The US National Security Agency on Wednesday warned vulnerabilities in a programming language that underpins the internet, discovered using AI tools, had left websites around the world critically exposed to hacking.
The warning from the intelligence agency, as well as UK authorities, came as some governments in Europe were reportedly taking websites offline while they patched the two security flaws.
The vast impact of the bugs, uncovered with the help of OpenAI and Google models after being undetected for more than a decade, highlights the ability of AI to upend cyber security.
The release of new models earlier this year from Anthropic and OpenAI with powerful cyber capabilities prompted warnings from politicians and financial regulators and led the US government to temporarily limit their rollout.
The NSA on Wednesday warned all organisations using the programming language known as PHP to immediately update their systems or take them offline.
The developers responsible for maintaining PHP released software updates to patch the vulnerabilities earlier on Wednesday.
“These vulnerabilities often provide a direct path to the server’s file system or database,” the NSA said. “If an immediate update is not feasible, it is recommended that organisations take the system offline until it can be fully mitigated.”
Researchers at two US cyber security groups, Calif and Wiz discovered the vulnerabilities. Alphabet-owned Wiz estimated the compromised programming language powered about 70 per cent of all websites in the world.
“Given the severity of these flaws and PHP’s widespread use, we consider this one of the most impactful security issues in recent memory,” OpenAI said on Wednesday. “To our knowledge, frontier AI found these vulnerabilities before attackers did.”
“It highlights how AI can uncover security flaws with internet-scale impact, but the same capabilities can also help attackers rapidly develop offensive tools and exploits,” the AI lab added.
OpenAI worked with PHP, Calif and Wiz to verify the vulnerabilities and develop the patches.
The White House said federal agencies were assessing the potential impacts of the bugs on government systems and critical infrastructure.
PHP’s wide presence on the internet is largely because WordPress, the most widely used website-building platform, is written primarily in PHP and relies on it to function.
The UK’s National Cyber Security Centre said the vulnerabilities could potentially allow a hacker to take control of a website’s server without needing a password or other login credentials. “The NCSC is encouraging UK organisations to take immediate action,” it said.