# Black October: AI Is Turning the Internet Into a Dark Forest *Author: Bankless* *Published: Oct 24, 2026* *Source: https://www.bankless.com/podcast/black-october-ai-is-turning-the-internet-into-a-dark-forest* --- Is AI turning the entire internet into a dark forest? Security experts Hari Mulackal and Odysseas Lamtzidis join David Hoffman to unpack Black October, why AI-powered hacking is becoming cheaper and more scalable, how defenders are falling behind, and what it means for your crypto and personal data. # TRANSCRIPT David Hoffman: [0:04] They're calling it Black October, the worst month in cybersecurity of all time. There's Armageddon on the internet. We're going to figure out today whether it's really all that bad or not. Joining me on this stream today, we've got Hari, the CEO of Cantina Security. Hari, welcome to the live stream. Hari Mulackal: [0:21] Yeah, thank you, David. David Hoffman: [0:24] And joining Hari is Odysseus, CEO of Filix. Odysseus has been on the podcast before. Every time there's a security conversation, we tap in Odysseus. Odysseus, I would say good to have you back, but actually in these circumstances, maybe not. But either way, good to talk to you, my man. Odysseas Lamtzidis: [0:40] Yeah, thank you so much. David Hoffman: [0:43] Okay, so I want to learn a little bit about what your guys' last two days have been like. You guys are both security experts. It's the worst week of cybersecurity, apparently, of all time. Are you guys busy? What is it like to be in the world of security right now? Hari, I'll start with you. Hari Mulackal: [1:02] I'll give you an answer that you're probably not expecting, which is I think the public incidents have been very alarmist. People hear about all these incidents in the public. But the reality is that this has been going on for the last, I would say, 18 months. The number of incidents have been going up by a lot. Many people do not report incidents to the public. It's just that with the PHP one, with some of the healthcare ones, it's a big story. So taking a step back, we started seeing that agents and alums were starting to get really good at cyber last year. So back in, I would say, February, we started seeing this change. And we started seeing both offensive and defensive actors starting to use this newfound capability to build products and also to disclose security issues. Hari Mulackal: [1:57] There was an uplift in cyber ability around january where the mall started getting very good where the economics was cheap where now you can blast it on many companies and make disclosures we did that a lot starting this year, this year is just right now it's just a tipping point where many companies are starting to show up in news this is nothing new for us, last few days like we alerted a few of our customers with the PHP incidents because we had products that would enable them to scan their service area. So nothing new to us, just because we have been seeing this for the last 18 months. David Hoffman: [2:35] Nothing new to you guys, but nonetheless, something just feels different in the last week. Maybe it's a little bit of what you said, Hari, just the Twitter phenomenon of casting doom upon something, of inciting doom is very viral. So maybe that's what's different. Odysseus, what would you have to add to why this week feels so different than the wins previous season? Odysseas Lamtzidis: [3:00] I think it's the tipping point is, as Harry said, in the capabilities, like probably we saw last year with a lot of social engineering attacks where the deep fakes was the first like big change in capabilities. But that was like more targeted, I would say. And crypto obviously was a great target for that. And now we're actually seeing that it's actually very cheap to like blast that on the Internet and just scan everything. So security through obscurity is like breaking down in real time right now. And that's what we're seeing. David Hoffman: [3:35] I've got this tweet from somebody who works at Anthropic, Anthropic security researcher person who says, as bad as things have gotten in the past four days, they are going to get a lot worse before they get better. Security leaders never let a crisis go to waste. Please go to your boards and ask for help right now. Is it going to get worse? Is this just kind of just like the first time this has emerged in the public zeitgeist and actually this is going to escalate so next week or next month will be worse than October? Hari, what do you think? Hari Mulackal: [4:06] Oh, absolutely. So, with a lot of the AI capabilities, it's like there is this exponential where, either the capability or the cost keeps going down. So every time you have a... The capabilities are already there. It's now the economics. How do we do this at a scale where it's so cheap to hunt on every website? This is starting to inflect where the same thing that we could do in January, it's now 15 times cheaper, like 15x cheaper. That's our internal efficiency gain. And this will continue to get 10x cheaper in every six to 12 months. So... Hari Mulackal: [4:48] The way to think about it is that the scope has gone up where hacking in the past was a bespoke skill. So to hack a company, you needed to have a lot of talented people that would then spend weeks, months, maybe years trying to hack a company. And then you need to have profit at the end to hack it. So it was never scalable. Hacking has now become scalable where you can build a factory where you can give it a website. You can give it [bankless.com](https://bankless.com) and we'll go hack it. You don't even have to think about costs because it will cost like $10 as opposed to like two weeks of human time where now you need to think about ROI. What do I get from hacking bankers? So right now, the unfortunate reality is that you can build a factory that will like churn in exploits and no humans need it. And the economics is falling to zero. Yeah. Odysseas Lamtzidis: [5:43] And I think this is also why now the attention is turning away from, you know, crypto and like just in, you know, broad web too, because before in crypto, it was a very clear target, right? If you had something, it was a very clear money to be made at the end, right? So the economics made sense there. And in web two, it was like more difficult, right? It was not clear how you would monetize. But now that it's actually so cheap, you don't need to answer that question. You just do it and you'll figure it out at the end. David Hoffman: [6:15] Well, you guys aren't really reassuring me in any particular way. This kind of sounds bad. Maybe we can start trying to talk about the scope of the actual harm being caused here. Because it's a little bit confounded. There are a ton of vulnerabilities being found and disclosed. That's not inherently bad. There are some exploits actually happening. That's bad. But they're not exploits like crypto, where if a crypto exploit happens, people lose money. So that's also not necessarily what's happening. It's kind of muddy as to what's going on. How do we understand or measure the actual harm that's happening right now? Hari Mulackal: [6:56] I mean, at the end of the day, like, what is the value of data? What is the value of reputation? What is the value of money? And all of them are getting targeted today. So if you have valuable data in an application you're using, like maybe your dentist. Maybe your dentist has information about you that you don't want to be on the internet. Or maybe the dentist doesn't want to leak their customer data because it's liability. So what's happening is it has become so cheap to hack these companies that people would just do it. And the way to make money is often by threatening these companies. Hey, I will breach your database if you don't pay me XYZ money. And that has become a scalable cybercrime motion today. so in the past uh. Hari Mulackal: [7:43] You have to think about cybercrime as a business. These criminals need to make money, and these criminals need to make money. You need to have scalable unit economics. In the past, while crypto was a big target because the money at the end was very high, North Korea funded their nuclear missile program with crypto hacks because there was a lot of money to be made. But if you hack a dentist, there's not much money to be made, and the resources that you need to hack a doctor or a healthcare company was, so high that the ROI wasn't there. And the highest ROI in the past was phishing. So you find a way to get past your email filter, your, message filter, and you just blast millions of emails, millions of messages, and out of the million people, maybe 1,000 will click at it. And maybe out of the 1,000, like 100 of them would give you data that is now worth threatening them. Now, the same threat actors are now shifting to hacking or they are using zero days. They find zero days that are out there that are not getting fixed by companies to just scalably hack. And now they have data. And with that data, they can chat on the companies. I will breach this if you don't pay me XYZ money. We've seen that across the board that is going to keep increasing. So there is economic value to it. Hari Mulackal: [9:03] And even at a bigger political level, Just think about if the database of JP Morgan is getting leaked. I'm not saying it will. Just think about it at a political level. That is going to be a political catastrophe. If some of the largest banks in the world have their records leaked, you can think about the second and third order effects. That would change the politics of that country because that is exposing people's finances. And there is true economic damage to these incidents. Odysseas Lamtzidis: [9:42] Yeah. And I think a very easy to grog example is how leaking databases like that of, you know, Ledger back, I think, in 2021 or other databases were actually linked to, you know, the rent attacks, right? where you identify who are the high net worth individuals and then you go after them personally. And I think that's part of why it's hard to quantify because the second and third order effects is not always obvious, the connection. But they found this data and then they connected with other data and then they were able to perform a personal attack to actually trade millions, either in crypto or some other valuables. David Hoffman: [10:25] So the main thing I'm hearing from you guys is that data is going to be exposed. And honestly, if you asked me about, if you asked me before all of this, if you asked if my personal data was out and available on the internet, I would probably say, yeah, it probably is, like statistically speaking. So I'm not, me as an individual, I don't know if I'm more worried about even more of my personal data being on the internet because it was already like that. I take the point that like, JP Morgan doesn't want its data out there and it's a company that it needs to protect. So its concern is to protect its data. And most companies' concerns are about its data. But me personally, the individual, I care less. Does that resonate with you guys? How would you respond to that, Hari? Hari Mulackal: [11:09] I mean, that's a great question. I've heard this objection from other people. I do think there are multiple things happening at the same time that this time it's truly different. Hari Mulackal: [11:22] We build an AI product. We build an AI security product. And one of our AI engineers, he did this demo to somebody in the office, which is he asked his JGPT, tell me everything it knows about him, this person's JGPT. And then it listed out information about his compensation, and who their romantic partners are, a lot of deeply personal information about this individual that when he read that, he was like shocked how much his AI agent knew about him. So I think this is like truly different where people are giving up a lot of data to the new products and agents will then use all this data together to, do malicious things for you. Like, you know, if an agent had access to David all of your data, like, it can now do things that it couldn't do in the past. You know, in the past, somebody still had to, like, look at all this leaked data, understand, like, how can they, like, you know, do something to David with that data, and that was too expensive. Now it's, like, prompts, like, hey, here's David's data. I want you to write this precise email that will make him, you know, do something that, you know, he otherwise wouldn't do. And you can now scale that to millions of people. Odysseas Lamtzidis: [12:46] Yeah, like I think, yeah, like a very, I think we've seen recently is the elder scams, right? When they call elder people and they say that, you know, your son or a relative is like in police custody or, you know, they owe money in the taxes or whatever. And then they convince them to give them money. That's something we're seeing, right? So now imagine that they can do that in a way that is 100% believable because they have all this information about you. And they can convince millions of people, billions of people who are not aware of what AI is capable, so they're more gullible. And they can convince them to, you know, exfiltrate money from them, right? At a scale that is industrial for the first time. David Hoffman: [13:34] So it sounds like the default scenario moving forward is that everyone's records, individual records, my health records, I don't even know where my health records are or who has them, but they're going to be exploited and made accessible to the internet. And that's kind of the default for just data broadly. It sounds like the default path, the assumption that in a short order here, most data will be made exploitable, vulnerable, and accessible by open-weight models because the internet has been built on sticks and duct tape and now we have AI breaking all those things down and so data is now just free on the internet. Is that kind of the default future that we have? Hari Mulackal: [14:18] That is the worst case. Like that's what we're going to prevent. Like, look, I don't want that to happen. I want your data to be only with the people that you want to have access to. David Hoffman: [14:31] Okay, so we're not there yet. So the Armageddon on the internet has not created that environment. That is the trajectory that we are going towards if we do nothing. Hari Mulackal: [14:38] Correct. David Hoffman: [14:40] Okay. Okay. Yeah. Okay. How much time do we have before that happens? Hari Mulackal: [14:46] Yeah. So there is this, you know, fun way to think about the time. It's often called like zero day clock. So how long do you have until you need to fix zero days in your environments? And in the past, it would be like months, years. So you had time to fix these issues. These days, a zero day clock is negative days. David Hoffman: [15:10] So that's what it's done. The clock has hit zero and you are on borrowed time in this present moment. Hari Mulackal: [15:15] Correct. So if you are a company that has customer data, you know, repetition worth protecting, money worth protecting, you need to act today. You need to have acted like six months ago, but the best time to act is today. So you are living on borrowed time. Otherwise, like it's almost irresponsible. Like you have a duty to your customers to protect that data. Odysseas Lamtzidis: [15:46] Yeah, there was a tweet from Nikita Beer that I like that says that even your company, your engineers are mentioned as IT department. You don't have to worry about, you know, security incidents because they have already happened. David Hoffman: [16:04] I'm looking at a chart here from a 0x Osprey. Can you guys just kind of walk me through what we're looking here on this chart and why it's significant today? Hari Mulackal: [16:13] So this is a great chart to showcase like what we're dealing with. So if you have a software, there is a way to disclose to the public that there is a vulnerability in the system. So anyone using the software or as a dependency, they can fix it. So these are called CVEs. So like vulnerabilities in your system that people are disclosing. And oftentimes the next step is, oh, upgrade your packages because, you know, we have the CVE in the system in this version. And this is a chart of like the cumulative number well the cves that are getting published like i think. Hari Mulackal: [23:24] Correct and now the economics have changed and you know you know welcome to the 2020 crypto where you see like a big incident every week uh that is, that is a new reality for um the real world and you know in some way like no you have moved through this in a different era. David Hoffman: [23:43] My spinal reflex is to like look at crypto and be like, yeah, this is bullish because this is the environment that crypto was born in. Like this is, we are home here. Like you guys, you know, non-crypto securities, like you are in the room with us now and we were raised in the darkness, you know, something to that effect. I don't know if that actually means like crypto prices go up, but it does make me feel some sort of comfort that like blockchain systems were born in adversarial environments and now the world is an adversarial environment. Is there a more bullish take than that or is that about as bullish as it gets? Hari Mulackal: [24:23] I think you hit an interesting point where and i always tell people like you know like you know we're a security company and our job in the past was to secure money and securing money is the hottest thing in the world it's like uh, with the maybe the sole exception of like government to government cyber which is a you know all different industry and if you are in the if you are in this like circle of like protecting money like, this is like easy uh and yeah so it's now a lot of the job is a scale so how do you make sure that every single company on the internet can have the same level of, like protection that some of the largest like crypto companies have um that that's like one way to think about it but also the large companies in crypto they also need to invest Nobody's, only the paranoid survive and like you need to invest in cyber today across the board. But I do think there is a, like philosophically and, from an operation perspective, like there is a better advantage to companies that were built in this like really offensive environment that has become commonplace. David Hoffman: [25:36] So that was going to be one of the questions I have is like, what about my crypto that I have stored in Coinbase. Like, is Coinbase vulnerable here? And I guess interpreting your answer is like, well, they are vulnerable in the sense that, like, the cost to attack has gone down. That's true for Coinbase. Like, the economics of that doesn't change. But the Coinbase incentive to defend has been way higher for a lot longer. And so, yes, Coinbase should be concerned, but their starting point is fundamentally different. And so my money in Coinbase is probably not any weaker today than it was a week ago or a month ago. But also, nonetheless, it is still up to Coinbase to be very on the ball with advances in security practices. Hari Mulackal: [26:18] Yeah, I would lean into that. Like if you look at, let's say, Coinbase and JP Morgan or like a large financial institution, in some way, Coinbase is better prepared to defend than your bank. And people often assume that, you know, the traditional financial institutions don't have to worry about cyber risk because you can always like pull back money. That's not the case. Like, you know, you... People build payment rails and abusing the payment rails are like there's real risk at place. And if you study North Korea, before there was internet banking, they have found exploits in ATMs and they use that ATM exploits to withdraw money. Somebody gave this example where they found a way to exploit target gift cards, and then they were able to use the gift cards to get money out of the system. In some way, like the legacy companies that never had to worry about this intense cyber pressure, they are more at risk than the Coinbase. And I know the Coinbase team pretty well. They are preparing. They need to keep investing in cyber. But your money is safer in Coinbase than, you know, target gift cards as of now. David Hoffman: [27:44] I hope that was always true. Is there like a silver lining in the fullness of time here? Because we've known that in like modern day software that's built by humans that runs on the Internet, it has been full of holes forever. Like the Internet is built with sticks and duct tape and like paper mache because humans wrote it. And as Odysseus mentioned earlier, humans are lazy. And so therefore the Internet has been built in a lazy way. And we've only really needed to secure it on an as needed basis. And that's not the environment that we are in anymore. So like, say we get through this period, call it, I don't know, 18 months, I think, Haru, you said 18 months of turbulence in terms of internet cybersecurity. But then on the end of it, doesn't that mean we have like completely secure software for the first time ever? And if once we get to that point, what do we get? Is there like silver lining there? Or is it just like, oh, we just know we just get to be back in a normal environment and we get to proceed forward? I don't know, is there some sort of silver lining in the fullness of time here? Hari Mulackal: [28:49] Or this is our Letico 5? Odysseas Lamtzidis: [28:54] Intuitively, I would say probably yes. So, you know, probably we will, you know, it will not be better, but it will be back to normal, I guess. So right now it's, you know, right now it's a full-on, you know, scale invasion. And after the bloodbath, it's going to be back to regular, you know, hand-to-hand combat between attackers and defenders on more or less equal grounds. Okay. But there's going to be first the bloodbath. Hari Mulackal: [29:22] Yeah. I think for me, I have two conflicted opinions. One, agents doing cyber will make software better, period. After 18 months, the software we will be building would be way safer than anything in the past. But people need to think about this new, like the next attacker is an agent, and they are not going away. Like it's like this alien species that's now going to live among us. So I don't think people have really taught enough about like what does it mean. Like do you want to live in a world where one mistake and you're done? Because there's always like this persistent pressure on you. I don't think the world was built that way. Like the world is always built for, hey, people are safe. Like most people are not criminals. But now, highly scalable agents that can attack you at any point if you make one mistake, that's a very different world that we will be living in. David Hoffman: [30:28] All right, guys, I feel sufficiently informed. Do you guys have any just like general advice for just individuals like me or listeners of this podcast who own crypto assets or whatever, just have data or individuals who live in the modern era? What behaviors or activities are you guys doing as a result of this? Anything that the individual should know and learn from? Hari Mulackal: [30:53] So broadly speaking, This applies to crypto and non-crypto. Think about all the products that you're using today. Reach out to them. Ask them, like, hey, what are you doing to protect my data, my money, my reputation? And if you don't like the answer, then you should think about, like, moving your data money out of the system. It is almost irresponsible for companies to not take actions to protect their customers today and you need to look out for it. It's also now your responsibility to make sure that your data, your money is living in products that are responsible. So that is the number one thing I would say. Do like a personal audit of what are the products you're using, what are the services you're using, where's your data, where's your money, potential reach out to them, look at their public work that they're doing. If their security program is the same as before, leave. If they haven't changed, it's coming for them, unfortunately. That's what I would recommend as every consumer. Look at everything where you put your money in. Odysseas Lamtzidis: [32:15] For me, it's all about redundancies and blaster radius. So you assume you are going to be exposed to an incident, like with Railway, for example. So assume that the services you're using are exposed and are going to be infiltrated and then have a lot of redundancies such that a lot of organizations have to fail at the same time in order for you to lose money, right? So to give an example, if you have self-custody, for example, maybe you want to use a ledger, but also use an iPhone. So you have like two supply chain attacks that need to happen. And also the safe transaction supply chain has to be infiltrated. And also, you know, maybe add some other measure, right? So it's like building these defenses and assume that any service you're using will probably be infiltrated. And if it does, then how exposed are you going to be? David Hoffman: [33:15] That does feel a little bit daunting because I just think about like, okay, I have assets here, I have assets there, I have assets there. That's a lot of things for me to like vet, to kick the tires of. And I'm not technical. I'm not technical. How do I do this? Yeah. Odysseas Lamtzidis: [33:37] Um, I'm not sure there is a good answer for that. David Hoffman: [33:41] Yeah. Odysseas Lamtzidis: [33:42] Uh, probably, um, yeah, in terms of like self-casted assets, I think if you have, I think the best setup is if you, yeah, you use like probably something like an iPhone with biometrics to, uh, secure the, the keys. And then if you have multiple of these, um, then, you know, if there is a supply chain attack on Apple, there's a lot more to be worried about than your assets. Hari Mulackal: [34:12] One pragmatic tip I can give in that context is we have disclosed a lot of security issues on the internet. Many crypto companies do. And based on some of the incidents we have seen, maybe don't click on links that, you feel are a bit sketchy, that is like the common way to escalate. So careful clicking links. That should like, especially with self-custodied, you need to have a trigger. You need to like take an action. It's very rare that without any trigger, well, it's possible, but it's very, very much more difficult. So if you're using a wallet somewhere, like you need to drive an action there. So try to minimize that and more importantly like reach out to these companies tell them like hey what are you doing, like at the end of the day like they are respond they have a responsibility to like if every if every individual is responsible for securing the software that they're using like, that's that's not how it works you know like that yeah most people are not technical and we need to build products for everyone in the world and make sure that that is secure so, So the responsibility lies in the builders. Hari Mulackal: [35:35] And yeah, maybe for the foreseeable future, like, you know, stop clicking on a random lane shot. Odysseas Lamtzidis: [35:42] And maybe for the foreseeable future, consider not self-custodied. Actually, maybe it's worth breaking up your assets into multiple exchanges where not only you delegate the security to a professional team, but also they have cyber insurance. So you know that if anything happens, they have some kind of liability. Although I think we're going to see a lot of cyber insurance careers failing over the next few months. There was a very interesting data point where in 2024, Lloyd's, which is the biggest car in the world, said that LLMs will create more cyber risk. And, you know, the premiums of cyber insurance actually have been falling consistently since 2024. So I think actually we'll see a lot of these carriers failing. Odysseas Lamtzidis: [36:36] So that's even you know a silver bullet but probably not self-custarding for the next 12 months seems a good idea David Hoffman: [36:49] It would be good I think in that case to just have productive proactive conversations proactive statements from anyone who is a custodian so like Coinbase being the big one for me personally Infinex for example is a wallet that I use But anyone who holds customer assets, I would like to see them make a tweet saying, hey, the internet's scary, but we are on it. And there's somebody whose responsibility it is at these companies to think about these things and to protect user assets. I think that would be a very refreshing thing to see from some of our biggest crypto companies and custodians in this space. Odysseus, Hari, thank you. I feel much more informed about this. So thanks to you for coming on this live stream and just informing me and the Bankless audience about exactly what's going on here today. Odysseas Lamtzidis: [37:38] And you so much. Hari Mulackal: [37:39] Yeah, thanks. Bye-bye. David Hoffman: [37:41] Hari, Odysseus, before I let you guys go, you guys are both have security startups. Who are your best clients? And if people are just like looking for extra help, what kind of clients do you guys work with the most? Hari, I'll start with you, and Odysseus, I'll go after you. Hari Mulackal: [37:56] Yeah, so we work with some of the largest crypto companies. My business is a customer, like Robinhood Crypto and Mastercard. They're all our customers. But increasingly, because now the tools to secure companies are the same, they're agents, they're agents that you built and models that you built, it has become very similar. So we now work with healthcare companies. We are securing some healthcare technology companies and their patient healthcare data. We're securing some AI companies that are now increasingly pulling in a lot of data. Remember the Chachibit example. So, yeah, reach out to us. Like, we send disclosures to many companies. We have this factory that can, you know, as I mentioned, like, can churn out exploits. The best way to defend is to attack yourself and fix everything that it finds. We're very happy to support companies for free. Like, it's very cheap for us to send you disclosures. So, reach out to us. Reach out to me on Twitter. We'll send out more disclosures. and if you're a larger company that feels like stress, like we have resources that can help you in this terrible aneurysm. David Hoffman: [39:11] Odysseus, who do you work with? Odysseas Lamtzidis: [39:13] Yeah, so we work with, right now we work with the Lean Ecosystem, so we're protecting the ecosystem there, the L2 from ConsenSys. So you have a protocol there that would love to help you set up. And we're about to launch a new network, so follow us on socials and you'll see where we make our technology available. And yeah, it's interesting seeing how redundancies are starting to pop up and customers are very interested in having this completely orthogonal circuit breaker from a different organization, different code base protecting their assets such that two systems have to fail at the same time. David Hoffman: [39:54] Odysseus, Harry, thanks for coming on. It's nice to know that crypto has been kind of on the ball on some of this stuff just by necessity and now it's the rest of the world's turn. I do feel a little bit more prepared having talked to you guys and also being in the crypto space. So thanks for coming on and educating me and everyone else. Bankless nation you guys know the deal crypto is risky you can lose what you put in this is a frontier it's not for everyone but we're glad you're with us on the bank's journey thanks a lot --- *This article is brought to you by [NEAR](https://www.bankless.com/sponsor/near-1785257427?ref=podcast/black-october-ai-is-turning-the-internet-into-a-dark-forest)*