The AI Security Apocalypse Is Here
This week brought the news that PHP, the most used programming language on the web, has urgent security loopholes that AI can now easily discover and exploit. And this has been happening for a while, with AI-enabled breaches up 56% year over year. Ultimately, AI makes anyone a potential hacker if they choose to be one.
The PHP bugs also provided a frightening preview of how our species will behave during these times - badly. The security embargo on these exploits failed: Amazon detected an attempt four days before the disclosure and Cloudflare saw thousands of attempts in the hours leading up to the public announcement. If we can't rely on the security community's infrastructure, we're on our own.
So what can you do? The baseline is an industry-leading password manager like 1Password, with a minimum of two-factor authentication but ideally passkeys. You need to be fastidious about software updates across the board, on all devices used by your family and any servers you control.
If you run websites and apps, you should have your coding agents conduct regular security reviews and use alternative models to perform 'adversarial' reviews. I also recommend using a 'skill' like gstack's CSO review on a weekly basis to stay on top of potential risks. And if you're running an agent, you can also have it regularly check the news for hacking risks against your software stack.
The world's cybersecurity landscape is changing rapidly and it doesn't seem like anyone is coming to save us. Protection from AI is your own responsibility.
"I say your civilization, because as soon as we started thinking for you it really became our civilization" - Agent Smith, The Matrix (1999).