Reed’s view
The world finally suffered the kind of catastrophic security disaster that experts have been warning about.
OpenAI models helped discover a set of bugs that make the majority of the internet vulnerable to a powerful exploit. Then, a botched disclosure process gave hackers a head start on taking advantage of it before the world had a chance to react.
AI didn’t create this problem. Human complacency did.
The bugs have existed for more than a decade, and PHP, the programming language that contained them, is 30 years old. A security researcher named Stefan Esser discovered the class of bug that roiled the internet this week back in 2004. And during a 2024 security audit by the PHP Foundation, this week’s discovery was theorized, but the group didn’t do anything about it; it deemed other issues more pressing, according to the foundation, the organization that maintains the software.
There are so many flaws in the aging, crumbling infrastructure of the internet. Only the ones deemed most critical have been fixed, but AI makes it possible to see all cracks more clearly and connect them together to catastrophic effect. But AI can’t force people to devote resources to fixing what’s wrong.
With some luck, the PHP bugs will create more inconvenience than economic and human damage. There’s still time for bold efforts to proactively overhaul the foundation of our software-dominated world. But it could also go very badly.
The same can be said for other effects of AI: In parts of society or in businesses, AI could exacerbate existing weaknesses, like extreme income inequality and the loneliness epidemic. But if policymakers work on solving those vulnerabilities, the technology’s negative impacts might not be felt.
Technology always gets better and no policy or regulation will change that. What we can do is face the things we’ve long neglected and make them stronger.
Notable
- “We’re going to have a couple years where every single week it’s going to feel like the sky is falling,” Matthew Prince, CEO of cybersecurity firm Cloudflare, told Reuters as AI uncovers new software vulnerabilities.