'Vulnerability tsunami' is coming, Anthropic security chief warns
What's the story
Jason D. Clinton, the Deputy Chief Information Security Officer (CISO) at Anthropic, has warned that the tech industry is headed for a major crisis. In a post on X (formerly Twitter), he said, "As bad as things have gotten in the past 4 days, they are going to get a lot worse before they get better," attributed to Jason D. Clinton. His warning comes after a series of global cyberattacks this month.
Current crisis
October has seen a spike in global cyberattacks
The month of October has seen an unrelenting wave of major cyber incidents.
The cybersecurity community has been working around the clock to fend off millions of attempts to exploit a critical PHP code vulnerability worldwide.
This comes on top of the weaponization of zero-click spyware via online advertisements and massive data breaches.
Strategic response
Use the current state of panic to your advantage
Clinton had issued a similar warning back in August, predicting a "vulnerability tsunami" would hit in just a few months.
Now that his prediction has come true, he is advising security leaders to use the current state of panic to their advantage.
However, instead of asking for advanced AI defense budgets, he is urging them to focus on securing funding for basic cybersecurity measures.
Future outlook
'Vulnzero' vision: A world with zero vulnerabilities
When asked about the changes expected after this 18-month period, Clinton shared his vision of "vulnzero" (zero vulnerabilities).
He believes AI scaling laws will soon shrink advanced cyber capabilities into small, cheap models.
Once we cross that threshold, software developers worldwide will be able to use these AI tools at minimal costs to identify and permanently fix security bugs before they even reach production.
Current advantage
Hackers are using existing AI models to exploit vulnerabilities
Until this verification technology becomes widely available and integrated into standard development pipelines, malicious actors have a temporary but devastating advantage.
Hackers are currently using existing AI models to quickly find, automate, and exploit legacy bugs much faster than human defenders can patch them.
This gives them an edge in the ongoing cybersecurity battle.