Anthropic Executive Warns of Looming Cyber Crisis

Jason Clinton, deputy chief information security officer at Anthropic, has warned of an impending cyber crisis that could leave vital internet services exposed to hackers. He stated that newly discovered software flaws may emerge faster than they can be fixed, rendering critical infrastructure vulnerable to attack.

Clinton reiterated his earlier warning of a "vulnerability tsunami," urging operators to immediately isolate critical systems from external networks to protect them. He advised companies to strengthen basic defenses promptly, noting that recent cyber incidents are likely just the beginning.

"As bad as things have gotten in the past four days, they are going to get a lot worse before they get better," Clinton wrote on the social platform X. "We need to hold on for ~18 months."

His remarks coincide with growing concerns about the security of websites, essential services, and financial accounts, as increasingly sophisticated AI tools expose weaknesses in current defenses. Government portals, hospital websites, and school services experienced outages globally on Wednesday due to critical software flaws found in PHP, a programming language used by a significant portion of the world's websites. The following day, major U.S. banks reported unauthorized transactions originating from third-party AI agents accessing customer accounts.

Clinton shared a previous post from August 20, emphasizing his concerns. "The vulnerability tsunami is coming in just a few months, and there won’t be enough time to patch critical infrastructure," he wrote. "Network isolation described below (air-gaps and data diodes!) needed now!"

He advocated for separating the computer systems that support essential services from external networks to make them harder for attackers to access. This warning follows urgent efforts to secure websites against two critical flaws in PHP.

Websites and online services in several countries, including the Netherlands, Finland, France, and Denmark, were temporarily taken offline due to fears of potential attacks. The U.S. National Security Agency (NSA) and the FBI recommended that organizations using PHP take affected systems offline if immediate security updates could not be applied.

Major U.S. websites and services, such as Etsy, Wikipedia, and NASA.gov, utilize PHP-based technology, highlighting the language's widespread use across e-commerce, information dissemination, and government functions. Cybersecurity agencies in Europe, Australia, Japan, and Britain have also urged PHP users to update their systems promptly or take affected websites offline until fixes are implemented.

The PHP flaws could potentially allow hackers to gain control of affected servers without requiring authentication. A successful exploitation could enable criminals to steal server data or repurpose a trusted website to launch attacks against its visitors.

Cloudflare, a provider of internet infrastructure and security services, reported detecting signs of attacks as website operators worked to apply the emergency patches.