The week has been tough for cybersecurity teams, and this is unlikely to improve in the short term. Anthropic, the company behind Claude AI, warns that the hardest part is yet to come.This is the prediction made by Jason Clinton, deputy head of information systems security, on X this Thursday, October 22.

The company’s second-in-charge of cybersecurity writes that however badly things may have gone over the past four days, they are going to “get worse before they get better” in the short term. Broadly speaking, he anticipates a difficult eighteen months, during which it will be necessary to hang in there.

“The situation is going to deteriorate considerably further before it improves”

Jason Clinton

“Even though the situation has already deteriorated sharply over the past few days, it is going to deteriorate considerably further before it improves. Security executives, never waste a crisis: contact your boards of directors without delay and ask them for help. Not for AI, but for the basics,” he wrote.

His forecast is understandable, especially in light of recent events. In the case of the malfunctioning refrigerators, according to an analysis by the French Agency for Information Systems Security, the hack was mainly made possible by “basic security shortcomings.” In plain terms, attackers took advantage of basic vulnerabilities.

Yet the development of artificial intelligence is going to act as a powerful accelerator, both for uncovering basic vulnerabilities and for finding previously unidentified vulnerabilities. Over the past few months, AI laboratories themselves have highlighted these capabilities.In April, Anthropic thus refused to make its Claude Mythos model public, citing precisely its ability to find software vulnerabilities.

And your digital life becomes serene

Bitdefender Premium Security is a European cybersecurity solution that automatically protects you against hackers and all web threats. Enjoy your online activities with complete peace of mind

Sponsored

Cybersecurity is on sale

We saw it partly over the past four days, with the PHP2Shell incident, the nickname given to the two critical vulnerabilities in PHP, the scripting language that powers WordPress and, according to Wiz, about 70% of websites. They were ultimately patched as a matter of urgency this Wednesday, October 21. They had been identified with the help of AI.

Cybersecurity company Wiz, acquired by Google, says in its technical write-up that the vulnerable code had been dormant in PHP for more than ten years. Turning it into a working attack required a chain of steps “at the limit of what human researchers could achieve,” and Google’s Gemini 4 Argon and OpenAI’s GPT-5.6 Sol models, combined with Wiz’s in-house Atlas tool, broke through that barrier.

OpenAI describes it as “one of the most consequential vulnerabilities in recent years,” discovered, according to the company, before the attackers, which would have given defenders time to respond. For her part, Raluca Ada Popa, head of Gemini security at Google DeepMind, highlights the role played by Gemini 4 Argon.

The origins and timing of the discovery of these flaws became the subject of controversy. Wiz was not the first to find them. Ryan Austin, a researcher at California security company Calif, identified the first flaws as early as August 1 with the help of GPT-5.6 Sol and reported them to PHP on August 11. Wiz says it made its own discovery on August 19 and reported it on August 24. There were therefore indeed two independent discoveries, giving rise to these competing claims.

Why 18 months?

But that may not be the main issue.

Jason Clinton did not come up with this timeline by chance.In June, in remarks reported by The Transcript, he estimated that it would take seven to ten months for open-weight models (whose parameters are published and that anyone can run locally) to reach this level in cybersecurity.

He then predicted “the most difficult period of [their] careers” for industry specialists, lasting around 18 months. And beyond that? When asked on X, he replied “vulnzero,” meaning zero vulnerabilities. In the long term, these capabilities would fit into small, inexpensive models that would help developers identify and fix flaws before code goes live.

It is impossible, of course, not to point out that this narrative also suits Anthropic, whose business model depends on selling access to increasingly powerful models and which has since April reserved its most powerful system, Claude Mythos, for a select few companies. The cybersecurity issue also entails economic stakes.

The concern also reaches people outside cybersecurity. John Milinovich, who develops AI features at Figma and who generally considers himself very optimistic about technology, published a long essay on October 22 titled “Black October,” which was viewed around one million times on X. His optimism, he writes, took a serious hit in the space of eighteen hours.

In it, he asserts that the query behind the PHP flaw was literally “find vulnerabilities in PHP.” This characterization, perhaps a little reductive, needs to be qualified.Calif, quoted by The Hacker News, explains that a good knowledge of the history of code mattered, and that current models do not simply start out on their own from obscure techniques dating back twenty years.

In any case, the recommendation urging people to update their systems and software as soon as patches are available will seem even more crucial in the short term. Applying these patches without delay does not require changing everything internally. This is precisely one of those foundations that Jason Clinton encourages people to prioritize funding.

Your favorite VPN is not the one you think Best VPN 2026: Numerama’s complete comparison Use our comparison tool to choose the best VPN

All the tech news at a glance

Add Numerama to your home screen and stay connected to the future!

Install Numerama