Jason Clinton, Anthropic’s deputy chief information security officer, warned on 22 October that a surge in software vulnerabilities could strain defences around critical infrastructure, Anadolu Agency reported. In a post on X, Clinton urged security leaders to seek help from their boards for basic protections rather than AI tools. His warning concerns systems that keep power and water services running.
Key points
- Clinton warned of a “vulnerability tsunami” and urged organisations to separate sensitive networks from outside access.
- He said organisations would need to withstand heightened cyber risk for approximately 18 months.
- PHP developers released emergency fixes on 21 October for two critical flaws, each rated 9.2 out of 10.
Clinton urges board help for basic protections
“As bad as things have gotten in the past 4 days, they are going to get a lot worse before they get better,” Clinton wrote on X. He called the prospect a “vulnerability tsunami” and warned that operators of essential systems, including power and water facilities, could struggle to fix flaws quickly enough.
His request to security leaders was direct: “please go to your boards and ask for help right now. Not for AI, for the basics”. He urged organisations to isolate sensitive computer networks from external access, making them harder for attackers to reach.
Clinton said organisations would have to endure heightened cybersecurity risks for approximately 18 months. He did not identify the incidents behind his reference to the preceding four days or suggest they were connected, Anadolu Agency reported.
PHP developers issue two emergency fixes
On 21 October, developers of PHP, a programming language widely used for websites and online services, released emergency updates for two critical vulnerabilities. Each received a severity score of 9.2 out of 10. The flaws could allow an attacker to run malicious code on an affected server without login credentials, and the developers urged organisations to install the updates immediately.
Anthropic has also reported using its AI models to find thousands of vulnerabilities in publicly available software. Clinton’s appeal puts the operational problem beside that discovery work: organisations need ways to protect systems while flaws are found and repaired.
Anthropic’s Cyber Mission targets power and water
Anthropic launched its Cyber Mission, including a Critical Infrastructure Defense Program that pairs Claude models and on-site engineers with work on industrial operational technology, Industrial Cyber reported. That technology supports power grids, water systems, factories and transport networks. AI Affairs reported the programme’s launch with 11 partners and a free scanner.
Anthropic said several partners were already working with Claude to address vulnerabilities and help customers fix them. The company also said that finding flaws had become easier than verifying, prioritising and repairing them, and that vulnerabilities identified through its earlier Project Glasswing work sometimes remained unresolved for months.
The Cyber Mission includes OSS Scanner, which Anthropic says offers enrolled open-source projects periodic scans at no charge. Its model-generated reports include an example of how a flaw could be exploited and, where available, a suggested fix. Anthropic says the reports reach maintainers without human review and that some may contain errors, including incorrect severity ratings.
.jpg){kind=link}