Internet faces security crisis as Anthropic chief warns it will ‘get a lot worse’

A senior security executive at Anthropic has warned that the internet could face a coming cyber crisis that leaves vital services exposed to hackers. 

Jason Clinton, the company’s deputy chief information security officer, said on X that newly discovered software flaws could emerge faster than operators can fix them, leaving critical infrastructure vulnerable to attack.

Clinton reiterated his earlier warning of a ‘vulnerability tsunami,’ urging operators to isolate critical systems from outside networks immediately to protect them from attack. 

He urged companies to strengthen basic defenses immediately, warning that recent cyber incidents were only the beginning.

‘As bad as things have gotten in the past 4 days, they are going to get a lot worse before they get better,’ Clinton wrote on X. ‘We need to hold on for ~18 months.’

His comments come amid mounting concerns over the security of websites, essential services and bank accounts as increasingly powerful AI tools expose weaknesses in existing defenses.

Government portals, hospital websites and school services went dark worldwide on Wednesday as operators scrambled to protect against two critical software flaws found in PHP, a programming language used to power up to 70 percent of the world’s websites.

A day later, major US banks reported third-party AI agents accessing customer accounts and making transactions.

Clinton reinforced his latest warning by sharing a post he originally published on August 20.

‘The vulnerability tsunami is coming in just a few months, and there won’t be enough time to patch critical infrastructure,’ he wrote.

‘Network isolation described below (air-gaps and data diodes!) needed now!’

He was urging operators to separate the computer systems behind essential services from outside networks, making them harder for hackers to reach.

His warning follows a scramble to secure websites against two critical flaws in PHP, a programming language widely used across the web. 

Websites and online services have been temporarily taken offline in several countries, including the Netherlands, Finland, France and Denmark, over fears of an attack.

The US National Security Agency (NSA) and FBI advised organizations using PHP to take affected systems offline if they could not immediately install security updates.

Major US websites and services, including Etsy, Wikipedia and NASA.gov, use PHP-based technology, illustrating the software’s reach across shopping, information and government services.

Cybersecurity agencies in Europe, Australia, Japan and Britain have also urged PHP users to update immediately or take affected websites offline until the fixes can be applied.

The flaws could allow hackers to take control of affected servers without needing a password or account. A successful attack could let criminals steal information stored on a server or turn a trusted website into a tool for launching attacks against its visitors.

On Thursday, Axios reported that some AI agents had attempted to take actions inside bank accounts that appeared to be independent of users’ instructions, citing people familiar with the matter.

Reuters separately reported that major US banks had been blocking third-party AI agents from accessing customer accounts and making transactions.

In some cases, customers had given the tools their login details, with banks typically flagging and blocking the transactions, an industry source told Reuters. 

The source cautioned that transactions could not be deemed unauthorized if customers had shared their credentials.

Morgan Stanley has blocked third-party agents from accessing its platforms, although a person familiar with the matter told Reuters it had not observed unauthorized or rogue AI agents.

JPMorgan Chase CEO Jamie Dimon also warned earlier this month about allowing outside agents into the bank’s systems.

‘We’re not going to allow just any outside agent to come in inside the company because that’s just too risky for clients and for JPMorgan,’ he said.