As artificial intelligence (AI) uncovers software security flaws far faster than humans can, Silicon Valley is scrambling to respond. Alarm is mounting that vulnerabilities must be patched before AI is turned into a hacking tool.
The trigger for the current crisis was AI’s discovery of a string of security flaws in PHP, a server programming language used by a large share of websites worldwide. The New York Times reported on the 28th (local time) that Silicon Valley is struggling amid a sudden “flood of vulnerabilities,” noting that AI is so adept at finding flaws that companies are racing to fix them before hackers can exploit them.
In an interview with the newspaper, Cloudflare CEO Matthew Prince said, “For the past two months, the security industry has lived in absolute terror that someone would find these bugs before we could finish the fixes,” adding, “For the next two years, we’re going to live in a world where a major vulnerability can be discovered any given week.”
The scale of the flaws AI has surfaced is evident in the patch numbers each company has disclosed.
CompanyDetection/patch volumeComparisonMicrosoft (MS)1,461 patches in October aloneExceeds 1,247 for all of 2025Google Chrome1,072 bugs fixed since JuneExceeds fixes in the prior two yearsGoogle ChromeCritical vulnerabilities in the past three monthsExceeds the prior eight years combinedOpenAIMore than 1,300 flaws since MayTargeting open-source softwareNode.js50 vulnerabilities identified and fixed this yearMost ever
Note: Compiled from patch and fix figures disclosed by each company
Fouad Martin, OpenAI’s head of cybersecurity, spent his birthday on the 21st getting only two hours of sleep as he worked to fix two critical vulnerabilities that could affect the internet at large. “AI is opening Pandora’s box of security vulnerabilities,” he said. “The ultimate goal is to inspect and fix as much of the world’s software as possible.”
Speed isn’t AI’s only strength. Analyzing code without rest, it connects small flaws scattered across different places to trace serious attack paths. In effect, AI is rapidly replacing the vulnerability-detection work that human experts once did by hand. Matteo Collina, who maintains the open-source development tool Node.js used by the likes of Netflix and Uber, warned, “This is just the beginning, and things will get 10 times worse.” He said he works all week to handle the backlog and runs AI agents at night.
The security industry sees this as more than a one-off. The Wall Street Journal reported on October 23 that while the security industry has faced a serious software security problem roughly once a decade, this is the first time such an event has occurred since AI’s spread, and that hackers will use AI tools to carry out intrusions that are faster and harder to trace than before.
The impact is concentrated in Big Tech’s engineering organizations. With the speed of creating and distributing patches now competing against the speed at which attackers exploit flaws, securing engineering talent and automation tools has emerged as a key variable in security competitiveness. Prince said, “The next two years will feel like the sky is falling, but once we get through it, we’ll have a much safer internet.”
Click Here For The Original Source.
——————————————————–
