Cybersecurity leaders are sounding the alarm following the discovery of a major vulnerability this week. They predict that artificial intelligence tools will expose more fundamental weaknesses in the global Internet infrastructure in the coming months. “I don’t think we’re capable of righting all the wrongs anymore,” Sam Altman said Thursday night, joining the chorus of executives. In the midst of what is being called “Black October,” for which researchers used AI to help identify critical flaws in a coding language used on millions of websites that may have been unpatched for years, technology executives are warning about the ways in which AI will be used to identify and exploit security vulnerabilities at an unprecedented scale and pace. In the coming months we will see a “tsunami of vulnerability,” according to Jason Clinton, deputy chief information security officer at Anthropic. “There will not be enough time to patch critical infrastructure,” Clinton said in a post on X Thursday night. Marc Benioff, CEO of Salesforce, agreed, calling it a “code red.” AI is uniquely capable of finding and identifying security flaws in a way and at a pace that will feel catastrophic because the security community won’t be able to move fast enough to address them, said Matthew Prince, CEO of Cloudflare. “It will feel like the sky is falling. It will feel like there is nothing we can do. “The next two years will be incredibly, incredibly, incredibly rife with new tools that have infinite patience for searching for vulnerabilities on the Internet,” he wrote in a post on called PHP, which may have left the millions of websites running on it vulnerable to hackers for years. Some experts estimated that 70% of all sites on the Internet were at risk of being hacked. However, just as AI will be used to help identify security vulnerabilities at an unprecedented rate, technology leaders are concerned that it will also be used by malicious actors. After the vulnerabilities were announced, government and private websites in the US and. The U.K. temporarily shut down their sites to fix the bugs. The U.S. National Security Agency (NSA) issued an alert recommending that any site running on PHP implement the patches immediately. Malicious cyber actors may try to further exploit these bugs to access servers without authorization, the NSA said. AI security platform Wiz said this was “one of the most serious vulnerabilities discovered in PHP, and possibly in the history of software.” “The underlying flaws had been present for decades, but proving its exploitability required an exceptionally complex chain of steps, on the edge of what human researchers could practically achieve,” they wrote.
