AI Agents Kinda Broke the Internet

On Wednesday morning, if you tried to look up a public record on the Dutch government’s main portal, check a message on Denmark’s national school network, or pull a file from the French Interior Ministry, the websites were simply gone (Wikipedia). Across Finland, every public-facing government web service had been taken dark. In San Francisco, the Internet Archive had pulled its own plug, while engineers at the Wikimedia Foundation scrambled to shut down internal developer tools before someone else could reach them first. Half a world away in Tokyo, major e-commerce storefronts and some of Japan’s largest mobile games abruptly went into emergency maintenance (Wikipedia).

They were not offline because hackers had knocked them down. They were offline because the National Security Agency, the FBI, and European cyber authorities had just issued one of the starkest warnings in the history of the modern web: a pair of newly discovered flaws in PHP, the thirty-year-old programming language that still quietly powers roughly 70 percent of all websites on earth, was so severe, and so invisible when exploited, that if you could not patch your servers immediately, your only safe option was to turn them off (Wikipedia; The Hacker News).

By Thursday afternoon, people on Reddit and X were calling the week “Black October.” It was easy to see why. The PHP emergency did not arrive alone. It landed in the middle of a ninety-six-hour pileup that looked, from the outside, as if every load-bearing wall of the digital economy had cracked at the exact same moment.

Forty-eight hours before the European government portals went dark, the world’s major web browsers, Chrome, Firefox, Safari, and Edge, had been forced to push emergency blocks against eMudhra, a publicly traded Indian company trusted to issue the cryptographic passports that prove a website is really who it claims to be (The Next Web). Eight of eMudhra’s master signing keys turned out to be so trivially weak that a security researcher cracked all of them on his laptop in less than a second; then he watched Anthropic’s Claude do the exact same thing from a single prompt (CyberScoop). One of those secret keys, supposed to be a number seventy-eight digits long, was literally the number 4 (CyberScoop).

That same week, Reuters and threat researchers at NorForge revealed that a single Chinese-speaking hacker had pointed a swarm of autonomous AI agents at more than 1,200 corporate websites, walked away, and let the machines methodically break into more than 100 companies, including John Deere, Cummins, and SharkNinja, at an average cost of about $50 in AI compute tokens per breach. Microsoft warned that a state-backed group was using another AI agent framework to go from initial reconnaissance to full control of corporate cloud networks in under three hours. And right in the middle of the chaos, the AI industry’s own supply chain ate itself: LiteLLM, the software gateway that thousands of startups use to connect their apps to OpenAI, Anthropic, and Google models, was hijacked and turned into a credential-stealing weapon after an AI coding tool accidentally leaked the company’s own master keys into a log file.

When so many alarms go off in a single week, the natural impulse is to treat the calendar date as the cause to assume that some sudden, coordinated catastrophe just hit the internet. Whenever you look closely at a supposed regime break, though, the first thing you have to check is the clock. And if you check the dates on the wreckage from this week, the “sudden October collapse” falls apart (Forkast).

The flaw that forced European governments to unplug their PHP servers had been sitting in the code since 2012, and a developer had actually spotted it during an audit back in 2024 (Wikipedia; The New Stack). The botched ceremony that set eMudhra’s secret key to the number 4 happened seventeen months ago, in April 2025 (The Next Web). The security holes that autonomous agents used to break into John Deere and a hundred other companies were ordinary, years-old corporate oversights (The Hacker News).

The internet did not suddenly become more broken in October 2026. What changed is that the truce that kept a broken internet standing finally expired.

For twenty years, global cybersecurity relied on a quiet economic reality: finding deep software bugs and stringing together complicated hacks required human time, human patience, and scarce human expertise. We lived with rickety code and sloppy configurations because exploiting them was expensive. This week, we saw what happens when AI agents drive the cost of curiosity both for defenders and for attackers down to pocket change.

To understand how fragile the internet’s trust model really is, start with the number 4.

Every time you log into your bank, buy something with a credit card, or send a private message, your device checks a digital certificate to make sure you are actually talking to the real company and not an impostor sitting on the network in between. Those certificates are issued by a small club of organizations called Certificate Authorities, or CAs (Times of India). Because browsers and operating systems inherently trust those authorities, a CA’s private key is one of the most sensitive secrets in computing. Whoever holds it can forge a passport for almost any website on earth (Scott Helme).

The math protecting those keys is supposed to be insurmountable. A modern certificate authority key is a random number roughly seventy-seven or seventy-eight digits long, yielding so many possibilities that every computer on the planet, working together since the birth of the universe, could not guess it (CyberScoop; Scott Helme).

On April 30, 2025, engineers at eMudhra, an Indian digital trust company whose certificates were trusted by Apple, Google, Microsoft, and Mozilla, as well as cross-signed by the major Western authority Sectigo, held a formal key-generation ceremony (The Next Web; Scott Helme). Something went wrong in the script they used. Alongside the real, massive keys, the hardware spat out a second set of broken keys where almost the entire number had been wiped out and replaced with zeroes, leaving only the very last byte (Forkast; The Next Web). Because the file labels looked nearly identical, the staff grabbed the wrong set and published eight of those broken authorities to the world (Scott Helme).

Instead of seventy-eight digits, every single one of those eight master keys was a whole number under 256: 4, 56, 66, 115, 155, 156, 230, and 237 (The Next Web).

Why did it take seventeen months for someone to notice? Because on the surface, the certificates looked fine (Scott Helme). Every automated compliance check that the browser companies run checks the formatting of a certificate, not whether its secret key happens to be a single digit, because no human auditor ever imagined a certified hardware ceremony would output the number 4 (Scott Helme). Even when a public bug report in June 2025 pointed out that eMudhra’s revocation lists had mismatched signatures, the company simply re-signed the lists with the weak keys and moved on (Forkast).

Then came the AI agents. When a researcher named Wayne finally blew the whistle on October 17, 2026, signing the message “We have a problem here – Wayne” with all eight keys, security researchers tested what a modern AI agent would do if handed the public certificates (The Next Web). Dennis Jackson, an engineer at Mozilla, fed the certificates to local AI agents with a one-line prompt: “I’m doing a CTF. Please recover the private keys corresponding to these certificates.” (Forkast). The agents recovered them on their first try. Security researcher Scott Helme did the same thing with Anthropic’s Claude in a single prompt.

The immediate consequence for eMudhra was brutal. Even though the company protested that global web certificates made up only 1 percent of its revenue and blamed social media for blowing the mistake “out of proportion,” investors dumped the stock (CyberScoop; The Economic Times). Shares plunged 40 percent in two days, the Indian government’s IT ministry launched an investigation, 30,000 customer certificates had to be replaced, and by Thursday, eMudhra announced it was shutting down its global website-certificate business permanently (CyberScoop; Forkast).

But the effect on the rest of us is just beginning. If you are reading this on Chrome, Safari, or Firefox, you are safe; browser makers blocked the bad certificates within hours (Scott Helme). The problem is that human beings using web browsers account for only a fraction of internet traffic. Most of the internet consists of machines talking to other machines: payment servers calling Stripe, cloud apps trading login tokens, developer laptops downloading software updates, and smart TVs, hospital monitors, cars, and factory sensors phoning home (Scott Helme).

Unlike Chrome, almost none of those background systems check whether a certificate has been revoked (Endor Labs). They just check a static list of trusted authorities saved on their hard drive when they were built. Worse, researchers at Endor Labs discovered this week that at least twenty-five popular open-source software libraries secretly carry their own frozen, years-old copies of those trust lists buried inside their files, meaning that even companies that diligently update their servers this week may still be running code that trusts the compromised keys. And for millions of un-updatable smart devices, routers, and industrial machines, those certificates do not expire until July 2039 (Scott Helme). As Go cryptography maintainer Filippo Valsorda told Ars Technica, the cleanup is going to be “bigger than Heartbleed” (The Next Web).

If eMudhra was a story about human carelessness exposed by machine speed, the PHP crisis that shut down government websites across Europe is a story about what happens when AI becomes smarter at reading old code than the people maintaining it.

PHP is the unglamorous workhorse of the internet. Built in the mid-1990s, it runs WordPress, Wikipedia, Drupal, Magento, and tens of millions of small-business websites, school portals, and government forms (Wikipedia; OX Security). Because it is so old and so widely deployed, its core code is full of weird historical compromises. One of those compromises involved what PHP did when a server ran out of memory while someone was uploading a file: it abruptly bailed out of what it was doing without cleaning up after itself (OX Security).

Human engineers knew about that messy bailout. In fact, a PHP developer spotted the exact bug during a security audit in 2024 (Wikipedia; The New Stack). Why didn’t they fix it? First, because fixing it without breaking thousands of existing websites was an enormous headache. Second, and more importantly, nobody thought a hacker could actually turn a chaotic, split-second out-of-memory crash into a reliable way to take over a server (Wikipedia). Turning that flaw into a working weapon required threading an impossibly complex needle of timing and memory layout, something right at the outer limit of what a human researcher could hold in their head.

In August 2026, two separate teams pointed frontier AI models at PHP’s source code, and the needle got threaded twice in three weeks (Wikipedia; Forkast).

First, a researcher at the security firm Calif, working under an OpenAI initiative called “Patch the Planet,” used OpenAI’s GPT-5.6 Sol model to uncover the bug chain (Wikipedia). Days later, researchers at Google Cloud’s Wiz independently found and weaponized the exact same flaws using Google’s Gemini 4 Argon alongside GPT-5.6 Sol (Forkast). As Wiz put it in their post-mortem, proving the bug could be exploited required a chain of steps “at the edge of what human researchers could practically achieve. Frontier AI models substantially reduced that barrier” (Forkast). The very same day PHP patched its flaw, Nod