AI starts to tear the world apart
This week, SBI leaked data belonging to thousands of customers. Hundreds of banks in South America faced coordinated cyberattacks. Hackers broke into India's Censor Board website and stole data. In the US, hackers attacked Quest Diagnostics, a large medical testing company, and stole data belonging to thousands of patients. Cloudflare CEO Mathew Prince said his company had seen millions of attacks on websites within days. These attacks used serious PHP bugs that had recently been discovered.
Last week, cybersecurity news came quickly from all directions. AI was not responsible for every incident. The eMudhra incident, for example, was clearly caused by human stupidity. But AI played a role in many of the other events. The biggest news was the PHP security flaw. PHP is a technology used by millions of websites around the world. Human researchers using AI tools found two very serious PHP bugs. They were so serious that the secretive US National Security Agency (NSA) posted a warning on X. The discovery even prompted the office of the Japanese Prime Minister to discuss technical details.
Last week was frightening for cybersecurity, but many experts agree that this is only the beginning. AI tools such as Fable and Astra, and possibly now Kimi 3.1 and DeepSeek Flash 4.1, are very good at finding software bugs. This is turning cybersecurity into a game of whack-a-mole, with attackers finding new weaknesses while defenders try to fix them. AI can find bugs and write code to exploit them so quickly that attackers can repeatedly target systems. It is not clear whether defenders will be able to keep up.
George Kurtz, CEO of the cybersecurity company CrowdStrike, called this the beginning of a new era. In a discussion about how AI is changing the balance between attackers and defenders, he said, “You’ve got data breaches. You've got ransomware. You've got the ability to steal trade secrets. AI is democratising who can do this. We're seeing many different adversary groups with very low skill, now able to conduct nation, state level attacks for, basically, the cost of tokens and a prompt.”
The effects could be serious, even if people like us, whom tech experts sometimes call “normies,” are still going about our lives without worrying much. But we should not fool ourselves. The world is entering a dangerous period. Cybersecurity could become such a huge problem that people may eventually give up trying to keep systems safe. As the week went on, someone on X summed up the feeling by saying, “The internet is over as we know it.”
Mathew Prince made a similar warning. A couple of days after the PHP crisis, another serious bug was found in an important technology. “This one may be as bad or worse than the PHP ones. Get used to lots of patching,” he wrote on X. He was responding after OpenAI announced that its AI had found a bug in Brotli, a software library used by technologies such as Bun and Node.js.
The problem with AI is that it speeds up every part of the process: finding a bug, using it to attack a system, and building defences against that attack. Something similar happened about a decade ago, when social media and WhatsApp made it much easier for false information to spread. AI works so quickly that people struggle to understand and control what is happening.
For now, cybersecurity usually works by finding and fixing bugs before attackers can use them to cause widespread harm. But AI is turning this approach upside down. People are being pushed into a defensive position because AI can find bugs quickly and attackers can use them even faster. This puts humanity in a dangerous position because it weakens the sense of safety we expect from essential services and important infrastructure. It makes the internet feel less reliable and leaves people who use it with more doubts. There will be consequences.