Trust isn’t a security model

At the end of last month, I spent a whole week doing almost nothing but patching.

On the morning of the 19th, I got into my home office as usual. Halfway through my coffee and my morning debrief, my phone started going off. Friends from college were texting me to google “latest CVEs”, right now. I thought, eh, probably one new CVE that needed patching. I added it to my docket and finished my debrief.

Then it hit me that this was no ordinary day. It started small. I patched every CVE that touched my projects and servers, and by the evening I thought I was finally done, only to find two more. I worked through the night, patching and checking what else was affected. I went to sleep thinking the worst was over, and woke up the next day to four more.

It went on like that all week, and it cost me more than a few nights of sleep. By the end, I was a zombie glued to my chair, patching whatever came in next.

Between 19 and 22 October, critical flaws landed one after another. People started calling it Black October.

• PHP: a bug that let anyone run their own code on any PHP site serving web pages. Five days later, CISA confirmed attackers were using it.
• Node.js and Next.js: urgent fixes for the JavaScript runtime and one of its most used frameworks.
• GitLab: a flaw with a perfect 10 for severity, and attackers are already going after it.
• LiteLLM, a tool that a huge number of AI apps use to talk to models: for about two hours, its official release carried malware that stole passwords and keys. That’s the second time this year.

The same month, Microsoft fixed about 1,400 vulnerabilities in a single update. That’s more than it used to fix in a whole year. Can you believe that? One update, 1,400 vulnerabilities. It makes you wonder how many more are still hiding in all those lines of code.

The warning came before any of it.

Five weeks before Black October, Dario Amodei, the CEO of Anthropic, wrote: “We must slow the pace at which we improve the capabilities of AI models.” He warned that within six to 12 months, a swarm of AI agents “could be capable of taking over the entire internet.” Sam Altman replied, “I agree with Dario that we need to pace the frontier.” Elon Musk posted, “Dario is right.”

Then October happened, and the people at the top sounded the alarm:

• Matthew Prince, the CEO of Cloudflare, said that in the 10 hours before the PHP flaw was even announced, his network saw thousands of attempts to exploit it. Then “tens of thousands in the 45 minutes post announcement, hundreds of thousands within 2 hours, and millions now.”
• Marc Benioff, the CEO of Salesforce, summed it up on X in two words: “Code red.”
• Tobi Lütke, the CEO of Shopify, called it the craziest day in cybersecurity in a long time.
• Matthew Green, a cryptographer at Johns Hopkins: “we’re in the part of the movie where you need to throw whatever you can in the path of the zombies and hope it slows them down.”

And the slowdown? On 29 October, the Washington Post ran the headline: “Anthropic and other AI firms agreed to slow down AI. It didn’t happen.”

This wasn’t just a bad month. It’s the new normal. Google’s threat team counted 5,045 new vulnerabilities in January this year. By August, it was 10,740 a month. Double, in eight months. What used to be a steady line is starting to look exponential, and that’s a bit scary.

AI is a big part of why, and it’s on every side now.

It writes the bugs. More code is generated than ever, and a lot of it ships without anyone reading it properly.

It finds the bugs. The PHP flaw had been sitting in the code for years until researchers using AI found it. Then Chainguard, another security company, found the same bugs just by asking an AI model to “find bad vulnerabilities in PHP”. AI agents hunt for flaws around the clock, and they’re good at it. Google found that half the flaws AI finds let an attacker run their own code on the machine, against about a quarter of the ones found other ways.

And it helps people exploit them. One flaw found by an AI agent was being exploited four days after it went public. Google suspects attackers are using AI to turn known bugs into working attacks faster. Last November, Anthropic reported a state-backed group that used Claude to run most of a hacking campaign with very little human help.

Defenders and attackers now have the same tools. The difference is that attackers only need one door left open.

Look back at the Black October list. Every item on it is something developers trust without checking: a language, a framework, a server, a package. We have to. Nobody can read every line they run.

As an Indian, I keep coming back to one story from that week.

eMudhra is one of India’s biggest digital certificate companies. Its job is to vouch that a website is who it says it is. On 17 October it came out that eight of its certificate keys, which should have been impossible to guess, had only a few hundred possible values. A researcher simply worked them out. Chrome, Firefox and Apple stopped trusting them, and Chrome dropped the root they hung from, with about 30,800 live certificates under it. (Its Indian digital signature services weren’t affected.)

The most ridiculous detail? One of those keys was just the number 4. How are we supposed to comprehend that? A big, trusted certificate company, and one of its keys was a number a child could guess. Five days later, eMudhra quit the global certificate business altogether.

The company whose whole business is trust got the most basic part of it wrong.

The same week, SBI, India’s largest bank, confirmed that personal details from nearly 4,000 customer records had turned up on the dark web.

And it isn’t only the big names. India runs on small businesses, and small businesses run on freelancers and agencies they hire because they trust their technical know-how. More and more of what gets delivered is vibe-coded: generated in an afternoon, shipped the same evening, never really checked. One security firm found 5,000 apps built on vibe-coding platforms with virtually no security or login of any kind, many of them leaking medical and financial details, company documents and private chatbot chats.

The business owner doesn’t know any of this. They trusted the developer. The default password, the open database, the forgotten admin page just sit there, a back door nobody knew existed, until someone else finds it. And with AI doing the searching, that someone never sleeps.

Now we’re being asked to trust the cloud with our hardware too.

AI has been eating the world’s memory supply. Memory makers moved production to the special memory AI servers use, so regular RAM got scarce. A 32 GB DDR5 kit that cost about ₹9,500 in mid-2025 sells for around ₹38,000 now, and contract prices are still climbing this quarter. Micron even stopped selling Crucial RAM to consumers.

OpenAI is one of the biggest reasons. Its supply deals were reported to cover as much as 40% of the world’s DRAM output.

Then, in a podcast released on 29 October, Sam Altman said it’s “quite terrible to have everybody have a bunch of the world’s limited supply of DRAM sitting in their own computer and being used 5% of the time.”

So the man whose company helped make RAM this expensive now tells us that the RAM we paid those prices for is a waste, and would be better off in his cloud.

A computer isn’t a server farm. Free memory is headroom. It’s why your machine feels fast, and your operating system already fills it with cache. Run it at 100% and the system starts swapping to the SSD, slows to a crawl, and apps start crashing.

And the RAM in my laptop is what lets me run models locally, offline, without sending my code and data to someone else’s server. After everything above, handing even more of our work to machines we can’t see into is the last thing we should do. That isn’t waste. That’s ownership.

Put it all together and this is what the next few years look like for developers:

• more to patch, every week,
• less time between a bug going public and someone using it,
• pricier machines to do the work on,
• and the hardest hit are the small teams and freelancers with no security team behind them.

So what do we do?

• Know what you run: every dependency, every version, every server.
• Pin your versions. Don’t let a fresh release install itself overnight.
• Patch in days, not months.
• Point AI at your own code before someone else does.
• Treat AI-written code like code from a stranger: read it, test it, then trust it.
• If you’re the one hiring: ask who checks the code, where the passwords and keys live, and who patches it after launch.

I’m still not anti-AI. I use it every day. But the speed it gives us cuts both ways.

In my last post I wrote that good intentions don’t cancel out bad implementation.

Neither does trust.