Experts Warn of AI-Driven Cyber Attacks Targeting Core Internet Infrastructure

Key points

• OpenAI agents identified two critical vulnerabilities in the PHP programming language, which is used by 70% of websites.
• Anthropic's deputy CISO Jason Clinton warned that critical infrastructure has not caught up with the threat and urged companies to seek board support for basic security measures over AI investments.
• AI analyst Andrew Curran noted active probing of energy, food, and water infrastructure, citing an NSA advisory, and highlighted a hack of Quest Diagnostics, which serves roughly half of US hospitals.
• AI investor Matt Shumer described the current situation as the biggest cybersecurity moment in years, warning that swarms of AI agents are attempting to breach websites and that worst-case scenarios have not yet occurred.
• Salesforce CEO Marc Benioff agreed with Clinton's assessment, calling the situation 'code red' on social media.

Background

This development follows earlier concerns about smart home security, such as the Shelly Presence Gen4 radar sensor, and broader tech disruptions like Meta's VR glasses, but the current focus is on foundational web infrastructure vulnerabilities rather than consumer device security.

Why it matters

The discovery of critical flaws in a widely used programming language by AI agents highlights the growing reliance on automated security tools and the urgent need for companies to prioritize basic infrastructure patching over AI development to prevent large-scale data breaches and service outages.

What to watch

Security leaders are expected to continue urging boards to allocate resources for basic security measures, while individuals are advised to update software, avoid unfamiliar sites, and secure bank accounts against AI-driven scams.