In my social media bubble, the past month has been described as Black October, the month in which an unprecedented number of cyberattacks spilled over into the physical world. Anyone listing what has happened over the past few weeks will quickly realise that far more is going on than a handful of isolated European incidents.
Three weeks after the attacks on French supermarkets, the freezers of many supermarkets in Belgium and other European countries were set to 50°C during the night from Sunday to Monday.
That same night, someone hacked into the systems of the French blood service via a maintenance contractor and raised the temperature of its freezers from minus 30°C to 110°C, with frozen plasma stored inside. A technician on duty noticed the temperature rising and prevented a far worse outcome.
How did we get here? Exactly according to the predicted timeline.
On 7 April, Anthropic announced that it would not release its latest model, Mythos. As a by-product of its general reasoning capabilities, the model had proven so effective at discovering software vulnerabilities that the company entrusted it only to a select group of verified defenders.
Many people dismissed the announcement, suggesting it was merely intended to inflate a forthcoming stock market valuation. Yet Anthropic's CEO, Dario Amodei, immediately added a prediction: open models, most likely Chinese ones, would match the same capability within six to twelve months.
At the end of August, that alarm bell rang. The Chinese company Zhipu released GLM-5.3. Anthropic tested the model: GLM-5.3 was capable of building functioning cyberattacks with a success rate comparable to that of Mythos.
One important detail: GLM-5.3 is what is known as an open-weights model. All of its model parameters are freely available. And so we run into one of the most contentious debates in modern AI development, one that many researchers are struggling with as well.
“They democratise intelligence, but they also introduce new risks”
Open AI Models
With closed AI systems, such as those developed by OpenAI, Anthropic and Google, the creators actively monitor whether their models are being used for criminal purposes. Anyone who repeatedly asks Claude how to attack critical infrastructure will lose access to the model. That system works reasonably well, although some cases still slip through the cracks.
Open models, by contrast, provide no control whatsoever over how they are used. They democratise intelligence, and we welcome that, but without oversight mechanisms they also enable the kind of disruption we are now witnessing.
Was an open model definitely involved? I would bet my life on it. But for now, nobody knows for certain. For many of these attacks, powerful AI was not even strictly necessary. Thousands of devices are simply exposed to the internet, many of them protected by extremely weak passwords.
But that misses the point entirely. AI may not have been essential, yet it makes these attacks dramatically more accessible. So where will the next attack strike? I am not going to provide a list of companies or pieces of infrastructure and put them on display. But imagine that everything capable of heating, cooling, pumping, dosing, opening, closing, accelerating or overwriting, and equipped with a web interface, even behind a firewall, can now expect unwelcome visitors.
Protection
How do we protect ourselves in the short term? Three measures can help.
First, defend yourself using the most powerful AI currently available. Anthropic developed Project Glasswing for this purpose, while OpenAI followed a month later with Daybreak, which includes its own cybersecurity model for verified defenders. Most companies will gain access to these capabilities very quickly.
Belgium also has local expertise, such as Ghent-based Aikido Security. Companies and public authorities urgently need to adopt a culture of red teaming: systematically searching for their own vulnerabilities as if they were attacking themselves. I wonder how many organisations in our country have already tested themselves using GLM-5.3.
Second, implement one or more physical safety mechanisms, or failsafes. Technology company Westinghouse, for example, designed a train brake that automatically engages when air pressure fails. A freezer should not be mechanically capable of reaching 110°C; a mechanical temperature limiter cannot be hacked. Likewise, the online maintenance tunnel should only be opened when someone deliberately enables it.
Against attackers equipped with modern AI, the final layer of defence for critical infrastructure must consist of something that contains no software at all.
Third, take seriously the people who predicted Black October when they speak about what comes next. Amodei gave us six months, and those six months have now passed. But he was, and remains, equally clear about what follows: the world is not prepared for the current race towards ever more powerful AI models. You do not have to agree with him on everything. But someone who predicted November's freezer attacks back in April deserves, in my view, more attention than those who dismissed his warning as little more than preparation for a stock market flotation.
BIO
Vincent Ginis is Professor of Mathematics, Physics and Artificial Intelligence at Vrije Universiteit Brussel and Harvard University