An executive at Anthropic PBC has warned that large-scale cybersecurity disruptions, such as this week's scramble by multiple governments and enterprises to patch two critical software vulnerabilities, could become "significantly worse" before conditions improve.
This week, numerous banks, airlines, and governments worldwide took websites offline as a precautionary measure to avoid being targeted by hackers. This followed cybersecurity researchers using AI to discover vulnerabilities in the open-source programming language PHP, which underpins a substantial portion of the internet.
Jason D. Clinton, Deputy Chief Information Security Officer at Anthropic, said on Thursday: "The past four days have already been bad, but it will get much worse before it gets better. Security leaders, do not waste any crisis—go to your board now and ask for help. Not for AI, but for the most fundamental security work."
AI models are becoming increasingly capable of identifying severe cybersecurity vulnerabilities. This capability helped researchers find the two PHP vulnerabilities that prompted multiple organizations to proactively suspend services this week, but it could also significantly enhance hackers' ability to exploit weaknesses. This has dramatically accelerated the pace of cybersecurity and compressed the time organizations have to respond to AI-discovered threats to near zero.
So far, there is little evidence that the increased number of disclosed vulnerabilities has led to more cyberattacks. Many vulnerabilities are actually discovered by tech companies themselves. Google reported 401 out of the 433 vulnerabilities found in Chrome in July. The U.S. government's "Known Exploited Vulnerabilities" catalog also does not show a significant increase in the number of known exploited vulnerabilities. There is also no public evidence that hackers have successfully carried out large-scale intrusions through these two PHP vulnerabilities.
However, the incident has left a large number of still-vulnerable systems that security teams must remediate. As AI tools help discover new vulnerabilities faster than organizations can patch them, this backlog could worsen further.
Chris Hughes, Vice President of Security Strategy at Noma, said: "AI has industrialized vulnerability discovery, but remediation remains bottlenecked by human resources."
Comments