Must read: BT BIG STORY: What happens when the keys to internet security are no longer secret
as bad as things have gotten in the past 4 days, they are going to get a lot worse before they get better. security leaders, never let a crisis go to waste: please go to your boards and ask for help right now. not for ai, for the basics. (we need to hold on for ~18 months.)
— Jason D. Clinton 🔸 (@JasonDClinton) October 22, 2026
“Security leaders, never let a crisis go to waste: please go to your boards and ask for help right now. Not for AI, for the basics.”
He wrote the post, highlighting his post from August, in which he said: “The vulnerability tsunami is coming in just a few months, and there won’t be enough time to patch critical infrastructure.” The massive wave of cyber threats that Clinton warned about has now arrived. Now, it's time for companies and security leaders to push for stronger cybersecurity measures.
He further urged the tech industry to “hold on for ~18 months.” Furthermore, in a reply to an X user, Clinton highlighted a term “vulnzero,” which is used for zero vulnerabilities. He predicts that as AI capabilities are rapidly expanding, advanced AI security tools will soon become cheaper. With such tools, developers could identify vulnerabilities and fix them before the code goes live in production. This could make software more secure from the outset.
Must read: eMudhra, PHP security scare: Govt to hold high-level review, audit to assess potential damage
However, until these advanced security tools are widely used in everyday software development, attackers can exploit existing AI capabilities to discover weaknesses in older software, automate the process of finding security bugs, exploit known vulnerabilities faster than human security teams, and exploit systems before developers have time to release patches.
The forecast sparked a wave of criticism, with many arguing that AI companies were making cyber threats worse before defences are in place.