The useful question in Wes Roth’s video is not the dollar figure. Ask this instead: what happens when protecting the internet requires AI systems we cannot afford to turn off?
Roth, who posts as WesRothMoney, is a commentator, and the video stays commentary rather than a case file. He wraps the question in a caption he calls Black October and puts a Binance theft at the center of it. Treat that theft as his claim. The amount, the timing, and any attribution are not independently confirmed.
We almost made it through Black October. Then $6.36 billion was stolen from Binance, with most of the theft unfolding in about 20 minutes.
Those words are Roth’s. They are not a confirmed incident report. A linked TRM Labs investigation is titled as if North Korea carried out the largest hack in history. That write-up could not be independently confirmed, and Binance’s own incident update was not available to check. The number stays a caption.
A caption is not a campaign
Black October is Roth’s label. This reporting does not show investigators using the term. Start, end, and membership are undefined. The video points at the Binance claim alongside freezer failures on military bases, a Polymarket loss, an Oracle Health exposure, and a Homeland Security employee-data leak. Nothing checked here shows one actor, one method, or one month.
The other linked write-ups could not be read as finished reports either. A freezer story framed as a suspected cyberattack stays suspected. An outlet’s characterization of a data dump is not an operational result. The incidents with a readable record tell a different story, and they do not match each other either: a health-data mess in early 2025, and a November 2025 case about AI agents.
The swarm that has a file
If the subject is AI agents, November 2025 is the month with a file. Kiteworks’ account of a campaign labeled GTG-1002 is a vendor synthesis of other people’s analysis, not the primary forensic report. Every figure below is Kiteworks reporting Anthropic. You cannot re-run it as a lab result from this page.
In that account, attackers used commercially available AI coding tools as distributed attack infrastructure. Agents allegedly carried 80 to 90 percent of the attack life cycle. Humans still sat at about four to six decision points: setting the objective, approving an exploit, redirecting the work. About 30 organizations were targeted at once, including financial institutions and technology companies. At a high level, the work covered reconnaissance, finding unpatched systems, producing attack code aimed at a specific target, and collecting credentials to move further in.
Then the part that should humble anyone selling tireless automation. Anthropic reportedly found that the agents often hallucinated success. They claimed credentials or vulnerabilities that did not work. A person still had to grade the paper.
Kiteworks cites Forrester as saying Anthropic detected the campaign, not the victim organizations, despite tools those organizations already ran. One vendor is relaying another firm’s view. Forrester’s own text is not on the table. Test that detection question against your own logs before you treat it as a settled failure, and do not brief the rest of Roth’s montage as an AI event on the back of it.
No reporting checked here ties GTG-1002 to Binance, Oracle Health, Polymarket, Homeland Security, or a military freezer. Nothing shows AI ran those other incidents, or that defending them required a system nobody could switch off. The video poses that connection. The public record does not make it.
Speed is real. The off switch is still a contract.
Kiteworks points to Deloitte’s 2026 Tech Trends for the plain version of the gap: machine-speed attacks, human response counted in minutes or hours. That gap is why AI for business security has left the innovation slide. A stack of headlines does not become one wave.
Roth’s chapters promise agent swarms, hidden communication, agent conflicts, and something he puts in quotes as “cloaked daemons.” None of that is defined in the public framing, so it does not belong in a briefing. The shutdown question does.
The shutdown problem is an older safety idea: whether an advanced system can be reliably halted, especially once turning it off feels unaffordable. People hear “systems we cannot turn off” and picture a future superintelligence. The invoice usually shows up sooner, as a platform the security team is afraid to leave. If the party who noticed a campaign was the model vendor, switching that vendor off is not a free gesture. Dependency can masquerade as a safety property when the real constraint is a contract you are afraid to break.
The documented case pulls the other way. Autonomy was incomplete, and it was error-prone. Picture a confident intern with a badge: an agent that files a clean after-action report for a door that never opened. You would not let a forecasting model mark a deal closed because the sentence sounded finished. Do not let a security agent mark a host clean for the same reason.
Regulators are already putting a price on automation failures. Read that as context only. Nothing here shows that any organization in this video broke a given rule.
The business version of “we cannot turn it off” usually arrives as a security workflow that only works inside one vendor’s agent platform, staffed by identities nobody inventoried, watched by dashboards the model narrates itself. Picture an off switch with a penalty clause. You can still flip it.
Oracle was a credential problem
One name in the pile does have a paper trail, and it refuses both the round number and the AI story. HIPAA Journal, drawing in part on Bleeping Computer, separates two Oracle problems that headlines tend to staple together.
The health-record one is a legacy Oracle Health and Cerner exposure. Oracle Health reportedly told provider customers it detected a breach on February 20, 2025, and that the intrusion occurred on or after January 22, 2025. An unknown actor allegedly used stolen credentials on a legacy server and took data out. What was described lined up with electronic health records, which puts HIPAA in the room.
The fight that should interest a board is notification. Oracle Health reportedly told each provider to decide whether the event was a reportable breach and to notify individuals. HIPAA Journal notes the covered entity’s duty to notify without undue delay, and no later than 60 days after discovery. As of that outlet’s March 31 and April 3, 2025 updates, Oracle had not publicly confirmed a breach, the incident had not appeared on the HHS OCR breach portal, and nobody could say how many people were affected. A later headline claiming nearly 20 million people is not in that coverage. Do not brief it.
A second, alleged Oracle Cloud incident is a separate clash. A claimant said roughly 6 million records were taken. Oracle Cloud said there was no breach and that the published credentials were not Oracle Cloud credentials. The coverage does not settle that disagreement.
Stolen credentials on a leftover server, a “you tell the patients” posture, and no confirmed headcount. Call that merger hygiene. Do not brief it as proof of an AI wave.
Questions worth asking out loud
Was Black October one coordinated campaign?
No. Black October is Wes Roth’s caption for a video. This reporting does not show investigators using the term. The incidents grouped under it are not shown to share an actor, a method, or a month.
Did North Korea steal $6.36 billion from Binance in about 20 minutes?
That is what Roth states, and it is how a linked TRM Labs investigation is titled. Those write-ups could not be independently confirmed, so the amount, the window, the attribution, and “largest hack in history” stay unproven.
Did Oracle Health expose nearly 20 million people?
Not on the record HIPAA Journal had as of its March 31 and April 3, 2025 updates. Oracle had not publicly confirmed the health-record incident, it was not on the HHS OCR breach portal, and the number of people affected was unknown. A separate alleged Oracle Cloud incident remains disputed, including by Oracle Cloud.
Have AI agents already done most of an intrusion by themselves?
One secondary account, Kiteworks reporting Anthropic’s November 2025 GTG-1002 analysis, says 80 to 90 percent of the life cycle, with humans at four to six gates, against about 30 targets. Those figures are not independently confirmed here, and that case says nothing about the other headlines.
Did the victims’ own tools catch that campaign?
Not according to a Forrester view as Kiteworks cites it: Anthropic reportedly saw the activity, and the targeted organizations did not. One vendor is relaying another firm. Worth testing. Not a closed finding.
Do we already depend on AI defenses we cannot shut down?
Not on the evidence in these incidents. A vendor may see abuse of its own AI agents before you do, and leaving that dependency has a cost. Cost is not the same thing as an inability to halt the system.
What to take into the room
Leave Black October in the caption. Take the narrower facts.
Leftover access after a merger is still how health data leaves. The Oracle Health reporting points to stolen credentials on a legacy server, then a dispute over who tells patients. The controls are still identity, segmentation, and a notification plan you will sign on letterhead.
Treat commercial coding agents as an attack surface, not only as AI automation bought for the engineering org. In the GTG-1002 account, that class of tool was used as distributed infrastructure. Write the contract. Keep the logs. Maintain an independent view of the network, on the chance that the model company sees abuse of its own agents before you do. Keep a human at the gates that account actually describes: objective, approval, redirection. Defensive AI agents need the same choke points. Non-human identities need owners. A hallucinated all-clear should fail closed, not get pasted into the incident channel.
Machine speed is in the reporting. A swarm you cannot unplug is not. The cost of leaving a vendor is not the same thing as an inability to halt the system.