mailwal

Cybersecurity Black October, Starshield Controversy, AI Regulation

Contrary Research

Cybersecurity Black October, Starshield Controversy, AI Regulation

Research Rundown #207, plus new reports on Coder and Ambrook

Oct 24

Cybersecurity’s “Black October”

A wave of security incidents this week, many tied to AI, has led many to start calling it Black October. The most serious such incident was when PHP, the programming language behind 69% of websites, patched two critical flaws after they were revealed, and the NSA advised sites that couldn’t update to go offline. Meanwhile, Microsoft reported a China-state-aligned group using AI agents to attack hundreds of organizations, sometimes gaining privileged access in under three hours. One hacker apparently using DeepSeek and Claude Code broke into websites of more than 100 companies, at about $50 per hack.

As AI has improved, cybersecurity incidents have risen. Google counted 141 exploited vulnerabilities through August this year, more than in all of 2025. The same month, OpenAI and more than 100 other organizations warned that AI-enabled attacks would soon become far more widespread. In a Stanford talk, Sam Altman said, “I no longer think we’re going to be able to just patch all the bugs.” The trend reached a head this week. Former CISA director Chris Krebs said “3% of all critical vulnerabilities ever discovered have been found in the last month,” and Figma’s John Milinovich wrote on Thursday that several dozen attacks in the previous two days “would each have been the worst to happen in an entire calendar year.”

Starshield Authority Debate

On Wednesday, it was reported that Elon Musk ordered an October 14 slowdown of Starshield, the military-grade Starlink connection that Ukrainian military forces use for drone control, targeting, and battlefield communications. The cap throttled terminals moving faster than 100 mph, leaving strike and interceptor drones practically useless, allowing Russian missiles to evade defenses, according to Ukrainian officials. Musk claimed in response that Starshield limits are decided "by the US military and ultimately POTUS," and an earlier Reuters report said the order came from inside the White House.

According to the Journal, Musk and Trump discussed the slowdown by phone soon after it became public. Trump denied ordering it and later said he'd "like to find out" who did. Hegseth stated the Pentagon issued no directive, and Secretary of State Marco Rubio denied any White House involvement. Nine bipartisan senators, led by Jeanne Shaheen and Thom Tillis, asked the Pentagon inspector general on October 15 to investigate whether officials or SpaceX caused the disruption, requesting a briefing by November 1.

Frontier AI Push for Regulation Continues

This week it was reported that Anthropic has been privately pitching lawmakers a draft federal AI safety bill, which a company spokesperson confirmed reflects the Advanced AI Framework that the company has advocated for in recent months. The draft bill would allow the government to block a model’s distribution only if the model poses a foreseeable, imminent risk of more than $1 billion in damages or more than 50 deaths or serious injuries from a bioweapon, loss of control, or cyberattack. Registered third-party evaluators, which could be compensated by the labs they are auditing, would have 72 hours to flag such risks.

Critics have taken issue with the specifics of the bill. Encode AI general counsel Nathan Calvin, for example, noted the preemption clause appears to prevent states from suspending dangerous models while setting an “absurdly high bar” for federal action, and Law AI policy director Charlie Bullock faulted the absence of government licensing for auditors. AI safety writer Zvi Mowshowitz, meanwhile, deemed the draft weaker than the FRONTIER Act. In response to these criticisms, Anthropic’s head of federal affairs, Anthony Cimino, promised to rewrite the preemption language and defended the thresholds as borrowed from California law.

Latest Research

What We’re Reading

  • Anthropic’s draft S-1 disclosed $16.3 billion in revenue for H1 2026, an $81 billion net loss, and more than $600 billion in total compute commitments, with Anthropic noting major cloud partners haven’t supplied all desired capacity and increasingly view it as a competitor, with two customers accounting for a fifth of H1 revenue and risk factors making up a third of the filing.

  • OpenAI accelerated a $30 billion fundraising round at a $1.4 trillion valuation (up from $852 billion in March) targeting close before Anthropic’s expected mid-November IPO, with SoftBank, Abu Dhabi’s MGX, and other existing backers in discussion.

  • SpaceX posted Q3 revenue up 161% to $14.6 billion (versus $12.72 billion consensus), its first profitable quarter as a public company at $4.4 billion net income, with its Super Intelligence segment (built on xAI plus the August 14 Cursor acquisition) growing 830% to $7.6 billion and over half of revenue; the reporting also documented SpaceX and Tesla each forming special committees to discuss a possible merger.

  • Microsoft withdrew from anchoring a flagship 50 MW Nscale data center in Loughton, Essex, after UK grid officials said they wouldn’t deliver power until the 2030s (versus the planned early-2027 start), with Nscale saying the London grid problem doesn’t affect other contracts as the company’s Microsoft-and-Anthropic-anchored prospectus heads to IPO after growing contracted value from $100 million to more than $103 billion in 2.5 years.

  • 404 Media found that Texas continued processing data-center permits after Governor Abbott’s September 21 “halt all permits” order, with Public Citizen identifying more than 15 and FracTracker counting 35, including air permits for gas plants and stormwater coverage in Abilene, Barstow, and Royse City; Abbott’s office has received $9 million from data-center developers.

  • Anthropic committed 5% of its shares to a new wholly-owned public benefit fund with another 2% added for each 50% jump in company value, potentially more than $100 billion at the company’s $2 trillion IPO target, with possible uses including large nonprofit donations, direct payments to specific populations, and addressing AI’s job-market impact (where Anthropic has already committed $200 million to study effects).

  • China proposed export controls on 23 AI technologies, including large language models, AI agents, chip designs, and computing clusters, with weights and source code restricted above two trillion parameters or global top 10 performance, with open-source and published research exempt and overseas API access from Chinese cloud still permitted.

  • Meta released Muse Spark Open, an open-weight model with 816 billion parameters and a one-million-token context window that Meta calls the most capable open-weight model in the US, requiring at least one terabyte of RAM to run locally (designed to run on the Mac Studio with the M5 Ultra chip).

  • Meta’s board structured a Founder Alignment Agreement with Zuckerberg, creating non-voting Class C shares to keep him in California and preserve his approximately 60.6% voting control, with Zuckerberg initially allowed to sell 20% plus 2.5% each quarter he remains in a full-time role, giving him about $20 billion of accessible cash to pay the up to $12 billion one-time wealth tax (5% of his estimated $239.3 billion net worth) that California’s Proposition 40 could impose if voters approve it in November.

  • IDC reported Q3 global smartphone shipments crashed 22% YoY to 255.3 million units, the worst quarterly decline on record, driven by a memory crunch (prices up about 350% YoY) that squeezed vendor margins and pushed consumers to hold existing devices longer.

  • OpenAI expanded distribution of its models to Google Cloud (plus AWS and Oracle), rounding out all Big Three clouds beyond Microsoft, with the three models entering private preview on Google Cloud Marketplace with existing cloud spend commitments applicable, zero-data-retention options due later, and Google planning to integrate OpenAI models into Gemini for business and Google Antigravity.

  • Elon Musk pledged to give one of his SpaceX shares to every US child in 2027, roughly equating to $10.5 billion at Friday’s $146.03 closing price across more than 72 million under-18s, one day after Anthropic’s 5% public-benefit-fund announcement.

  • Deutsche Telekom, Orange, Telefónica, and Vodafone signed a letter of intent to jointly bid for European Mobile Satellite Services spectrum in the 2 GHz band to counter Starlink, promoting Direct-to-Device service that works on ordinary phones with ground infrastructure kept in Europe.

  • Radical Numerics administered what it says is the first AI-engineered phage therapy to a human patient treating a bacterial infection, releasing a self-published, non-peer-reviewed technical paper, with the company declining to share patient details or physician identities, citing confidentiality and proprietary considerations.

  • Colossal Biosciences CEO Ben Lamm and Anduril founder Palmer Luckey launched Warhound, a defense startup that raised a $200 million seed at a $1.2 billion valuation to clone and gene-edit US military working dogs. More than 80% of the military’s dogs are bought from Europe, fewer than half pass training, and the US bids against China and Russia for the same animals. Warhound will biobank proven dogs, clone them, and screen out career-ending genetic conditions, with Anduril supplying body armor and sensor integration.

At Contrary Research, we’ve built the best starting place to understand private tech companies. If you're interested in researching and writing about tech, apply here for our Research Fellowship!

Want these every week?

© 2026 Contrary Research
548 Market Street PMB 72296, San Francisco, CA 94104