Anthropic security chief issues grim cyberattack warning: ‘It’s going to get a lot worse’

Anthropic’s deputy chief information security officer, Jason D. Clinton, has warned that the global cybersecurity crisis could become significantly worse before new defences are ready. In a post on X on October 22, he said the past four days had been difficult, but warned that “they are going to get a lot worse before they get better”.

Clinton urged security leaders to use the crisis to secure funding for basic cyber defences rather than immediately seeking bigger budgets for artificial intelligence (AI). His warning comes as critical software vulnerabilities trigger emergency patches and millions of attempted cyber exploits.

Why Anthropic’s security chief is warning of worse cyberattacks

One major concern is the growing speed at which software weaknesses can be found and turned into working attacks.

Two critical vulnerabilities in PHP, a programming language used by a large proportion of websites, recently prompted urgent security warnings. Researchers have also reported using AI tools to help identify flaws and develop exploits, raising concerns that attackers could use similar capabilities to move faster.

The problem is not simply finding a vulnerability. Organisations must identify affected systems, test fixes and install patches before attackers take advantage of the weakness.

Clinton had warned about this risk in an August 21 post, describing a coming “vulnerability tsunami” and cautioning that critical infrastructure might not have enough time to patch every flaw.

Why he wants companies to fund basic cyber defences

Clinton’s immediate recommendation is for security teams to approach their company boards and seek urgent help. Crucially, he said they should ask for funding for cybersecurity fundamentals, not AI.

That means prioritising the measures organisations already need to keep systems secure: timely software updates, vulnerability management, access controls, network protection and plans to respond to breaches.

The advice reflects a difficult reality. Even as AI helps defenders identify weaknesses, companies still need the staff, processes and infrastructure to act on those findings. A vulnerability report offers little protection if a critical system remains exposed.

Clinton’s estimate is that the industry needs to “hold on for 18 months”. This is his forecast, not a confirmed timeline for when cyber threats will ease.

What is ‘vulnzero’ and how could AI change cybersecurity?

Clinton’s longer-term vision is what he calls “vulnzero” a future in which software vulnerabilities are detected and eliminated before code reaches production.

His argument is that AI scaling could make advanced cybersecurity capabilities available through smaller, cheaper models. Developers could then use these tools throughout the software development process to identify and fix security bugs at very low cost. If that happens, software could become much harder to attack. However, this remains a prediction, not an established outcome. It would depend on the reliability of the technology and how widely organisations adopt it. Clinton also faced criticism from people who argued that AI companies had helped create the very risks they now warn about. Responding to one such comment, he wrote: “Yes. It was always going to be this way. We tried to warn the world.” For businesses and ordinary users, the immediate lesson is clearer than the long-term forecast: AI may improve security, but it does not replace basic protection. Until better tools become widely available, keeping software updated and limiting access to critical systems remain essential.