Amazon Issues Warning: New Cybersecurity Flaws Uncovered By AI Are Being "Exploited At Scale"

Researchers using models from OpenAI and Google have uncovered serious vulnerabilities in software used by the vast majority of websites worldwide.

Amazon has warned that security flaws discovered by researchers using artificial intelligence tools in a programming language that powers a large number of internet sites are now being "exploited at scale." Governments and companies are racing to secure their systems.

The world's largest cloud computing provider said on Wednesday that it had found hackers attempting to exploit the vulnerabilities as early as four days before they were publicly disclosed. Amazon added that the flaws "are currently being widely exploited in real-world cyber environments."

Earlier that day, the US National Security Agency (NSA) and UK authorities warned that the vulnerabilities put websites around the world at extremely high risk of hacking. According to reports, some European governments have taken parts of their websites offline while patching the two security flaws.

The vulnerabilities went undetected for more than a decade until researchers identified them with the help of AI models from OpenAI and Google. The broad potential impact of the flaws underscores AI's ability to disrupt the cybersecurity landscape. Earlier this year, Anthropic and OpenAI successively launched new models with powerful cybersecurity capabilities, triggering warnings from politicians and financial regulators and prompting the US government to temporarily restrict the release of those models.

The NSA warned all organizations using a programming language called PHP on Wednesday to update their systems immediately or take the affected systems offline. The developers responsible for maintaining PHP released a software update earlier that day to fix the vulnerabilities. The NSA said: "These vulnerabilities often allow attackers to gain direct access to a server's file system or database. If updates cannot be completed immediately, we recommend that affected organizations temporarily take their systems offline until the flaws are fully remediated."

Researchers at two US cybersecurity firms, Calif and Wiz, discovered the vulnerabilities. Wiz, owned by Google parent Alphabet, estimates that the vulnerable PHP programming language underpins about 70 percent of websites worldwide. OpenAI said on Wednesday: "Given the severity of these vulnerabilities and the widespread use of PHP, we believe this is one of the most significant cybersecurity issues in recent years. To our knowledge, frontier AI models discovered these vulnerabilities before attackers did."

OpenAI added: "This highlights AI's ability to find security flaws that could affect the entire internet, but the same capability could also help attackers rapidly develop attack tools and exploits." OpenAI worked with PHP, Calif and Wiz to jointly verify the vulnerabilities and develop corresponding patches.

The White House said federal agencies are assessing the potential impact of the vulnerabilities on government systems and critical infrastructure. PHP is widely used on the internet mainly because WordPress, the world's most widely used website-building platform, is primarily written in PHP and relies on the language to run.

The UK National Cyber Security Centre (NCSC) said the vulnerabilities could allow hackers to take control of website servers without passwords or other login credentials. The agency said: "The UK National Cyber Security Centre is urging UK organizations to take action immediately."