'Vulnerability tsunami' is coming, Anthropic security chief warns
What's happening
Jason D. Clinton, the Deputy Chief Information Security Officer (CISO) at Anthropic, has warned that the technology industry is heading toward a serious crisis. In a post on X (formerly Twitter), Clinton said, "As bad as things have gotten in the past 4 days, they are going to get a lot worse before they get better." His warning comes after several major cyberattacks around the world this month.
Current crisis
Cyberattacks around the world have increased in October
October has brought a steady stream of serious cyberattacks and other online security problems.
Cybersecurity experts have been working day and night to stop millions of attempts to take advantage of a serious security flaw in PHP code used around the world.
At the same time, attackers have been using online advertisements to spread zero-click spyware, which can infect devices without users clicking anything. There have also been huge data breaches, where private information has been exposed or stolen.
What security leaders should do
Use the current fear to get support for better security
Clinton gave a similar warning in August. He predicted that a "vulnerability tsunami," meaning a huge wave of software security problems, would arrive within just a few months.
Now that the problems he warned about are happening, Clinton is telling cybersecurity leaders to use the current fear and concern to help improve security.
But he is not telling them to ask for large budgets for advanced AI security tools. Instead, he wants them to get money for basic cybersecurity protections.
Looking ahead
Clinton's 'vulnzero' idea: Software with no security flaws
When asked what changes he expects after this 18-month period, Clinton described his idea of "vulnzero," which means having zero security flaws.
He believes that as AI technology improves, powerful AI tools for cybersecurity will become small and cheap enough to run as simple models. This follows what are known as AI scaling laws, which describe how AI abilities change as the technology develops.
Once AI reaches that point, software developers around the world should be able to use these tools at very low cost. The tools could help them find and permanently fix security problems before their software is released for people to use.
Hackers' current advantage
Hackers are already using AI to take advantage of security flaws
Until technology that can check software for security problems becomes widely available and part of the normal software development process, people who carry out cyberattacks will have a temporary but very dangerous advantage.
Hackers are already using existing AI models to find old security flaws, automate attacks, and use those flaws to break into systems. They can do this much faster than human security teams can fix the problems.
This gives hackers an advantage in the continuing fight between cyberattackers and the people trying to stop them.