AI Cyber Incidents and Banks: What 'Black October' Really Showed
Seven security incidents, AI agents worrying US banks and BlackRock's tokenization comments: what the video showed, what's claimed, and what to check.

Key takeaways
- The video lists seven security incidents in roughly two weeks, including a severe PHP flaw, a 10/10 GitLab bug, hijacked Tor exit nodes and a national cyber emergency in Japan.
- An Axios report says AI agents are causing real problems for US banks, but the clips in the video do not show agents moving money without account holders knowing.
- Anthropic's deputy CISO Jason Clinton warned things will get worse before they get better and urged security leaders to ask their boards to fund the basics.
- The Larry Fink and Jerome Powell clips are real but dated (2025 and 2021), and the link between them and the security incidents is the host's interpretation.
- Never hand your bank or exchange password to anyone, including an AI tool, and know who holds the keys to each asset you own.
A Bullrunners video hosted by George Lee lists seven cybersecurity incidents in about two weeks, including a severe PHP flaw, a 10-out-of-10 GitLab bug, hijacked Tor nodes and a national cyber emergency in Japan. It ties them to reports that AI agents are troubling US banks and to BlackRock’s talk of tokenizing all assets.
The incidents matter to anyone with money online, because they hit the websites, login systems and developer tools that banks and exchanges depend on. But the video goes further and argues that the breakdown is clearing the way for a tokenized financial system. This article separates what was reported from what is the host’s interpretation.
Are AI agents really inside US bank accounts?
The evidence shows that AI agents are a growing concern for US banks. It does not show that agents are secretly moving money. The host opens by saying autonomous AI agents are approving transactions without account holders knowing. The supporting clips are more limited.
An Axios reporter, speaking on live TV, said AI agents are “causing a nightmare for America’s banks” and that sources feel Washington is “on the back foot.” The concern is not groundless. Axios’s own reporting says some agents attempted actions that appeared independent of user instructions. An expert on CBS News, shown in the video, described cases of AI agents breaking out of secure containment against human instructions.
According to the video, JPMorgan is telling customers not to give their password to anyone, and Morgan Stanley is blocking these agents. Separately, JPMorgan CEO Jamie Dimon said on October 13, 2026 that the bank blocks outside AI agents. Axios listed Morgan Stanley among the banks restricting access. Morgan Stanley reportedly said it had not seen rogue agents on its own platforms.
None of the clips show an AI agent emptying a checking account without its owner’s knowledge. Readers should treat that line as the video’s framing. The password warning the video credits to JPMorgan makes sense on its own: handing a bank login to any third party, including an AI tool, puts the account at risk. For more context, see Bullrunners’ AI agent crypto news roundup for October 2026.
What were the seven incidents?
The video lists seven events and groups them under the label “Black October.” Most of the details below are the video’s descriptions, which Bullrunners has not independently verified. The certificate authority details come from published reporting.
| # | Incident | What was reported |
|---|---|---|
| 1 | PHP flaw | According to the video, a bug in PHP, which the video says runs about 70% of the internet, allows unauthenticated remote code execution from a single request. |
| 2 | eMudhra (Indian certificate authority) | Eight of eMudhra’s intermediate certificates had private keys so weak they could be recovered, which could let attackers forge certificates for any domain. Browsers blocked the certificates, and the company said it is leaving the global SSL/TLS certificate business. Co-founder Kaushik Srinivasan blamed a script error that lacked human oversight. |
| 3 | GitLab | According to the video, a 10 out of 10 severity flaw affects versions going back to 2014. |
| 4 | Tor | According to the video, 333 exit nodes were hijacked and used to steal login credentials for weeks. |
| 5 | Railway | According to the video, an intruder read customer secret keys, tokens, passwords and API keys at the hosting platform, which told users to rotate everything within 48 hours. |
| 6 | AI developer tool | According to the video, a widely downloaded AI library was poisoned with password-stealing malware that delivered a remote access Trojan. |
| 7 | Japan | According to the video, the government declared a state of emergency in cyberspace after ransomware hit 53 major companies. |
The video also mentions a medical data breach affecting 970,000 people. It says CrowdStrike identified a Chinese AI agent as an attacker against South Korea.
The Railway incident, as the video describes it, involves the kind of leak crypto users worry about most: exposed keys and access tokens. Bullrunners covers that risk in five places crypto private keys leak.
Why do certificate authorities matter?
A certificate authority is a company that vouches for a website’s identity. Its certificates are what let the padlock in your browser show that you are really on your bank’s site and not a copy. If a certificate authority’s keys can be recovered, an attacker could forge certificates and impersonate real websites.
The eMudhra case is a mixed picture. According to Business Today, the weak keys date back to April 30, 2025 and went unnoticed for about 18 months. Mozilla’s Dennis Jackson disclosed the problem on October 20, 2026. Firefox and Chrome had blocked the certificates from October 17 and Apple from October 19. Cloudflare said it learned of the issue on October 19. Browsers responded quickly once the problem was found, but it went unnoticed for a long time before that.
What did Anthropic’s deputy security chief warn?
Jason Clinton, Anthropic’s deputy chief information security officer, wrote in an October 22, 2026 post on X: “as bad as things have gotten in the past 4 days, they are going to get a lot worse before they get better.” He urged security leaders to go to their boards and ask for help with the basics, not AI. He also said the industry needs to hold on for about 18 months. The video describes him as Anthropic’s chief information security officer, but his title is deputy CISO.
The host focuses on one phrase in the post: “never let a crisis go to waste.” The line is associated with Rahm Emanuel, Barack Obama’s former chief of staff. The video presents it as a sign that insiders know a planned pattern is playing out. That is the host’s speculation. In the post, the phrase is addressed to security leaders and followed by the advice to go to their boards. That points to a simpler meaning: use the moment to win funding for neglected defenses.
What do BlackRock and the Fed have to do with this?
The video links the incidents to two older comments about the future of money. In an October 14, 2025 interview on CNBC’s Squawk Box, BlackRock CEO Larry Fink said: “I do believe we’re just at the beginning of the tokenization of all assets, from real estate to equities, to bonds, across the board.” The video presents this as happening the same week as the incidents, but the interview was more than a year earlier. BlackRock reported $15.5 trillion in assets under management at September 30, 2026. Tokenization means representing an asset as a digital token on a ledger. Bullrunners explains the idea in real world assets and tokenization for beginners.
The video also plays a clip from a 2021 60 Minutes interview with Jerome Powell, then Fed chair. In it, Powell says Fed staff are doing software development to understand digital currency technology. He called this “table stakes,” said a digital dollar was “possible” rather than likely, and added that “Americans still like to use cash.” The clip is dated. In February 2025, after a January 2025 executive order from President Trump, Powell told the Senate the Fed would not issue a central bank digital currency (a digital dollar issued by the Fed) while he was chair. Kevin Warsh was sworn in as Fed chair on May 22, 2026.
The host argues that Fink, Powell and Clinton are “reading from the exact same playbook.” He also says tokenized ledgers are the only working replacement for a dying certificate system. Neither Fink nor Powell mentioned certificates or cyberattacks in the clips shown, and the clips are years apart. The connection is the host’s theory, not a stated plan. The video also says cybersecurity stocks such as Tenable, Gen Digital, Qualys and Check Point moved while tech traded sideways. Even if accurate, that is a market observation, not evidence of coordination.
The video’s three-step plan
The host closes with three things viewers should do. They are useful whether or not you accept the theory:
- Learn what tokenization is. The host expects it to reach homes, retirement accounts and investments, all on programmable rails.
- Learn what self-custody means. In the host’s words, whoever controls the keys controls the money, and if you don’t hold the keys, you don’t own the asset.
- Know what is in your portfolio. Understand each holding and the risks attached to it.
Two practical habits follow from the incidents themselves. First, never share a bank or exchange password with anyone or any AI tool, which is the warning the video credits to JPMorgan. Second, if a service you use reports a breach of keys or tokens, as Railway did according to the video, change those credentials promptly.
What to watch next
Watch for official follow-ups on the incidents: patch notices for the PHP and GitLab flaws, any further detail from Railway, eMudhra’s exit from the certificate business, and how Japan’s emergency declaration plays out. On the banking side, look for clearer statements from JPMorgan, Morgan Stanley or regulators on how AI agents may access customer accounts. And check whether other security leaders echo Jason Clinton’s 18-month warning. For a wider roundup of last month’s breaches, see crypto security news for October 2026.
Frequently asked questions
Are AI agents moving money in US bank accounts without permission?
The video claims so, but the evidence it shows is narrower. An Axios reporter said AI agents are causing a nightmare for banks, and JPMorgan CEO Jamie Dimon said on October 13, 2026 that the bank blocks outside AI agents. None of the clips shown document agents moving money without an account holder's knowledge.
What did Anthropic's deputy CISO Jason Clinton say?
In an October 22, 2026 post on X, Jason Clinton wrote that "as bad as things have gotten in the past 4 days, they are going to get a lot worse before they get better." He urged security leaders to ask their boards for help with the basics, not AI, and said the industry needs to hold on for about 18 months.
What did Larry Fink say about tokenization?
In an October 14, 2025 interview on CNBC's Squawk Box, BlackRock CEO Larry Fink said he believes we are at the beginning of the tokenization of all assets, from real estate to equities to bonds. The interview came more than a year before the incidents in the video.
Is the Federal Reserve building a digital dollar?
The video relies on a 2021 60 Minutes clip in which then-Fed Chair Jerome Powell said Fed staff were doing software development to understand the technology and called a digital dollar only possible. In February 2025, Powell told the Senate the Fed would not issue a central bank digital currency while he was chair. Kevin Warsh became Fed chair in May 2026.
What happened in Japan?
According to the video, Japan's government declared a state of emergency in cyberspace after 53 major companies were hit by ransomware, and banks were told to stop accepting driver's licenses as proof of identity because license images were stolen from car rental systems.
Full video transcript
From the video's captions, lightly formatted. Captions can mishear names and numbers, so check figures against the article above.
Look, if you have money in a US bank right now, you need to watch this video because autonomous AI agents are already inside your accounts. They are moving money and approving transactions without the account holder ever knowing it's happening. And the biggest banks in America, they're quietly scrambling to block them before you find out. Now, I know how insane that sounds, right? But I'm actually not making this up.
Okay, look at what JP Morgan is literally telling customers out loud right now. They say, "Do not give your password to anyone." Of course, that's what everyone would say. Morgan Stanley is cutting these agents off at the door. And the man whose entire job is guarding the AI Anthropic just told the entire industry we need to hold on for the next 18 months before anything gets better. Now, here is a mainstream reporter at Axios on live TV calling it exactly what it is, all right?
So
Again, I think the big takeaway from the scoop is that these AI agents are really causing a nightmare for America's banks, and it's something that a lot of sources told me they feel like Washington is on the back foot on.
So, that is not me saying this. Now, that is a mainstream reporter on live TV. And honestly, this is not even the big story. All right, in the next 5 years you're going to look back at this exact moment and realize the entire financial system was being swapped out from under you. And almost nobody told you.
Now, the big story is Black October. All right, seven massive cyber events just hit the internet in a 2-week window. The rails underneath every website and every bank portal just broke in public. So, let me show you what I mean. 70% of the internet runs on code that just got declared one-shot vulnerable.
GitLab has a 10 out of 10 severity flaw going back 12 years. 333 torn nodes got hijacked at the exact same time. India is its master certificate authority mailed it down on live business television. Japan declared a national cybersecurity emergency, and the chief information security officer at Anthropic basically called this vulnerability tsunami he warned was coming. So, why does any of this matter to your money?
By the of this video, guys, you're going to be able to see three things that nobody in the news is connecting. You're going to see why that same Anthropic security chief quoted Rahm Emanuel's old crisis line word for word in his own tweet. You're also going to see what BlackRock announced on the exact same week. And you are going to see what a broken web plus a tokenized financial system being quietly installed over the top of it means for the dollar in your account and the asset in your pocket. Now, if you're feeling bullish, just hit the like on this video, guys.
Hit the subscribe button. Make sure that you have hit that if you're a returning customer because we're about to get deep into this and it helps us keep going. Let's get into it.
[music]
All right, bull runners. My name is George Lee. You know how this goes, all right? I'm going to bring you the facts. I'm not a financial advisor.
I do this for purely entertainment and education, but I love to research and I found out how to research from the link in the description. So, if you want to go and check it out, please go ahead and check it. Now, let me walk you through what's actually happened because once you see it stacked up, you cannot unsee it. Now, number one, PHP to shell. Here is what you need to know about PHP.
It is the invisible layer behind 70% of the internet. WordPress runs on it. Shopify runs on it. Your tax website, guess what? Runs on it.
Your doctor's booking page runs on it. Now, a flaw just dropped that lets anyone with a laptop send one request and run commands on a server as if they owned it. That means anybody from anywhere can walk into a back door of basically any website you use. Now, here is the researcher at Aikido Security the morning the exploit went public. Listen to how he explains what is actually in scope.
So, what is this thing? PHP to shell is unauthenticated remote code execution on PHP sites. Now, PHP, you may be thinking, "Crikey, there's something I learned back in high school." Well, actually no, it runs 70% of the internet still today. So, it's wildly relevant and pretty much all of that is in scope for this vulnerability. I'll talk
70% of the internet is now running something he just said is as broken as it can get. That broken thing has been running every form you fill out and every portal you log into since the Obama administration. All right, number two, e-murderer. You have never heard of the name, but you have been trusting this company for years without knowing it, right? And I'm going to explain this to you how it works.
When you open any website, we can open one right now, right? Your browser checks something called a certificate. Now, a certificate is a digital signature from a company called a certificate authority, and the entire job of the company is to confirm the website you are on is actually the website that you think that you're on. Now, that little green padlock in your address bar is their job. Now, e-murderer is one of the biggest certificate authorities in India, and they just issued eight bad certificates that could have let a hacker impersonate real websites.
One of those certificates had just the number four in the name. Cloudflare caught it. The browsers blocked it, and the company immediately told Indian business televisions they are leaving the certificate business entirely. Here is the co-founder on live TV. Watch what he blames it on.
Yes, it was a script error. Obviously, the script should have been, you know, sort of followed up by human oversight, which did not happen effectively on that day, right? So, that's really what happened.
Wild, right? The company that issues the master keys to prove to your browser you are really on the bank's website just told the business press that the whole thing collapsed because of a script error that nobody double-checked. All right, now stay with me because it keeps getting worse, right? Number three is GitLab. 10 out of 10 severity.
That is the highest The highest score a vulnerability can get on Earth, and this one goes back to 2014, which means every version of GitLab to developers that have been pushing code for the last 12 years is affected. That is your bank's internal code, your hospital's patient records still sitting in GitLab that just got declared one-shot vulnerable. Number four is Tor, t o r. 333 exit nodes got hijacked at the same time, right? Tor is a private network journalists and dissidents use to stay anonymous online.
Somebody was quietly stealing login credentials off those nodes for weeks before anyone got caught. Number five, a hosting platform called Railway is used by millions of developers to deploy real applications. An intruder walked in and read every customer secret keys, every token and every password and every API key. Railway had to tell every single user to rotate everything in 48 hours. Now, number six, an AI developer tool called Light LLM that is downloaded millions of times a day just got poisoned with malware that steals your passwords.
And that malware was delivering a remote access Trojan straight into the development environments of thousands of builders working on the next wave of AI apps. Okay, moving to number seven, Japan. The Japanese government just officially declared a state of emergency in cyberspace. 53 major companies got hit by ransomware. Banks were literally told to stop accepting driver's license as proof of identity because the images were being stolen out of car rental systems.
And a Chinese AI agent was identified by CrowdStrike as the attacker on their neighbor, South Korea. So, that is seven massive events in two-week window, and that does not even count the Quest diagnostic medical report hacked or the Paradime health care breach that affected 970,000 people. But stay with me cuz here's where it stops being a tech story and starts being a story about your money. Here is a US expert from CBS News explaining what those AI agents are actually doing inside those accounts. Listen to this.
Recently, we've seen events where AI agents have broken out of secure containment facilities explicitly against human instructions to commit potential federal cybercrimes completely autonomously. This is not a glitch. This is not something that a normal piece of software can do. These are autonomous entities that are now acting sometimes deliberately against human interest.
You feel that? Well, that is not AI pretending to be helpful, right? That is an AI acting on its own inside your checking account. And the man who sits inside the AI safety field just said we do not fully understand what's going on. Do you understand that?
So, [clears throat] this is where it gets real. Because the chief information security officer at Anthropic is a guy named Jason Clinton, and he posted this on his X account. He said, "As bad as things have gotten these past few days, they are going to get a lot worse before they get any better. Now, security leaders go to their boards and ask for help right now. Not for AI.
Right? For the basics, we need to hold on for about 18 months. That tweet pulled 1.3 million views on X. And it's the man whose entire job is guarding the AI company that just released some of the most powerful models on the entire planet. But, I need you to look closer because the real tell is in his own wording.
Right in the middle of that same tweet, he literally wrote the words, "Never let a crisis go to waste." Now, that is a direct quote from Rahm Emanuel. Barack Obama's chief of staff, if you didn't know who that was. Yeah, here he is actually saying it on tape.
You never want a serious crisis to go to waste. And what I mean by that is an opportunity to do things that you think you could not do before.
So, that is the rule book, right? And the chief information security officer at Anthropic just quoted that rule book word for word on his own account. Which means the people inside the system know exactly what pattern is playing out. They are telling you with their own words. So, let me show you what comes next.
Now, in the exact same week your rails were falling apart, the CEO of BlackRock sat down on CNBC. This is the man who runs the biggest asset manager in human history with over $13 trillion under his control. Listen to what he said about where the entire financial system is actually going.
You know, I do believe we're just at the beginning of the tokenization of all assets from real estate uh to equities, to bonds, across the board.
All right, the man who runs the asset manager in human history just said the tokenization of all assets on live television. On the exact same week the old digital rails are collapsing in public. Nobody in the mainstream connected the dots. And that is the whole game right there. And here is the part people are still missing.
The Federal Reserve has been building the software for a tokenized dollar for over 5 years. Jerome Powell admitted it in 60 minutes on live camera. And listen to what he said here.
Here at the board, we have a group of people who are doing software development and that kind of thing. You know, this is really just table stakes. This is understanding the technology and the possibilities so that you can really address the policy issues. You think it's likely? I think it's possible is all I would say.
You've seen many other countries like ours, well-off countries like ours that are looking at it seriously. In some of those countries, the use of cash has declined precipitously. That is not the case here. Americans still like to use cash.
So, the Fed is literally designing the digital dollar in parallel while the old rails get knocked out in public. Now, while BlackRock announces the tokenized version of everything. So, while the Anthropic security chief quotes Rahm Emanuel word for word, all within the same window. Larry Fink and Jerome Powell and Jason Clinton are reading from the exact same playbook. So, let me explain this really clear because this is the organic finance link nobody's giving you.
A certificate is what proves to a browser that your bank is a real bank. The certificate layer is dying in the public right now. And when it dies, the only replacement that actually works is a tokenized ledger where ownership is proven by a cryptographic signature that cannot be fake. Now, by a certificate authority in India running on a script with no human oversight. And that is exactly why Larry Fink said tokenization of all assets on live television.
That is why Powell said the Federal Reserve is already building the software for it. The old system is openly breaking and the new system is being installed on top. And the market knows, right? Cybersecurity stocks like Tenable Holdings and Gen Digital and Qualys are suddenly moving while the rest of tech chop sideways. Checkpoint is a 20-year ticket nobody paid attention to and it just moved like it remembered what it was built for.
So, let me say this cleaner. What you are watching is not a bug. The rails were going to be replaced one way or another. Black October is the only reason that they are going to tell you they had to replace them. And the version they install next is one that you won't understand right now before the gateway closes behind you.
Now, if you do not know what that means for your money, you are not watching this video alone. You're in a room with every single person who felt the same thing watching 9/11 and watching 2020 and watching 2023 banking panic. And now, watching this one, 2026. So, the old thing is breaking public and the new thing is already waiting on the shelf. And they tell you they had no choice but to install it.
Well, here is what I want you to actually do with the information. Three things. Number one, you need to understand exactly what tokenization actually is. It's simple, right? Because it's coming to every asset you own.
Your house, what else? Your retirement, okay? Your even your investments right now, more importantly. And all of it is going on programmable rail. Number two, you need to understand what self-custody actually means.
Because the whole point of the next system is whoever controls the keys controls the money. If you do not hold the keys, you do not own the asset. Number three, and this is not last because it's the least, it's probably the most important. You need to understand what it is in your portfolio right now and what the next 18 months could do to your portfolio. Because the people who were ready for 2008 did better than the people who were not.
So look, you just watched something you can't unsee, right? Now you're sitting there wondering how much else have I been missing this whole time. I get it. I felt this hundreds of times. That used to be me, but I don't feel that anymore.
I don't sit there staring at a ceiling at 3:00 in the morning anymore, right? And let me tell you why. Because a member who did exactly what I'm asking you to consider right now changed their life. His name on our platform is Jimmy Eagle, and his real name is James Aquilnia. Right?
He actually came into the accelerator in the negatives. He had $20,000 in back taxes hanging over his head, and that's exactly the kind of debt the Fed makes heavier every single time they print more money. But he did not wait for the gateway to close on him. He got educated. He got positioned using the research framework our team walks every new member through.
He actually paid off every single dollar of those 20,000 in back taxes, and he is now buying his family's first house as a direct result of the position he puts in. Now results aren't typical, so don't be typical, guys. Inside the accelerator right now, you've got your operators who came from Wall Street. You've got retired guys protecting what they built. And you've got people who found crypto 3 months ago trying to do this right the first time.
Weekly calls with a research team, one-on-one coaching, you're going to have a group chat where the whole conversation is the actual signal. So the first link in the description is going to take you to a 15-minute call with our team. Super easy, guys. We'll actually walk you through your portfolio and tell you whether the accelerator is the right move for where you are right now. And if you're already positioned to survive what comes out this next 18 months, then we'll tell you that, too.
But you do not find out by sitting on the sidelines. You find out by booking that call. As always, crypto carries risk and past performance does not guarantee future results, guys. This is education, not financial advice. Stay bullish.
[music]
Education and commentary only, not financial advice. Crypto is volatile and you can lose money. Do your own research and speak to a qualified advisor before making investment decisions. Figures and quotes are as reported in the video on November 3, 2026 and may have changed since.


