Source time Edition date
IndustryInterconnects
Was I wrong about open models & cyber risks?
我对开放模型与网络风险的判断错了吗？
Weigh whether the "Black October" framing overstates how fast AI-enabled cyber risk is arriving, especially since the PHP2Shell and GitLab flaws may be ordinary vulnerabilities recast in a new light.
Judgment
Nathan Lambert’s decision is whether to revise his “Black October” claim: he can keep the cyber-risk warning but must concede that PHP2Shell and the GitLab bug alone do not prove a step change, since harm needs multiple stages to align.
Basis
Lambert coined “Black October” after PHP2Shell and a long-standing GitLab bug, then cites Rob Wiblin’s April 10, 2026 “actual disaster” line, Anthropic’s April 7 Project Glasswing warning of “severe” fallout, and Zvi Mowshowitz’s April 9 “chaos” claim. He contrasts that language with GLM-5.3: over a month after release, public evidence shows no mass societal destabilization. His mechanism is multi-stage: Epoch AI used GLM-5.3 to build a website that, when visited by a Firefox user without further interaction, could exfiltrate files; finding an exploit is one step, and a hacker still must plant the site. He also notes cyber first responders are strained, which he reads as the system working, not collapsing.
- Craft websitelure
- Firefox user visitsno interaction
- Exfiltrate files
Unclear The source does not quantify how many PHP2Shell or GitLab exploits were actually used in attacks, nor give a baseline for “ordinary” vulnerability disclosure rates.
Next Check whether Epoch AI or another lab publishes a follow-up showing the Firefox exploit chain was reproduced outside its controlled website test.