Anthropic's deputy chief information security officer has warned that a 'vulnerability tsunami' is approaching, urging operators to isolate critical systems from outside networks to protect them from attack.
Jason Clinton said on X that recent cyber incidents were only the beginning and that the situation is set to worsen. He wrote: "As bad as things have gotten in the past 4 days, they are going to get a lot worse before they get better. We need to hold on for 18 months."
Global Outages Linked to PHP Flaw
The warning came in the same week that 70% of the world's websites went down. Government hubs, hospital portals and schools around the world were affected on Wednesday after a flaw was found in PHP, a programming language. A day later, major US banks reported third-party AI agents accessing customer accounts and making transactions.
Clinton continued: "The vulnerability tsunami is coming in just a few months, and there won't be enough time to patch critical infrastructure. Network isolation described below (air-gaps and data diodes!) needed now."
Authorities Urge Immediate Action
Websites and online services were temporarily taken offline in several countries, including the Netherlands, Finland, France and Denmark, amid growing fears about online safety. In response, the US National Security Agency (NSA) and FBI advised organisations using PHP to take affected systems offline if they could not immediately install security updates.
Major websites and services, including Etsy, Wikipedia and NASA.gov, use PHP-based technology, illustrating the software's reach across shopping, information and government services. Cybersecurity agencies in Europe, Australia, Japan and Britain have also urged PHP users to update immediately or take affected websites offline until fixes can be applied.
Banks Respond to AI Agent Threats
Morgan Stanley has since blocked third-party agents from accessing its platforms, although a person familiar with the matter told Reuters it had not observed unauthorised or rogue AI agents. JPMorgan Chase CEO Jamie Dimon also warned earlier this month about allowing outside agents into the bank's systems, saying: "We're not going to allow just any outside agent to come in inside the company because that's just too risky for clients and for JPMorgan."
