Anthropic’s deputy chief information security officer, Jason Clinton, warned Thursday that a surge in software vulnerabilities could overwhelm cybersecurity defenses in the coming months, increasing risks to critical infrastructure as artificial intelligence accelerates the discovery of security flaws.
Clinton warned of a coming “vulnerability tsunami” that could leave operators of essential services, including power and water facilities, struggling to identify and fix weaknesses before hackers exploit them.
He urged organizations to strengthen basic security measures, particularly by isolating sensitive computer networks from external access, to reduce the risk of cyberattacks.
“As bad as things have gotten in the past 4 days, they are going to get a lot worse before they get better,” Clinton wrote on X.
“Security leaders, never let a crisis go to waste: please go to your boards and ask for help right now. Not for AI, for the basics,” he added, warning that organizations would need to prepare for heightened cybersecurity risks over approximately the next 18 months.
His warning comes as security professionals increasingly face concerns that artificial intelligence could identify software weaknesses faster than companies and governments can patch them, potentially creating more opportunities for attackers to exploit vulnerable systems.
The risks were underscored Wednesday when developers of PHP, a widely used programming language that powers websites and online services, released emergency security updates to address two critical vulnerabilities.
Both flaws could allow attackers to execute malicious code on affected servers without authentication, and each received a severity score of 9.2 out of 10.
Developers urged organizations to install the updates immediately, highlighting the importance of rapid patching as newly identified vulnerabilities create pressure on security teams.
Clinton did not specify which recent incidents prompted his warning or indicate that they were connected to the PHP vulnerabilities.
Anthropic has previously reported using its artificial intelligence models to discover thousands of vulnerabilities in publicly available software, illustrating how the technology can accelerate the identification of security weaknesses.