AI Saves the Day—and Could Bring Doom Tomorrow

The National Security Agency warned organizations that if they could not fix their websites immediately, they should take them offline. The vulnerabilities were in PHP, the programming language behind most of the world's websites, allowing anyone to run commands on a server without a password. Several European countries temporarily took down some government sites due to the severity.

The prime minister of Japan instructed her country to prepare for patching. This was not the first occurrence of such a crisis, but it was the most serious. The flaws were discovered with the help of artificial intelligence models, including OpenAI's, and were reported to PHP's maintainers in August. OpenAI claimed that the AI found these flaws before attackers did.

However, Amazon spotted someone attempting to exploit the flaws just four days before public disclosure. Within days, attackers began using them to breach systems in the U.S., Japan, Taiwan, and South Korea. The open-source AI labs are also contributing to this issue, with China leading the development of open models that anyone can download and run on their own hardware.

The gap between the capabilities of open models and the closed, more secure ones is rapidly closing. This rapid progress is due to China, which is rapidly advancing with open models that are among the most downloaded globally. The discovery of vulnerabilities is shifting from a complex process to a simple prompt-based operation.

The barrier to entry is collapsing, and anyone with the desire can exploit these flaws. This reality is approaching faster than our digital security model, which assumes finding catastrophic flaws is difficult and that the few who can do so are on our side. This shift could result from criminal crews, foreign intelligence services, or even bored teenagers.

The entire digital security model assumes talent is scarce. However, this has changed in just a month, and the question is no longer whether this will happen again but who will get there first. The U.S. frontier labs currently hold this valuable defensive asset, but this lead is rapidly diminishing. Software developers should consider the code that runs the world as critical infrastructure and run their best models continuously against it.

The government should be aware of every powerful open model released from anywhere within days, and companies should no longer treat the PHP emergency as an isolated incident, as this is the new normal.