This week: SBI leaked data of thousands of customers. Hundreds of banks in South America were hit by coordinated cyber attacks. India’s Censor Board website broken into and data stolen. Quest Diagnostics, a large medical lab in the US, breached by hackers and data of thousands of patients stolen. Cloudflare CEO Mathew Prince said his company saw millions of attacks on websites within days using recently revealed critical PHP bugs.
News came in thick and fast from the world of cyber security last week. Not all of it was due to AI. eMudhra incident, for example, was a clear case of human stupidity. But a lot was AI. The biggest news, of course, was the PHP vulnerability. This is a technology that powers millions of websites in the world. Human researchers using AI tools found two PHP bugs so critical it made the secretive NSA tweet out a warning. It even made the office of the Japanese Prime Minister talk geek.
As harrowing as the week has been from the cyber security point of view, the consensus is this is just the beginning. AI tools like Fable and Astra, and now possibly Kimi 3.1 and DeepSeek Flash 4.1, are so good at finding software bugs that the world is turning into a whack-a-mole game between those who attack and those who defend. Given the pace at which AI can find bugs, write exploits and let hackers do strafe runs, it is not clear if defenders will prevail.
George Kurtz, CEO of cyber security firm Crowd Strike, called it the dawn of a new era. Highlighting how AI was changing the equation, he said, “You’ve got data breaches. You’ve got ransomware. You’ve got the ability to steal trade secrets. AI is democratising who can do this. We’re seeing many different adversary groups with very low skill, now able to conduct nation, state level attacks for, basically, the cost of tokens and a prompt.”
The implications are significant, even if at the moment people like us — the normies as nerds call us — continue to live in sunshine and bliss. But no delusions. The world is into a dangerous territory, the one where cyber security is going to be a headache so big there is a real risk of people giving up. As the week progressed, someone put the feeling into words on X. “The internet is over as we know it,” they said.
Or take the word of Mathew Prince, who tweeted a couple of days after the PHP fiasco when another critical bug was found in a key technology. “This one may be as bad or worse than the PHP ones. Get used to lots of patching,” he wrote on X after OpenAI announced that its AI had found a bug in Brotli, a library used in technologies like Bun and Node JS.
The problem with AI is that it speeds up the entire process of finding a bug, exploiting that bug, and the defences that can be put up against the exploit. Similar to how social media and WhatsApp did for misinformation around a decade ago. The speed is so great that it defies human ability to comprehend and control it.
Currently, cyber security is proactive. That means most bugs are found and fixed before they can be exploited at a scale. But AI turns it upside down. It forces humans into a defence because now bugs can be found fast and can be exploited faster. This is a dangerous place for humanity to be in because it strips away the certainty we take for granted in critical services and infrastructure. It makes the entire internet mushy and fills people who use it with doubts. It will have repercussions.
Leave a Reply