Reading the fog: Using semantic search to interpret social media noise about "black october"

 

“Black October” is the name some people are using for what is reportedly a series of AI-driven cybersecurity incidents, still unfolding as I write this. It is an emerging phenomenon in the most literal sense. The events are still happening, the name hasn’t settled, and nobody quite agrees on what counts as part of it. Or if it is happenning at all.

For something this new, social media is in a perpetual state of fog of war. Posts arrive before the vocabulary does. And if you try to find them by keyword, you hit an obvious problem: “black”, “October” and “AI” are some of the most ordinary words on the internet in autumn. Search for them together and you get Halloween art, festivals, and a lot of general hand-wringing about AI, with the posts you actually want scattered somewhere inside.

Using this as a way to think through what searching semantically rather than just searching lexically might look like in practice.

First, go wide to get a broad corpus

I searched the AT Protocol network (Bluesky, W Social and the other apps built on the same protocol, plus fediverse posts bridged in). The search ran from 15 September to 23 October 2026 and used three kinds of query: 1. the exact phrase “black october” and the hashtag #BlackOctober; 2. the phrase in nine other languages (sort oktober, schwarzer Oktober, octobre noir and so on); 3. any post containing black + October + an AI-related word (AI, swarm, hack, agents), in any order.

That last is deliberately sloppy. It catches every post that might be relevant, and plenty that obviously aren’t. I’d rather sort a messy pile than miss things by being too clever with keywords before I know what the conversation sounds like. The search returned 2,217 posts. After collapsing copy-pasted duplicates, 2,050 unique texts were left.

Then, find blobs of meaning within the corpus

Keyword search asks “does this text contain these words?” What I actually wanted to know was “does this text carry this meaning?” And so I used BERTopic:

Turn each post into numbers that capture meaning. A multilingual language model reads each post, along with any post it quotes and any link preview, and produces an embedding: a long list of numbers in which posts that say similar things end up close together, even in different languages. Then, squash that space down. UMAP compresses those hundreds of dimensions into a handful, keeping nearby posts nearby. Then, find the blobs of meaning. HDBSCAN looks for dense clusters of posts in that compressed space. Posts that don’t sit in any crowd are left unassigned rather than forced into one. Label each blob of meaning. BERTopic picks out the words most distinctive of each cluster, so you get a rough label like “cyberattacks · major cybersecurity”.

That give you a meaning map of the conversation. A cluster about an October festival sits in one place, AI art in another, and posts about agents attacking systems in a third. Crucially, none of that sorting depended on me saying in advance what the topics should be.

Next, interpret each clump

This part tends to get undersold in computational methods write-ups. The topic model doesn’t know what “Black October” is. Nobody does yet, which is kind of the problem. So at several points the work stopped being computation and became interpretation.

Which clusters count as “the event”? I used a weak signal to shortlist them. Posts that name “Black October” outright are a small minority, but they aren’t spread evenly. For each cluster I checked how over-represented those explicit posts were compared to the dataset as a whole. Clusters where they bunched up became candidates. Then I read the posts in each candidate and kept the five that held up.

What do the clusters actually mean? The model’s labels are keyword salad:  “panic insiders · october panic · panic stoking”. Turning that into “panic and insider claims about what happened” is an interpretation of the posts, and not a "property" of the model.

Where does the boundary go? This was the hardest call. Some of the grey clusters are about AI too: rogue agents, agent swarms, AI safety. They sit right next to the event in meaning. Are they part of Black October, or the background conversation it’s happening in? The model can show me that the two are close. Deciding whether close means “in” is my judgement about the phenomenon. The categories we build carry choices in them. That’s doubly true when the category is still forming. The topic model makes the choices visible and much faster to make, but it doesn’t make them for me.

Now, I can use each clump to pull out from the corpus the posts that I think are "about" the emerging Black October event. Aroughly 118 out of the 2217 wider corpus. 

Reading 118 posts is manageable. I'm going to go do that now.