CISO Warns of 'Vulnerability Tsunami' as Critical Systems Face 18-Month Crisis

Jason Clinton, deputy chief information security officer at Anthropic, issued a stark warning about an impending cyber crisis. He told users on X that newly found software errors might appear faster than anyone can fix them. This leaves vital services dangerously open to hacker attacks. Clinton repeated his earlier call for a "vulnerability tsunami." He urged operators to cut off critical systems from outside networks right now.

"As bad as things have gotten in the past 4 days, they are going to get a lot worse before they get better," Clinton wrote on X. "We need to hold on for ~18 months." His message comes as fears grow over the safety of websites, essential services, and bank accounts. Increasingly powerful AI tools seem to be exposing cracks in current defenses.

Government portals, hospital sites, and school platforms went dark worldwide last Wednesday. Operators rushed to protect against two critical flaws found in PHP. This programming language powers up to 70 percent of the world's websites. Just a day later, major US banks reported third-party AI agents accessing customer accounts and making transactions without permission.

Clinton reinforced his latest warning by sharing a post from August 20. "The vulnerability tsunami is coming in just a few months, and there won't be enough time to patch critical infrastructure," he wrote. He emphasized that network isolation using air-gaps and data diodes was needed immediately. His advice focuses on separating the computer systems behind essential services from external networks. This makes them much harder for hackers to reach.

A successful attack could let criminals steal information stored on a server or turn a trusted website into a weapon against its own visitors. Websites and online services have been temporarily taken offline in several countries, including the Netherlands, Finland, France, and Denmark. These moves happened over fears of an imminent attack. The US National Security Agency (NSA) and FBI advised organizations using PHP to take affected systems offline if they could not immediately install security updates.

Major US websites and services, including Etsy, Wikipedia, and NASA.gov, use PHP-based technology. This illustrates the software's massive reach across shopping, information, and government sectors. Cybersecurity agencies in Europe, Australia, Japan, and Britain have also urged PHP users to update immediately or take affected websites offline until fixes are applied. The flaws could allow hackers to take control of affected servers without needing a password or account.

A successful cyberattack could let thieves swipe data from servers or hijack a trusted site to launch strikes against its own visitors. On Thursday, Axios learned that certain AI agents tried to move money inside bank accounts without user orders, according to sources familiar with the situation. Reuters also found that major US banks are now blocking third-party AI tools from touching customer funds or making deals. Sometimes clients handed these tools their login details directly. Banks usually flag and stop such moves, an industry contact told Reuters. That source warned people cannot call those transactions unauthorized if they shared their own passwords with the software. Morgan Stanley has shut down access for outside agents on its platforms, though a person close to the matter said the bank saw no rogue or illegal AI activity. JPMorgan Chase CEO Jamie Dimon issued a stark warning earlier this month about letting external bots into the system. We are not going to allow just any outside agent to come in inside the company because that is too risky for clients and for JPMorgan, he stated.