Understand this story
Anthropic Deputy Head of Information Security Jason Clinton warned on X that the security crisis caused by AI discovering large numbers of software vulnerabilities will continue to worsen for about 18 months before it may improve, and called on security leaders to secure resources from their boards as soon as possible. The report cites two severe PHP vulnerabilities named PHP2Shell as an example, saying that Wiz used Google's Gemini 4 Argon and OpenAI's GPT-5.6 Sol to discover this vulnerable code that has existed for more than ten years, while researcher Ryan Austin discovered and reported it earlier on August 1 using GPT-5.6 Sol, forming two independent discoveries. Clinton previously also predicted that open-weight models will reach equivalent cybersecurity capabilities within 7 to 10 months. There are currently no subsequent developments with evidence.
AI-generated from public reports
Developments
1 confirmed developments
Reports and discussion timeline
Browse reports and discussion by time. Their evidence levels remain distinct.
Oct 24
gihyo.jp
AI accelerates cyberattacks; Anthropic, OpenAI, Microsoft and others disclose defense and agent control developments
gihyo.jp reviews multiple releases and reports from late October, organizing AI-era defense challenges along two lines: vulnerability remediation implementation and permission management. Anthropic Deputy CISO Jason D. Clinton says that within about 18 months, high cyber capability will spread to small, cheap models, but fixes still need to be applied to running systems. The article cites OpenAI's discovery of Brotli's CVE-2026-111497 during testing in an isolated environment, and introduces remediation and credential control solutions such as AWS Continuum, Google Agent Compute Engine, and 1Password for Agents, as well as Microsoft's report on Storm-0940 using AI to automate attacks.
Oct 23
Business Insider Tech
AI discovers two critical vulnerabilities in PHP, industry warns cybersecurity faces a vulnerability wave
Business Insider summarizes statements from multiple executives and analysts on AI exacerbating cybersecurity risks: AI helped discover two critical vulnerabilities in PHP infrastructure, and PHP is used by as many as 70% of websites. Anthropic Deputy Chief Information Security Officer Jason Clinton says a vulnerability wave is imminent, says the situation will worsen first over the next 4 days, and calls on enterprises to shore up basic security first; Salesforce CEO Marc Benioff responds that this is a red alert. Investor Deedy Das says non-technical people can also use AI models to locate common vulnerabilities; Box CEO Aaron Levie believes agents will end security through obscurity and predicts rising demand for cybersecurity roles.
Numerama
Anthropic security lead warns the AI vulnerability-discovery crisis will last about another 18 months
Jason Clinton, Anthropic's deputy head of information security, said on X that the security crisis brought by AI discovering software vulnerabilities in large numbers will continue to worsen for about 18 months before it may improve, and called on security leaders to secure resources from their boards as soon as possible. The article takes two severe PHP vulnerabilities named PHP2Shell as an example, saying that Wiz used Google's Gemini 4 Argon and OpenAI's GPT-5.6 Sol to discover this vulnerable code that has existed for more than a decade, while Calif researcher Ryan Austin discovered and reported it earlier on August 1 with the help of GPT-5.6 Sol, forming two independent discoveries. Clinton previously also predicted that open-weight models will reach equivalent cybersecurity capabilities within 7 to 10 months.