Does something you don’t know exists still exist? The answer is obviously yes. This basic truth is worth keeping in mind in the coming months — and maybe years — as artificial intelligence reveals hair-raising vulnerabilities in the software running the internet and critical infrastructure.
Banks, airlines and government agencies from Japan to Finland scrambled to protect their systems in recent days after AI uncovered two critical vulnerabilities in PHP, a programming language that powers a huge portion of the web. Some entities temporarily shut down online services as a precaution. Hackers were already trying to exploit the flaws, with the cybersecurity company Cloudflare reporting millions of attempts.
Other serious software vulnerabilities emerged around the same time, and more are being discovered with each passing day. The rate of disclosure has skyrocketed. According to Google’s Threat Intelligence Group, the number of software vulnerabilities publicly disclosed each month has more than doubled, from 5,045 in January to 10,740 in August. A separate tracker, using a different tally, records 13,542 vulnerabilities published in just the first 24 days of October, with 16,800 projected for the full month.
The PHP vulnerability hammers home an important point. One of the two flaws was discovered in 2024 by human cybersecurity investigators. They struggled, however, to imagine how it could be exploited by attackers and how to patch it. So the vulnerability remained unfixed. Then, in August, cybersecurity researchers working with OpenAI’s Patch the Planet program used its GPT-5.6 Sol model to demonstrate just how dangerous the flaw was. The discovery prompted an urgent effort by PHP’s developers, assisted by outside researchers using AI, to devise and distribute a fix.
As flaws in software are discovered at an increasing pace, the temptation is to blame AI. After all, before the arrival of advanced models, we didn’t have to worry about these bugs. Worse, there is a temptation to believe the threat comes from open-weight models, freely available tools that admittedly are gaining much of the cyber capability of more locked down frontier solutions.
But blaming AI turns reality on its head. The internet as we know it is a rickety, leaky system cobbled together over decades by programmers of uneven skill. It’s a vast network of pipes held together by duct tape. That network has until now been shrouded in relative darkness, and most of us have not bothered to look very closely.
AI is like a very powerful flashlight that has allowed everyone to better see the internet’s problems and either exploit them or fix them. When the public is scared, the natural impulse of government is to lock up the flashlight. That’s the wrong answer because attackers don’t need Washington’s permission to keep searching for exploits.
Cybersecurity is a race between good guys and bad guys to find weaknesses as quickly as possible. Free markets are good at winning races. A vulnerability creates an incentive to find a patch. A better attack creates demand for a better defense. Competition among researchers and technology companies spreads new capabilities rather than concentrating them.
Open-weight models have been a boon for defenders. When Hugging Face investigated how OpenAI-powered agents penetrated its systems, proprietary models refused some of the forensic work, but the Chinese open-weight model GLM-5.2 helped reconstruct the intrusion. A newer version, GLM-5.3, has also helped researchers discover previously unknown vulnerabilities in a popular web browser.
As AI discovers vulnerabilities at machine speed, fixing them will increasingly need to happen at machine speed, too. But not every company, institution or country can afford access to the most powerful proprietary models. Open-weight alternatives give those with fewer resources a fighting chance to keep up.
A foundational principle of the cybersecurity community is that security by obscurity is no security at all. Paradoxically, up until now, the scale and complexity of the internet helped conceal its countless vulnerabilities from attackers and defenders alike. The emergence of AI, by revealing flaws, has created an imperative to fix them.
The post The best defense against bad AI is more good AI appeared first on Washington Post.
