<- all tokdocs
2026.10.26@nate.b.jones

Nate B. Jones tells you to ask Claude or Codex about "Black October" zero-days; every current Claude model's knowledge stops four months before Black October happened

AI
Watch on TikTok

View on TikTok ->

The artifact is a 93.110567 s vertical clip, 1080x1920, in a QuickTime/MOV container (ffprobe reports format_name=mov,mp4,m4a,3gp,3g2,mj2), carrying an HEVC video stream at a constant 30/1 fps with 2,793 frames and a 1,208,328 bps bitrate alongside a 44,100 Hz stereo AAC stream at 96,145 bps and 2,008 frames, for an overall 1,311,068 bps and a file size of 15,259,293 bytes that matches filesize in metadata.json exactly; yt-dlp recorded the format id as bytevc1_1080p_1311062-1 with tbr 1311. The extracted audio.mp3 runs 93.178776 s at 121,823 bps across 1,418,918 bytes. The post timestamp is epoch 1792972871, which is 2026-10-26T00:01:11Z, matching the upload_date field of 20261026. The handle is nate.b.jones (uploader id 7061010091441964079), the display nickname is "Nate", and the audio is credited as "original sound" by artist "Nate", so there is no licensed music track. The description is 94 characters: "Scan yourself before hackers do. #aihack #cybersecurity #aisafety #ai #artificialintelligence". At capture time, the mtime on metadata.json, 2026-10-26 18:27:58 local, the counters read 112,300 views, 7,233 likes, 148 comments, 2,303 reposts and 7,410 saves. I read sixteen frames: 001, 004, 007, 010, 013, 015, 016, 017, 018, 036, 044 and 047 from the supplied 2 s set, plus a denser re-extraction at 30.5 s, 31.0 s and 31.5 s (fps=2) and at 58 s, 60 s, 62 s and 63 s (fps=1). The transcript carries 256 words across 12 segments in English. Every frame shows the same thing: a man with a full grey-flecked beard and dark-rimmed glasses, wearing a dark plaid flannel over a corduroy-collared shirt, filmed close in a domestic room with a white wall, a wood cabinet edge at frame left, a ceiling light fixture and a small framed picture at frame right, and a grey chair back visible behind his shoulder. A blue title card sits at the top of every frame I read from 0 s to 92 s, reading verbatim "AI Hack: The Prompt That Scans You For Vulnerabilities". Word-level burned-in captions run along the bottom in white with the current word highlighted cyan: "IF YOU SAW" (0 s), "HOW TO PROTECT" (6 s), "AI TO MAKE" (12 s), "ATTACK." (18 s), "YOU CAN FEED" (24 s), "ON YOUR MACHINE," (28 s), "YOU KNOW, CHATGPT," (30 s), "WORKER CODEX, OR" (31.5 s), "CLAUDE INSTALLED ON" (32 s), "ON YOUR DESKTOP." (34 s), "HACKS AND ZERO" (58 s), "DAY VULNERABILITIES FOUND" (60 s), "DURING THE BLACK" (62 s), "OCTOBER EVENT," (63 s), "AND A PLAN" (70 s) and "THANK YOU, AND" (86 s). No terminal, browser, editor, chat window, screen recording or prompt text card appears in any frame I read, so the video never shows the prompt being run and never shows a single result it produces. The spoken argument is that AI is driving a wave of attacks, that you should point the same AI at yourself for defense, and that pasting one short prompt into a desktop AI app will enumerate your personal vulnerabilities tied to the ongoing "Black October" event and hand you a prioritized fix plan. The transcript's last segment ends at 92.36 s against an audio duration of 93.110567 s, so nothing is timestamped past the end of the audio and no segment is a Whisper hallucination.

"Black October" is a real, correctly dated event, and the video gets the name right

At 48.06 s the video says "look for vulnerabilities tied to established bugs, hacks, and zero-day vulnerabilities found during the Black October event, which is ongoing." The term is not invented. The Wikipedia article on the subject records that October 2026 in information security "has been referred to as Black October due to several major security incidents and vulnerability disclosures," and the incidents it lists cluster between 17 and 21 October 2026.

The spelling is confirmed twice over in the artifact itself. Whisper produced "Black October," and the burned-in TikTok caption at 62 s reads "DURING THE BLACK" with 63 s reading "OCTOBER EVENT,". Both the local transcription and the platform's own captioner agree, so there is no name-mangling to correct here.

The underlying events check out against dated sources. The article records that "On 17 October 2026, a security researcher reported that the private keys associated with eight intermediate certificate authority (CA) certificates operated by the Indian digital trust provider eMudhra were cryptographically weak," with the keys traced to a key-generation ceremony in April 2025. It records that "On 21 October 2026, the PHP development team released emergency security updates addressing two critical vulnerabilities," identified as CVE-2026-109618 and CVE-2026-109619 and collectively named PHP2Shell, fixed in PHP 8.2.35, 8.3.36, 8.4.27 and 8.5.12, with downstream exposure across WordPress, Drupal and Joomla. The same window includes a LiteLLM supply chain attack, in which a malicious version 1.107.0 was published to PyPI and was available between 11:39 and 13:23 UTC on 21 October, and a GitLab remote code execution fix released on 21 October.

Fortune's 21 October 2026 reporting supplies the broader AI framing the video opens with. It describes a 25 September 2026 attack in which a single operator deployed autonomous AI agents against more than 1,200 websites and breached roughly 100 companies including Deere, SharkNinja and Cummins, at a token cost of about $5,000, which the piece frames as roughly $50 per successful breach. Jessica Ji of Georgetown's Center for Security and Emerging Technology is quoted there saying "These AI systems are now both more capable of hacking and are able to act more autonomously." So the premise at 0.60 s, that AI is driving a measurable wave of attacks, is supported by first-party reporting with named sources and dates.

I could not reach CNBC's 23 October 2026 piece on the PHP vulnerabilities. The fetch returned HTTP 403, so I do not cite it.

Correction: the Black October flaws are patched disclosures, not zero-days

The prompt the video dictates asks the model to look for "zero-day vulnerabilities found during the Black October event." The NIST Computer Security Resource Center glossary, drawing on CNSSI 4009-2022 and NISTIR 8011 Vol. 3, defines a zero-day attack as "An attack that exploits a previously unknown hardware, firmware, or software vulnerability."

The Black October flaws do not meet that definition at the moment a viewer would run this prompt. PHP2Shell was disclosed on 21 October 2026 alongside the patched releases, so by 26 October, when this video was posted, the two bugs had CVE identifiers, published fixed version numbers and vendor advisories. They were known, catalogued and remediable. The GitLab remote code execution flaw was likewise disclosed with its fix on 21 October. The eMudhra key weakness was reported on 17 October.

This matters for the prompt's practical output, not just its vocabulary. A model asked to hunt "zero-days" on a personal machine is being pointed at something that by definition has no public signature to match against. A model asked to check whether a machine is running PHP below 8.2.35, 8.3.36, 8.4.27 or 8.5.12 is being given a version comparison it can actually perform. The prompt as dictated asks for the former and would be far more useful asking for the latter.

Correction: no current Claude model knows Black October happened without a live web search

At 19.28 s the video says the prompt is one "that you can use and feed to Claude. You can feed it to ChatGPT." The prompt then names Black October as the thing to check against.

Anthropic's models overview page lists the current lineup as Claude Fable 5.1 (claude-fable-5-1), Claude Opus 5.5 (claude-opus-5-5), Claude Sonnet 5.5 (claude-sonnet-5-5) and Claude Haiku 5.5 (claude-haiku-5-5). For all four, the page gives a "Reliable knowledge cutoff" of "Jun 2026" and a "Training data cutoff" of "Jun 2026." The page defines reliable knowledge cutoff as "The date through which the model's knowledge is most extensive and reliable."

Black October ran from 17 October 2026. That is roughly four months past the cutoff of every current Claude model. Asked about "Black October" with no retrieval, a model has two options: say it does not know, or produce something that sounds like an answer and is not grounded in the actual CVEs. The second failure mode is the dangerous one in a security context, because a confident list of fabricated vulnerabilities and fabricated fixes is worse than no list.

The fix is a single missing instruction. The prompt as dictated never tells the tool to search the web first, and it never names the specific CVEs. A viewer who pastes it verbatim into a session with web search disabled gets a security report assembled from training data that predates the event the report claims to cover. Adding "search the web for the Black October CVEs disclosed between 17 and 22 October 2026 before you start, and cite each advisory you use" converts the prompt from something that invites invention into something that can be checked.

Correction: the three tools the video names do not have the access the prompt assumes

At 26.16 s the video says "You want to have an installed app on your machine. So, you know, ChatGPT Worker Codex or Claude installed on your desktop." The burned-in TikTok caption renders the same stretch as "YOU KNOW, CHATGPT," then "WORKER CODEX, OR" then "CLAUDE INSTALLED ON". Whisper and TikTok's own captioner independently produced "worker," so this is an ambiguity in the audio rather than a local transcription artifact, and I do not know with certainty which product name was spoken. The three products that exist and plausibly fit are the ChatGPT desktop app, OpenAI's Codex, and Claude on the desktop. What each one can actually do differs sharply from "scan my system."

Codex running locally defaults to a workspace-write sandbox with on-request approvals. OpenAI's agent approvals and security documentation states "By default, the agent runs with network access turned off." The sandbox permits reading across the workspace and writing within the current working directory, and holds .git, .codex, .aws and .agents read-only. A verbatim "please scan my system, all of my online presence and projects" instruction, given at 34.84 s, runs into two walls at once on a default Codex install: the filesystem scope is the workspace, not the system, and the network is off, so "everything you can find about me online" returns nothing until the user explicitly enables network access.

Claude on the desktop has no blanket filesystem access either. Anthropic's installation documentation describes desktop extensions as the mechanism for reaching local data, offering to "Connect Claude to your desktop apps with one click: Install extensions that integrate with your local files, calendars, emails, and messaging apps," and describes Cowork's file reads and writes as "limited to folders you connect," running in an isolated virtual machine. Access is granted per folder and per extension by the user.

Claude Code is closer to what the prompt imagines, and still bounded. Its security documentation describes a "Working directory boundary" where "In Manual mode, Claude Code asks you before its file tools read or write outside the folder where it was started and its subfolders," and notes that "Commands that fetch content from the web such as curl and wget are not auto-approved by default."

So the claim at 79.42 s, "It will look at your whole internet presence. It really will. It will look at your whole system," is not what any of these tools does out of the box. Reaching that behaviour requires a user to deliberately widen permissions, which is a real decision with real consequences and which the video never mentions.

The prompt's own shape is the attack surface the video is warning about

The prompt instructs an agent with filesystem access to go read arbitrary web content about the user. Anthropic's own published research on prompt injection defenses states that "every webpage an agent visits is a potential vector for attack" and that "prompt injection attacks represent one of the most significant security challenges for browser-based AI agents." The 24 November 2025 research reports measured attack success rates of 7.6% on Claude Opus 4.5, 10.8% on Claude Sonnet 4.5 and 11.1% on Claude Haiku 4.5 before safeguard improvements, falling to 1.4%, 1.9% and 2.4% after. Anthropic's own assessment of that result is quoted directly: "A 1% attack success rate, while a significant improvement, still represents meaningful risk."

Both vendors warn about exactly this pattern. Claude Code's security page lists as best practice "Avoid piping untrusted content directly to Claude" and "Use virtual machines (VMs) to run scripts and make tool calls, especially when interacting with external web services," closing with the warning that "While these protections significantly reduce risk, no system is completely immune to all attacks." OpenAI's Codex documentation states that "Prompt injection can cause the agent to fetch and follow untrusted instructions" and raises it specifically in the context of enabling network access and web search.

The Black October incidents themselves make the stakes concrete. The LiteLLM supply chain payload, per the Wikipedia account, "contained credential-stealing software and remote-access functionality" and "targeted browser credentials, cloud service secrets, developer authentication tokens and API keys used by AI services." A security-scanning session granted broad filesystem reach and network access holds precisely that inventory in one place. The prompt builds the target it is meant to protect.

There is also a scoping mismatch worth naming. Every incident in the Black October cluster sits in server and developer infrastructure: the PHP interpreter, Node.js Brotli decompression, GitLab, a PyPI package, and an intermediate certificate authority. None of them is a consumer desktop vulnerability. The Wikipedia article makes no claim about personal machines or personal online accounts being affected. A viewer who does not run a PHP web server, a self-hosted GitLab or a LiteLLM proxy has very little Black October exposure for any agent to find, and an agent instructed to find something will be under pressure to report something.

The horrified-user claim is unverified and the video shows no run

At 83.92 s the video says "I have had people run this prompt, and they come back saying, one, thank you, and two, I am horrified." At 72.10 s it says "It is scary how much that will turn up."

No frame I read contains a terminal, a chat transcript, a screen recording, a vulnerability list or any output of any kind. The entire 93 s is a single talking-head shot with a static title card and word-level captions. The claim rests on the speaker's unshown reports from unnamed people. I found no published account of this specific prompt being run with results. It is unverified, and the video supplies no artifact that would let anyone verify it.

The source is credible in his own domain. Nate B. Jones publishes AI News & Strategy Daily and advises on AI strategy after product leadership work at Amazon Prime Video. That is a track record in AI product strategy. It is not a security research track record, and this video makes security claims about vulnerability classes, agent capabilities and patch status that each turn out to need correction.

Key Takeaways

  • Verified: "Black October" is a real label for the October 2026 cluster of security disclosures, running from the 17 October eMudhra certificate authority key report through the 21 October PHP2Shell emergency release (CVE-2026-109618 and CVE-2026-109619), the LiteLLM PyPI supply chain attack and the GitLab remote code execution fix.
  • Verified: The video's opening premise that AI is driving a wave of attacks is supported by Fortune's 21 October 2026 reporting, including a 25 September 2026 autonomous-agent campaign against more than 1,200 websites that breached roughly 100 companies for about $5,000 in tokens.
  • Correction: The video calls the Black October flaws "zero-day vulnerabilities." NIST defines a zero-day attack as one exploiting "a previously unknown hardware, firmware, or software vulnerability." PHP2Shell and the GitLab flaw were disclosed with patches and CVE identifiers on 21 October 2026, five days before this video posted, so they were known and patchable, not zero-days.
  • Correction: The video says to feed the prompt to Claude. Anthropic's models overview gives every current Claude model, Fable 5.1, Opus 5.5, Sonnet 5.5 and Haiku 5.5, a reliable knowledge cutoff and training data cutoff of June 2026. Black October began in October 2026. Without an explicit instruction to search the web, the model has no grounded knowledge of the event and may invent findings.
  • Correction: The video claims "It will look at your whole internet presence. It really will. It will look at your whole system." Codex defaults to a workspace-write sandbox with network access turned off. The Claude desktop app has no default filesystem access and reaches local files only through extensions or explicitly connected folders. Claude Code asks before reading outside its starting directory and does not auto-approve curl or wget.
  • Clarification: The transcript's "ChatGPT Worker Codex" at 26.16 s matches TikTok's own burned-in caption "WORKER CODEX, OR" at 31.5 s, so the garbled product name is an ambiguity in the audio rather than a Whisper-only artifact. The 2 s frame sampling skipped this caption entirely; it only appeared after re-extracting at fps=2 across 29 to 35 s.
  • Context: The prompt asks an agent with filesystem access to ingest arbitrary web content about the user, which is the pattern both vendors warn against. Anthropic measured browser prompt injection attack success at 7.6% to 11.1% before safeguards and 1.4% to 2.4% after, calling even 1% "meaningful risk." The LiteLLM payload from the same Black October window specifically targeted browser credentials, cloud secrets, developer tokens and AI service API keys.
  • Context: Every Black October incident sits in server or developer infrastructure, PHP, Node.js, GitLab, PyPI and a certificate authority. None is a consumer desktop vulnerability, so a typical viewer running this prompt has little genuine Black October exposure to find.
  • Unverified: The claim at 83.92 s that people ran this prompt and came back "horrified." No frame shows the prompt being run, no output appears anywhere in the video, and I found no published account of a result.

Resources

Published October 26, 2026. Writeup generated from a favorited TikTok.