New Delhi: Jason D. Clinton, Deputy Chief Information Security Officer (CISO) at artificial intelligence company Anthropic, has warned that the global cybersecurity situation could deteriorate further before meaningful improvements arrive. He has urged companies to strengthen fundamental security measures, warning that organisations may need to withstand an increasingly difficult threat environment for approximately 18 months.

In a post on X on October 22, Clinton said the situation had already become serious and could get considerably worse before it improved. His warning comes amid growing concerns that artificial intelligence tools are making it easier to discover software vulnerabilities and potentially exploit them at a speed that traditional security teams may struggle to match.

Clinton’s warning is not a formal prediction that every organisation will face an attack over the next 18 months. Rather, it reflects his assessment of the transition underway as AI-powered cyber capabilities become more accessible to both attackers and defenders.

Why the cybersecurity situation is causing concern

The warning follows a series of significant cybersecurity developments reported during October. These include critical vulnerabilities in PHP, concerns involving cryptographic keys used in digital certificate infrastructure, spyware threats and major data-security incidents.

PHP is a widely used programming language that powers websites and online services. Critical flaws in software can give attackers opportunities to execute malicious code, compromise systems or gain access to sensitive information if affected systems remain unpatched.

The recent PHP vulnerabilities have prompted urgent attention because they could allow unauthenticated remote code execution on vulnerable servers. Developers released security updates, while security authorities urged organisations to update affected systems promptly. The episode has highlighted the difficulties organisations face when vulnerabilities affect widely deployed software.

However, the incidents should not automatically be treated as a single coordinated campaign. Clinton’s warning addressed the broader deterioration in the cyber threat environment, and he did not publicly identify every incident that prompted his remarks or establish that the events were connected.

AI could give attackers an advantage

One of the main concerns is the growing ability of AI systems to identify weaknesses in software. Tasks that previously required substantial specialist knowledge and considerable time can increasingly be assisted by models capable of analysing code, finding potential flaws and helping security researchers investigate them.

For defenders, these capabilities could be valuable. Security teams can use AI-assisted tools to review large codebases, identify weaknesses, prioritise fixes and improve testing. But the same underlying capabilities can also be misused by malicious actors.

Attackers may use AI to identify vulnerable systems, develop exploitation techniques and automate parts of an attack. If they can find and exploit weaknesses faster than software developers and system administrators can respond, the time available to prevent damage becomes shorter.

Legacy systems present a particular challenge. Some organisations operate software that is difficult to update, while others rely on complex networks of third-party products and services. Even when a patch is available, testing and deploying it across a large infrastructure can take time.

This creates a race between discovering vulnerabilities and fixing them. Clinton’s concern is that the balance could temporarily shift in favour of attackers as AI tools become more capable and widely available.

What does ‘vulnzero’ mean?

Clinton has also described a future concept he calls “vulnzero”, referring to the ambition of preventing software vulnerabilities from reaching production systems in the first place.

His expectation is that advances in AI will eventually make sophisticated security analysis available through smaller, cheaper models. Developers could then use these tools throughout the software development process to detect and eliminate security flaws before applications are released.

If such capabilities become affordable and are integrated into routine development workflows, organisations may be able to identify defects much earlier than they can today. This could reduce the number of exploitable weaknesses entering production environments and lower the cost of maintaining secure software.

The approach would shift cybersecurity from primarily responding to discovered vulnerabilities towards preventing them during development.

However, “vulnzero” remains a forward-looking vision rather than an established outcome. AI tools can produce incorrect findings, miss weaknesses and require human oversight. Secure development also depends on sound architecture, access controls, testing, maintenance and effective incident response.

Clinton’s estimate of roughly 18 months should therefore be understood as his forecast for a difficult transition, not a verified date by which universal vulnerability prevention will become available.

Clinton urges companies to fund basic security

Despite working at an AI company, Clinton’s immediate recommendation was not for businesses to rush into buying advanced AI security products. Instead, he urged security leaders to approach their boards and request support for essential cybersecurity measures.

The recommendation reflects a practical concern: new technology cannot compensate for weaknesses in basic security practices. Organisations still need reliable patch management, strong authentication, network monitoring, tested backups and clear procedures for responding to incidents.

Companies should prioritise the following measures:

  • Patch critical vulnerabilities: Maintain an inventory of software and apply verified security updates quickly, prioritising internet-facing systems.
  • Strengthen access controls: Use multi-factor authentication, restrict administrator privileges and remove unnecessary accounts.
  • Improve network separation: Limit the movement of attackers between systems by segmenting networks and isolating critical infrastructure where appropriate.
  • Monitor suspicious activity: Ensure security teams can identify unusual access, unexpected changes and potential exploitation attempts.
  • Test backups and recovery plans: Keep protected backups and verify that systems can be restored after a serious incident.
  • Review third-party exposure: Track security advisories affecting suppliers, software libraries and external services used by the organisation.

These measures cannot eliminate every risk, but they can reduce the likelihood that a single vulnerability will lead to a wider compromise.

AI companies face questions over responsibility

Clinton’s remarks also prompted criticism on social media, with some users arguing that AI companies are helping accelerate the very threats they now warn about. Critics questioned whether technology developers should bear greater responsibility for ensuring that defensive capabilities keep pace with increasingly powerful models.

Clinton responded to one criticism by acknowledging the concern and saying that the industry had tried to warn the world about the coming challenges.

The debate reflects a wider question facing the technology sector: how should AI developers balance innovation with the risk that their systems could make sophisticated cyberattacks more accessible?

AI can strengthen defensive security, but the benefits will depend on how responsibly the technology is developed, deployed and used. Organisations will also need trained personnel and effective processes to act on what AI tools discover.

The next 18 months could be a critical period

Clinton’s warning is a reminder that organisations cannot afford to wait for future AI-powered security tools before improving their existing defences. The same technological progress that helps developers find flaws may also enable attackers to discover weaknesses in widely used software.

His 18-month estimate is uncertain, and the cybersecurity landscape will depend on how quickly companies patch systems, improve security practices and deploy effective defensive technology. For businesses, governments and critical infrastructure operators, the immediate priority is clear: strengthen essential protections now while preparing for a more demanding era of AI-assisted cyber threats.