The key facts

  • Jason Clinton (Anthropic) warned of a 'tsunami of vulnerabilities' and risks to critical infrastructure
  • PHP developers released emergency updates for two critical vulnerabilities rated 9.2 out of 10
  • Clinton estimated the period of elevated cyber risk at roughly 18 months

Warning of a 'tsunami of vulnerabilities'

Jason Clinton, deputy chief information security officer at the American AI company Anthropic, warned on Thursday that the growth in the number of newly discovered software vulnerabilities could overwhelm defense systems in the coming months. According to him, operators of critical infrastructure, including power and water facilities, may fail to fix flaws before attackers exploit them, as artificial intelligence accelerates the search for weaknesses in code.

Call to boards of directors and network isolation

Clinton urged organizations to isolate sensitive computer networks from external access to make them harder to breach. On the social network X he wrote: 'No matter how bad things have been over the past 4 days, before they get better, they will get much worse,' and added: 'Security leaders, don't let this crisis go to waste: go to your boards of directors and ask for help right now. Not for AI — for the basics.' He also warned that organizations will have to endure elevated cyber risks for roughly 18 months. Clinton did not name which recent incidents prompted his warning, nor did he claim they were connected.

Emergency PHP updates

The day before, on Wednesday, developers of the widely used programming language PHP, on which many websites and online services run, released emergency security updates closing two critical vulnerabilities. They allowed attackers to run malicious code on vulnerable servers without needing to log in. Each vulnerability was assigned a severity score of 9.2 out of 10; developers urged organizations to install the updates immediately.

AI's role in finding vulnerabilities

Clinton's comments came amid growing concern that AI tools may find weaknesses in software faster than companies and governments can fix them, expanding opportunities for hackers. Anthropic previously reported that it had used its own AI models to discover thousands of vulnerabilities in publicly available software, illustrating how the technology accelerates the identification of security problems.