Nikesh Arora, chief executive of Palo Alto Networks, wrote on X on 2 November that “Attacks will accelerate from here on”. In the post he said attacks “are not becoming more sophisticated, it’s the same attacks, faster and by a lot more people”, and that “Incident responders have never been busier”.
By our count, 16 of the 689 AI news pieces FourWeekMBA published in the seven days to 2 November reported breaches, attacks or vulnerabilities in the wild, about 2.3%, and four more covered research on AI attack capability. The grouping is our own classification of our headlines.
Business Pill · Least Privilege
A short explainer on least privilege: giving software only the access it needs. It is a general explainer and is not about this story.
The key insight: Palo Alto Networks chief executive Nikesh Arora wrote on 2 November that attacks are not becoming more sophisticated but are the same attacks, faster and by a lot more people; by our count, 16 of the 689 AI pieces we published in the week to 2 November reported breaches, attacks or vulnerabilities in the wild.
Arora opened by recalling an earlier prediction: “Six months ago I said Mythos like capability will be widely available. It’s happening.” Mythos is the name of a line of Anthropic models; we covered a screenshot showing a Mythos 5.5 name in Anthropic’s site code on 1 November.
He listed three points. Attack path discovery, he wrote, “which took trial and error and multiple attempts is now trivial, open source LLMs are here to help”. On exposure he wrote “you are as secure as your supply chain”, adding that “marketplaces and supply chain is an easier vector”.
He wrote that the rise in activity comes from people: “The increase in activity is a result of more people becoming better at hacking due to the ease of being able to attack.” He added: “Had not contemplated that in my calculus.”
Breach, attack and vulnerability stories FourWeekMBA published in the seven days to 2 November, by day, out of 689 AI news pieces. The grouping and counts are our own classification of our headlines; they measure our coverage, not attack volumes.
What Was Posted on X
Attacks will accelerate from here on – We are there: Six months ago I said Mythos like capability will be widely available. It’s happening. A critical vulnerability, a social engineering attack that looks innocuous, or daisy chaining publicly available vulnerabilities and conducting a sniper strike is all being witnessed in the wild. Incident responders have never been busier.
Some key points: – attacks are not becoming more sophisticated, it’s the same attacks, faster and by a lot more people. – attack path discovery which took trial and error and multiple attempts is now trivial, open source LLMs are here to help – you are as secure as your supply chain, insecure down or upstream players who have access to your infrastructure could be the next attack path, marketplaces and supply chain is an easier vector
The increase in activity is a result of more people becoming better at hacking due to the ease of being able to attack. Had not contemplated that in my calculus.
Please: 1. Test your infrastructure for accessible vulnerabilities and misconfigurations 2. Fix your code and demand your vendors do. 3. Old infra, or insecure infra at the perimeter needs to be updated first 4. New AI tools, especially coding need a security framework. Your developers will do more with code, new skills, and more automation. Don’t forget the coding models have trained on human code.
Palo Alto Networks chief executive Nikesh Arora posted this on X on 2 November. He writes that attacks are โthe same attacks, faster and by a lot more peopleโ and lists four steps for defenders; this piece quotes the post throughout.
His Four Asks
Arora closed with four requests to defenders: test infrastructure “for accessible vulnerabilities and misconfigurations”; “Fix your code and demand your vendors do”; update “Old infra, or insecure infra at the perimeter” first; and give new AI coding tools “a security framework”. On the last point he wrote: “Don’t forget the coding models have trained on human code.”
As we read it, Arora’s argument is about volume rather than novelty: if the same attacks become cheaper to run, more defenders are exposed at once, and the weakest link in a vendor chain matters more. Palo Alto Networks sells security products, so his view of rising attack activity also describes demand for his company’s market.
The Structural Read
As we read the post, Arora’s claim is about how many people can run an attack, not about new kinds of attack.
As we read his three points, he names two exposures: attack paths that open-source models make trivial to find, and supply chains and marketplaces as an easier route in.
As we read our own week of coverage, several of the incidents we reported came through supply chains and tools, such as the tampered Claude Code add-on Cursor disclosed.
Nikesh Arora, Palo Alto Networks, on X, 2 November 2026
“attacks are not becoming more sophisticated, it’s the same attacks, faster and by a lot more people”
Three Implications
FOR SECURITY TEAMS Arora asks them to test infrastructure for accessible vulnerabilities and misconfigurations, and to update old or insecure infrastructure at the perimeter first.
FOR SOFTWARE BUYERS He writes: fix your code and demand your vendors do.
FOR TEAMS ADOPTING AI CODING TOOLS He says new AI tools, especially coding tools, need a security framework.
The framework puts it this way: “The surface, not the model, governs autonomy.”
As we read it, Arora’s fourth ask, a security framework for AI coding tools, is a request about that surface. The framework does not discuss Arora or Palo Alto Networks.
Arora’s post gives no figures for attack volumes, incident counts or the share of attacks using AI; those claims are his view. The post does not say which Mythos capability or which open-source models he means. Our 16-piece and four-piece counts and the 2.3% share are our arithmetic from our own headlines, a count of what we covered, not a measure of attacks.
This Week In The AI Supercycle
Anthropic’s Reality Check, The Capital Squeeze, & The New World Order
This week’s issue: for two years the AI build-out was priced as a growthstory. This week it started being priced as a credit story.
Palo Alto Networks’ chief executive wrote on 2 November that attacks are not getting more sophisticated but are coming faster and from more people, and asked defenders to fix code, update old infrastructure and set rules for AI coding tools. By our count, 16 of the 689 AI pieces we published in the past week reported breaches, attacks or vulnerabilities in the wild.
A note on sourcing. Quotations and claims attributed to Nikesh Arora come from his 2 November post on X. References to earlier incidents link to FourWeekMBA’s own pieces, each sourced there. The 16-piece count and 2.3% share are our arithmetic from our own headlines.
Gennaro Cuofano is a CRO and tech executive who has worked in AI since late 2015, starting with bringing NLP, natural-language generation, voice and chatbot products to the marketing industry. His background is in law and finance: he holds a Master's degree in Law and an International MBA with an emphasis on corporate finance (LUISS Business School and the University of San Diego, 2012), and worked as a financial analyst at a real-estate investment firm in San Diego and as an assistant controller. His work focuses on business model strategy, business engineering and, more broadly, structural analysis: how companies make money, read from their own filings. He created FourWeekMBA and leads research there and at The Business Engineer, his newsletter on AI and business strategy, with over 95,000 subscribers and more than 1,000 published analyses. His writing has also appeared on Entrepreneur (for example, How to Digitize a Family Business in Europe) and HackerNoon. Find him on LinkedIn and Substack. See how we source.
