21 advisory . Not patch carefully. Not watch for suspicious activity.
The National Security Agency told organizations that if they couldn’t fix their websites immediately, they should take them offline. Pull the plug, according to the NSA’s Oct.
When an open model can do what OpenAI’s did here, there will be no disclosure report, no August-to-October runway, no fix released by the PHP Foundation. The flaws were in PHP, the programming language behind most of the world’s websites, and they would let anyone run commands on a server without a password. Germany, France, Belgium, the Netherlands, Finland and the Czech Republic temporarily took down some government sites. That swiftly closing gap is thanks in large part to China. DeepSeek, Alibaba’s Qwen and a growing field of Chinese labs are shipping powerful open models that are among the most downloaded in the world. Each release is free and a little more capable than the last. And each can be run without permission by anyone anywhere. There will just be someone pointing a model at the internet and asking it what it can break. Finding a bug like this used to take a rare kind of mind and months of work. Soon it will take a prompt. Pick a target and press go. Vulnerability discovery is going from thinking to clicking. The barrier to entry is collapsing, and whoever wants to click, will. That could be a criminal crew, a foreign intelligence service or a bored teenager.
That held for 30 years—until last month. Every time a powerful open model is released from anywhere, our government should know within days what it can break. Because few people could find the bug in the meantime, software makers could spend weeks working on a fix. Because attackers needed time to catch up, companies could patch on a monthly schedule. Because they bet no one else could find or exploit it, organizations could tolerate a vulnerability in their architecture. Because it is, we should treat the code the world runs on as critical infrastructure,.
The frontier AI labs aren’t the only ones in this game. Open-weight models, which anyone can download and run on his own hardware and strip of their safety controls, trail the closed frontier by mere months. The gap is closing fast. Open models have real virtues; defenders against cyberattacks use them too. But a defender has to find every flaw. An attacker needs to exploit only one. This reality is racing toward us, and the world we built isn’t ready for it. Our entire model of digital security assumes that finding a catastrophic flaw is hard, and that the few people who can do so are known and mostly on our side. Every one of those bets assumed talent was scarce. The question isn’t whether this will happen again. It is who gets there first. That lead is the most valuable defensive asset we have, and it is shrinking. Every major lab should be running its best models against that code continuously. Washington and its allies should pay for this effort. And every company running a website should stop treating the PHP emergency as a one-off. It is what normal looks like now. This time, the warning came from the NSA and a prime minister. Next time, it may come not from a government but the attackers who got there first. Mr. Goldstein directs the Wicked Problems Lab at Vanderbilt University’s Institute of National Security.
Today, that is still America’s frontier labs.
It won’t be the last. They were reported quietly in August to PHP’s maintainers, who spent two months working with OpenAI and outside security researchers on a fix before releasing it publicly. How serious was it? The prime minister of Japan went on X.com to tell her country to get ready to patch. I have spent two decades in this business, including at the Pentagon and now at Vanderbilt University, where my lab specializes in cybersecurity. I have never seen a head of government issue a patch notice like this. Here is what should worry you: This was pretty much the best-case scenario. The flaws were found with the help of artificial-intelligence models, including OpenAI’s, and handled the way we would want. That is luck, not a system. Even this time, Amazon spotted someone trying to exploit the flaws four days before they were made public. Within days, attackers were using them to break into systems in the U.S., Japan, Taiwan and South Korea.
OpenAI says that, to its knowledge, AI found these flaws before attackers did.
