AI Helped Find a Critical Bug Affecting Huge Swathes of the Internet

A critical PHP vulnerability discovered with the help of artificial intelligence could impact a significant portion of the internet, according to recently announced findings. The flaw, affecting a widely-used open-source programming language that forms the basis for numerous content management systems, poses a serious threat if left unpatched.

This potential attack vector could enable malicious actors to gain control of websites, install malware or steal user data. In response, cybersecurity teams have been working to apply fixes released by PHP's developers, with agencies worldwide issuing urgent statements and some government websites in Europe and Canada being taken offline for updates.

The Wall Street Journal reports that the specific vulnerability was recognized decades ago, but deemed too difficult to exploit and largely forgotten until its recent discovery in August. Researchers at Google and OpenAI utilized advanced AI models to uncover the exploitability of the flaw, with OpenAI describing it as one of the most impactful security issues in recent memory.

However, this discovery is part of a concerning trend: a recent Epoch AI graph reveals that the number of critical vulnerabilities reported monthly by major tech providers and open-source projects has surged from a few dozen to nearly 600. OpenAI acknowledges finding these vulnerabilities among many others they have identified and are working to resolve, with more such findings expected in the future.

Greg Brockman, president and second-in-command at OpenAI, noted the slow and manual process for creating fixes for the PHP bug, suggesting that governments may need to take a more extensive role in monitoring internet infrastructure and potentially intervene to address vulnerabilities. AI leaders and policymakers have been increasingly focused on cybersecurity, especially following the discovery in April that Anthropic's Claude Mythos Preview model could autonomously discover and exploit critical software vulnerabilities.

This prompted Anthropic and OpenAI to provide trusted partners access to their models in advance to strengthen cyber defenses.

Experts on AI risks in August warned that AI could soon be capable of both aiding and hindering cyberattacks, mainly due to open-weight models whose safeguards could be bypassed. These concerns are not only limited to the digital realm. The Information reports that hackers leveraged models from Anthropic, Moonshot, and SpaceXAI to automate attacks against 400 financial institutions in Latin America, circumventing some safeguards by convincing the models they were in harmless environments.

The rapid advancements in AI models are also pushing the boundaries of scientific discovery, with leading models tackling complex mathematical and physics problems, contributing to medical breakthroughs and raising concerns about potential bioweapons research. As AI continues to evolve, it brings both opportunities and challenges, necessitating urgent efforts to ensure its responsible development and use.