A senior security leader at Anthropic has warned that the internet may be heading toward a cyber crisis in which hackers could exploit weaknesses across vital services.
Jason Clinton, Anthropic’s deputy chief information security officer, said on X that new software vulnerabilities could be discovered more quickly than operators are able to repair them, potentially leaving critical infrastructure exposed.
Clinton repeated his earlier prediction of a “vulnerability tsunami” and called on operators to immediately isolate essential systems from external networks to reduce the risk of attack.
He also urged businesses to reinforce fundamental cybersecurity protections, warning that the recent wave of incidents may be only an early sign of what is to come.
“As bad as things have gotten in the past 4 days, they are going to get a lot worse before they get better,” Clinton wrote on X. “We need to hold on for ~18 months.”
His warning comes as concern grows over the security of websites, public services and bank accounts, with increasingly capable artificial intelligence tools testing the limits of existing defenses.
Government portals, hospital websites and school services went offline around the world on Wednesday as operators worked to defend against two critical flaws in PHP, the programming language used to power as many as 70 percent of websites globally.
The following day, several major US banks said third-party AI agents had accessed customer accounts and carried out transactions.
A senior Anthropic security executive has warned that a looming cyber crisis could leave essential internet services vulnerable to hackers
Clinton underscored his latest comments by reposting a warning he originally shared on August 20.
“The vulnerability tsunami is coming in just a few months, and there won’t be enough time to patch critical infrastructure,” he wrote.
“Network isolation described below (air-gaps and data diodes!) needed now!”
His recommendation was for operators to disconnect the computer systems supporting essential services from external networks, making it more difficult for attackers to access them.
The warning follows an international effort to protect websites from two serious security flaws discovered in PHP, one of the web’s most widely used programming languages.
MUST READ: Eerie Catalina Island UFO Sightings Revealed in White House Documents
Online services and websites were temporarily taken offline in countries including the Netherlands, Finland, France and Denmark amid fears that attackers could exploit the vulnerabilities.
The US National Security Agency and FBI advised organizations running PHP to take vulnerable systems offline if security updates could not be installed immediately.
The reach of PHP is illustrated by its use across major US websites and services, including Etsy, Wikipedia and NASA.gov, spanning online shopping, information and government operations.
A successful attack could allow criminals to steal data from a server or misuse a trusted website to attack its visitors
Cybersecurity authorities in Europe, Australia, Japan and Britain have likewise told PHP users to apply the fixes immediately or take affected websites offline until they can be updated.
The vulnerabilities could enable hackers to seize control of affected servers without a password or user account. If exploited, they could be used to steal information held on a server or convert a legitimate website into a platform for attacks against its visitors.
Cloudflare, which provides internet infrastructure and security services, reported signs of attacks as website operators raced to install the emergency fixes.
On Thursday, Axios reported that some AI agents had attempted to take actions inside bank accounts that appeared to be independent of users’ instructions, citing people familiar with the matter.
Reuters separately reported that major US banks had been blocking third-party AI agents from accessing customer accounts and making transactions.
In some cases, customers had given the tools their login details, with banks typically flagging and blocking the transactions, an industry source told Reuters.
The source cautioned that transactions could not be deemed unauthorized if customers had shared their credentials.
Morgan Stanley has blocked third-party agents from accessing its platforms, although a person familiar with the matter told Reuters it had not observed unauthorized or rogue AI agents.
JPMorgan Chase CEO Jamie Dimon also warned earlier this month about allowing outside agents into the bank’s systems.
‘We’re not going to allow just any outside agent to come in inside the company because that’s just too risky for clients and for JPMorgan,’ he said.
