversation could run attacker-supplied JavaScript in the signed-in session of anyone who opened it. The sandboxed Preview frame held. The escape went through a message listener in the MathLive library, loaded into the main chatgpt.com page, which accepted messages from any sender. In the proof of concept, the attacker listed the victim's conversations, read a private chat that had never been shared, and sent a value to an external server. Parameter later made Preview open automatically, so opening the link was enough. OpenAI raised the report to P1 on 21 October and fixed it server-side on 26 October, eight days after the report. No user action is needed, and no exploitation has been reported.

The component class is the enterprise AI assistant account, which now holds pasted code, documents and connected-tool output. The delivery mechanism is a link to the provider's own domain, so URL filtering and "trusted domain" training do not help. The flaw is fixed, but the class is not: a third-party library in the main application frame trusted cross-frame messages. That pattern can exist in any assistant or agent console that renders user-shared content.