OpenAI says its AI agents found two critical flaws in PHP, which 70% of websites use, and tech leaders say more trouble is coming. Here is what to do now.
Tech leaders are warning that the internet is heading into a rough stretch. On Wednesday, OpenAI said its AI agents helped find two critical security flaws in PHP, a programming language that 70% of websites use. A senior Anthropic security leader says a "vulnerability tsunami" is coming and that things will get worse before they get better.
A vulnerability is a weakness in software that attackers can use to break in. OpenAI said the two critical flaws were found in the infrastructure of PHP, which is open source, meaning its code is publicly available. Because so many websites rely on it, a problem there can reach a lot of places. AI agents are programs that carry out tasks on their own.
Separately, AI analyst Andrew Curran pointed on Thursday to a hack of Quest Diagnostics. He said the company serves roughly half of the hospitals and physicians in the US.
Jason Clinton, Anthropic's deputy security chief, posted on X that critical infrastructure needs patching before core network weaknesses get exploited. On Thursday he wrote, "As bad as things have gotten in the past 4 days, they are going to get a lot worse before they get better." He urged security leaders to ask their boards for help with the basics, not AI, and said we need to hold on for about 18 months.
Curran said the threat to energy, food and water systems is real. He wrote that someone is probing that infrastructure right now, in response to an NSA cybersecurity advisory about threat actors. Salesforce's Marc Benioff agreed with Clinton, writing, "Jason is 100% right. Code red."
Matt Shumer, former CEO of Hyperwrite, wrote that swarms of AI agents are likely trying to break into the websites people use. He called it the biggest cybersecurity moment in years.
Shumer's essay laid out four ways to protect yourself and your family. The material names these:
His reasoning is simple: "Every connected thing is another way in."
The material does not say how many sites are affected, whether the PHP flaws have been used in real attacks, or what was taken in the Quest Diagnostics hack. The 18-month figure is Clinton's own view of how long the pressure may last. Much of the warning comes from individual voices, not a single official count of damage.
Update your phone and apps, treat codes and links with extra caution, and remove apps and smart gadgets you no longer use.
DARPA wants AI to hunt for design flaws in stock, bond, energy and cloud markets, so enemies cannot use them to cause economic damage that reaches households.
Read more: Pentagon wants AI to find weak spots in stock and energy marketsTuring Award winner Richard Sutton says more computing power alone will not make AI truly smart. Big AI companies disagree, which matters for anyone betting on AI.
Read more: AI pioneer says piling on computing power won't make machines smartA viral ChatGPT prompt turns what the chatbot remembers about you into a room image. Posting it publicly could give scammers clues to target you.
Read more: Viral ChatGPT room image could hand scammers clues about you
