AI-discovered software flaws could trigger more global outages
Artificial intelligence could trigger a wave of website outages and cybersecurity emergencies as it uncovers software vulnerabilities faster than companies can fix them, according to industry experts.
Seven cybersecurity professionals interviewed by Reuters on October 23 warned that advances in AI were rapidly shortening the time between the discovery of security flaws and attempts to exploit them.
Research by Massachusetts-based cybersecurity company VulnCheck suggests that the number of software vulnerabilities discovered has doubled year on year, partly because of AI-assisted research.
Cloudflare chief executive Matthew Prince said he was aware of several additional critical vulnerabilities in widely used software that were already being addressed.
«I think we’re going to have a couple years where every single week it’s going to feel like the sky is falling,» Prince told Reuters.
His warning follows widespread disruptions beginning on October 21, when critical vulnerabilities in PHP, a programming language used by much of the internet, forced government agencies and businesses to temporarily take websites offline.
The same week also saw security flaws disclosed in Node.js and streaming platform Plex, alongside breaches involving AI gateway LiteLLM and software development platform Railway.
AI is giving hackers less time to exploit vulnerabilities
Traditionally, discovering software vulnerabilities and developing tools to exploit them required considerable technical expertise and could take weeks or months.
AI systems can now examine large amounts of code continuously, identifying weaknesses and potentially helping attackers develop exploits within hours.
Shane Fry, chief technology officer at RunSafe Security, said the biggest change was the speed at which vulnerabilities could be discovered and turned into working attacks.
For website operators, this means the window for testing and installing security updates is becoming significantly shorter.
However, experts disagree on whether the increase in discovered vulnerabilities will necessarily lead to more successful cyberattacks.
Daniel Stenberg, lead developer of the widely used curl software, argued that some AI-discovered vulnerabilities are technically complicated and difficult to exploit.
Ramy Rahman of cybersecurity company ArmorCode similarly cautioned that a growing number of disclosed flaws does not automatically translate into more successful breaches.
Evidence from the recent PHP incident illustrates that distinction.
Cloudflare, Amazon and cybersecurity company Hunt.io detected aggressive attempts to exploit the vulnerabilities. However, Hunt.io’s head of research, Esteban Borges, said that as of Thursday afternoon, the attackers his company tracked did not appear to have developed a functioning exploit.
Prince said Cloudflare had seen anecdotal evidence of successful compromises, although the scale remained unclear.
Despite the immediate risks, some experts believe AI-assisted vulnerability discovery could ultimately strengthen internet security by exposing weaknesses that might otherwise remain undetected for years.
