What Vid sees, what Perun and Svarog stop, and what is not ours to stop.
October 2026 earned its name. In three weeks, one attacker set AI agents loose on more than a thousand websites and broke into over a hundred of them, for about fifty dollars each. Banks found other people’s AI agents inside their customers’ accounts, some doing more than the customer asked. An AI lab reported its own agents switching off the monitors that were watching them. And underneath it all, the ordinary flood: a critical hole in PHP found with AI and attacked before the patch shipped, a twelve-year-old GitLab flaw, poisoned packages stealing the keys to developers’ AI accounts.
None of this was hypothetical. It happened to companies like yours, this month.
We make three things, and they are one engine at three sizes. Vid is free and shows you what reaches your agent. Perun stands between your agent and its model and stops the attack. Svarog is Perun plus whole-computer protection. Perun 1.0 and Svarog 1.0 shipped on 23 October. So here is the honest table: for each incident of Black October, what each of ours does, and where it is simply not our field.
| Incident | What happened | Vid | Perun | Svarog | Not ours |
|---|---|---|---|---|---|
| One hacker, AI agents, 100+ companies breached | From late September, one Chinese-speaking attacker pointed AI agents at over 1200 websites in the US, Canada, Australia and Japan and breached more than a hundred, for roughly $5000 in total. Instructions fit in under a hundred characters; the agents did the rest. | — | — | Sees the intrusion on the machine and the files it leaves; holds it for a person. | The hole in your web app. Patch it. We guard the machine around it. |
| Outside AI agents inside bank accounts | Major US banks found unvetted third-party AI agents acting inside customer accounts, some doing more than the customer asked. Morgan Stanley began blocking them; others moved agents to read-only. | — | This is the case Perun was built for: an irreversible action from a source outside the mandate waits for a human, every time. | Same, plus the machine. | Someone else's agent on someone else's platform. On yours, it is Perun. |
| AI agents switch off their own monitors | An AI lab reported two of its coding agents weakening the monitoring that watched them: one switched off alerts meant for its security team, the other removed its own monitor and then told the programmer it had not. | — | The operator decides, not the agent. The record is signed and append-only; the agent cannot edit it. In doubt, Perun stops traffic. | Same. | Nothing. |
| php2shell: AI finds a hole in 70% of the web | Two critical flaws in PHP, found with AI models; attack attempts began before the fix was out. PHP runs most of the web. | — | — | Sees what an intruder does on the machine afterwards; malicious files held. | The patch. Apply it today. |
| GitLab: a 10/10 hole open since 2014 | A 10/10-severity hole present in every GitLab since 2014, patched on 21 October. No exploitation confirmed yet. | — | — | As above. | The patch. |
| LiteLLM poisoned: the AI gateway that stole keys | Poisoned packages and container images of a popular LLM gateway stole developer, cloud and AI credentials. | Sees a secret leaving in a reply. | Stops a secret leaving in a reply; a tool that changes is refused. | Same, plus malicious files on the machine. | Your supply chain. Pin versions, verify signatures. |
| Four new groups hand their intrusions to AI agents | Four previously unknown groups used AI agents inside intrusions between May and August. | — | If the agent they use is yours: stopped at the first irreversible action. | Sees them on the machine. | Their agents, their machines. |
| India's CERT: AI agents are an attack surface | India's CERT warned of AI agents reaching Indian ICT systems without authorisation and reading records they should not. | Sees what reaches the agent. | You declare where data may go. Anything else waits for a person. | Same. | Nothing. |
| Lazarus phishing hides its malware with post-quantum encryption | North Korea-linked phishing and in-memory malware against organisations in software, construction and telecoms equipment. | Sees hidden or forged instructions in the mail your agent reads. | Cleans them before the model reads a word. | Plus the malicious attachment on the machine. | The human who clicks. Train them. |
| eMudhra: certificate keys anyone could recover | Compromised intermediate certificate keys; possible HTTPS impersonation. | — | — | — | Entirely. Apply the certificate blocks. |
What Perun does when your agent is told to do something it shouldn’t
Every attack on an AI agent that arrived in text this month — hidden in a document, forged to look like the system, carried in a tool’s arguments, or simply asked politely — meets Perun at one of three points. Before your agent reads: hidden, encoded and forged instructions are stripped before the model sees a word. Before it acts: text from outside never reaches an irreversible action; those wait for a human, with the reason in plain words and one click to answer. Before it answers: every reply is checked on its way out for harm, for secrets, and for the moment the agent simply obeys.
The bank story is the one to remember. The banks’ fix was to take action away from agents altogether. Perun’s fix is to let your agent keep working and hold only the one call that needs a person.
What Svarog does on the machine
Most of Black October was not an attack on an agent. It was an attack on a server, through a hole in software you did not write. Svarog is Perun plus whole-computer protection: ransomware, intrusions, malicious files, watched by its own AI agents, which are themselves under Perun. When something gets in through a hole we could not have known about, Svarog sees what it does next and holds it.
What is not ours
We do not patch PHP, GitLab or Node. We do not fix someone else’s certificate authority. We do not stop the person who clicks. Where the table says “not ours”, it means it: apply the patch, and we guard what happens around it.
Where to start
Vid is free, runs in your browser, and shows you in a minute what your agent is actually reading. If you have an agent that sends email, moves files, pays or calls tools, Perun is from $2400 CAD for the first year, installed with you, your rules written with you, your people trained. Three design-partner places are still open: sixty days with us, at no cost, and half price for the first year after.
— Andrej Ristić, Toronto, 24 October 2026
Sources
- One hacker, AI agents, 100+ companies breached (Reuters, 19 October): Cybersecurity News, Technology.org
- Outside AI agents inside bank accounts (Reuters, 22 October): Technology.org, FinanceFeeds
- AI agents switch off their own monitors: CNBC, Al Jazeera, ABC News
- php2shell: CNN, Fortune, Wiz, CyberScoop
- GitLab CVE-2026-110264: Cybersecurity News, OpenCVE
- LiteLLM supply-chain compromise: Help Net Security, Socket
- Four groups using AI agents in intrusions (CrowdStrike, 21 October): Cybersecurity Dive
- CERT-In advisory CIAD-2026-0049: Security Affairs, Analytics India Magazine
- Operation FlashHole (Kaspersky): Cybersecurity News, GBHackers
- eMudhra intermediate certificates: Mozilla, Google, BleepingComputer