The cybersecurity situation has reached a dangerous point, and security leaders are being warned to prepare for more trouble. There have been several serious security problems recently, including emergency patches for two major PHP bugs and the compromise of eMudhra's digital certificate key. Jason D. Clinton, Anthropic's Deputy Chief Information Security Officer (CISO), has issued a serious warning to the technology industry.
Clinton shared his thoughts about recent cyberattacks on X, formerly known as Twitter. He warned that the current wave of security problems is only the start of a much bigger change.
"Things have gotten bad over the past four days, but they are going to get much worse before they get better," Clinton posted. "Security leaders, don't waste this crisis. Go to your boards and ask for help now. Not for AI, but for the basics. (We need to get through about 18 months.)"
Things have gotten bad over the past four days, but they are going to get much worse before they get better. Security leaders, don't waste this crisis. Go to your boards and ask for help now. Not for AI, but for the basics. (We need to get through about 18 months.) https://t.co/bcZp4heDtS
Clinton's warning is based on what he calls an approaching "vulnerability tsunami." As the most advanced AI models get better at finding and studying software weaknesses and creating ways to attack them, attackers may be able to use these weaknesses faster than organizations can fix them with software updates.
When sharing his earlier warnings again, Clinton stressed that organizations must act now to separate important computer systems from other networks instead of waiting for software fixes.
"The wave of software weaknesses is coming in just a few months, and there won't be enough time to update critical systems," he wrote. "We need network isolation now, including air gaps and data diodes!"
His warning comes as automated scanning tools and AI models are already making it much easier to find hidden weaknesses in open-source software and the systems that run the internet. Recent cases in which GPT models helped identify serious security flaws show that these tools can be used in two ways. They can help defenders check code for problems, but attackers can also use them to launch automated attacks before software fixes are ready.
The 18-Month Outlook: Reaching 'Vulnzero'
When people on X asked what would change in 18 months, Clinton described a future in which improvements in AI would shift the advantage permanently toward defenders.
"Vulnzero," Clinton explained. "The scaling laws will bring cyber Mythos-level abilities to small, cheap models. Software developers everywhere will use models costing tiny fractions of a penny to stop security bugs from being introduced, permanently."
Clinton believes the next 18 months could bring a difficult period of increasingly aggressive automated attacks. He expects the longer-term solution to be putting advanced AI security skills, like those shown in Claude's advanced problem-solving work, directly into the tools used to build software. Once small, affordable AI models can check software security in real time while code is being compiled, the industry could prevent entire types of software bugs before the code is put into use.
Back to Basics: Advice for Security Leaders
Although Clinton supports using AI to defend against cyberattacks in the future, his advice for security leaders right now is much simpler: focus on basic security practices.
Instead of rushing to adopt AI security tools that may not be ready during a crisis, security teams should use the attention from company boards to get funding for essential protections. Until AI models can reliably close the gap between creating software and finding and fixing its bugs, security leaders will need to get through this difficult period by relying on proven, dependable defenses.
