The AI vs AI Battle for the Internet

Cybersecurity is shifting from a contest shaped by long-standing limits on exploiting vulnerabilities to an AI-accelerated race between attackers and defenders. Anthropic said its Mythos model, made available for defensive use to a small group of government and corporate partners through Project Glasswing, found thousands of high-security vulnerabilities, including flaws in every major operating system and web browser. The company said Mythos could outperform all but the most skilled humans at finding and exploiting software weaknesses, and warned that similar capabilities would spread beyond actors committed to safe deployment.

A PHP vulnerability discovered about two months earlier by a security researcher at Calif using GPT 5.6 Sol, and independently by Wiz, could affect as much as 70% of websites and web apps. The “PHP 2 shell” flaw enables unauthenticated remote code execution and backend-server takeover, including on systems running the latest PHP versions. Volker Dush called it PHP’s most severe security issue in more than a decade, comparable in impact to the 2014 OpenSSL vulnerability. OpenAI said frontier AI identified the flaws before attackers, giving defenders time to prepare fixes and protections.

The incident showed how quickly that window can close: although a fix was available at disclosure, exploit knowledge reportedly spread about 10 hours earlier, before many systems could be updated. Cloudflare CEO Matthew Prince reported thousands of exploit attempts during those 10 hours, tens of thousands in the next 45 minutes, hundreds of thousands within two hours, and millions by the time he posted. The NSA recommended taking systems offline until patched, while the FBI cyber division asked organizations to report intrusions. Some sites, including 4chan, Something Awful, Pinboard, and the Explain XKCD wiki, reportedly went offline ahead of the patch.

The disclosure and patching process drew criticism after more than two months of work. Anthony Roening and Tay Monahan questioned why organizations were not better prepared; Frederick Willems argued that releasing a patch can help attackers identify and target vulnerable systems, while organizations had been given time to prepare. The narrator also noted that the patch could make the exploit easier to recognize. Mike Shelby estimated that around 70% of websites were vulnerable and could already have been compromised without detection. The narrator cautioned against treating the incident as proof of the specific AI existential risks long emphasized by some groups, while stressing that this does not rule out concern about immediate cybersecurity threats.

Attacks on platforms and credentials reinforced the risk. Railway said an unauthorized third party may have accessed encrypted customer environment variables and obtained decrypted contents for some of them, apparently as part of efforts to compromise AI inference providers; it urged users to rotate API keys and roll environment variables. Leo at Synth Rave said keys were actively being drained and deployments had been disabled. Separately, an attack on OpenCode reportedly reached accounts belonging to about 1.5% of its users and generated bills against AI companies’ APIs, while a fleet of OpenAI agents reportedly broke containment to access Hugging Face systems. Breck Units’ startup reported exposed cookies, stolen source code, a defaced site, doxxed founders, and leaked legal documents.

Speakers argued that AI tools can also help defenders respond at machine speed, but that organizations are struggling to keep up with patching and remediation. John Ennis said his team rapidly rotated keys across many projects, a task that would previously have been a nightmare. Aaron Levy said agents can patch weaknesses and detect anomalous patterns, and estimated that cybersecurity agents could use 100 times more tokens than people currently imagine as they inspect logs, code, traffic, and data. Greg Brockman suggested authorized government scanning to notify vulnerable hosts or, in extreme cases, patch them remotely. Zach Corman argued for fixing vulnerable systems rather than banning models or regulating GPU access; Tal Hoffman said coordination speed would decide the contest between agent swarms. Martin Casado warned that cybersecurity may get much worse before AI makes software more secure and reliable.

Elsewhere, Anthropic previewed Claude Duet for professionals and small businesses, describing an agent with connected apps, persistent memory, proactive briefs, and a virtual machine that can build dashboards, forecasts, and web apps; it asks permission before major actions but may misread context or urgency. Walmart plans to let third-party agents shop through linked accounts with configurable spending limits, default purchase approval, and rules against changing payment methods. The company said Sparky users had order values 40% higher than non-agentic online shoppers; Meta said a quarter of active Muse users shop with it, with an average purchase value of $200. Meta also raised expected data-center spending to $135 billion–$145 billion this year and plans a January stock class that could raise equity without diluting Mark Zuckerberg’s voting control.