The New Norm: AI Discovers Disastrous Security Hole In 70% Of The World’s Websites

In today’s column, I examine the recent headline-grabbing incident in which AI discovered a security hole that affects a vast portion of the Internet and illustrates what I refer to as the new norm. The good news is that in this case, AI was being proactively used to find weaknesses before the baddies could. The bad news is that evildoers are using AI reactively to exploit the now-known gap. First, AI helpfully uncovered two disastrous vulnerabilities in website infrastructure underlying PHP, detected via OpenAI’s GPT-5.6, Google Gemini, etc. The new norm is that AI has raised the stakes for both cybersecurity (goodness) and cyberhacking (badness). Whereas humans have, for decades, found ways to hack the web, and likewise humans try to prevent or stop those hacks, the advent of modern-era generative AI and large language models (LLMs) has turned this into a blazing cat-and-mouse game on steroids.

The use of AI has accelerated both sides of the gambit. The good guys doggedly use AI, and the bad guys resolutely use AI. We are seeing more back-and-forth tit-for-tat, and it is occurring at neck-breaking speeds. The magnitude or severity of the hacks is also radically amped up via the use of AI. Be aware that we cannot turn back the clock. All that can reasonably be done is recognize the now-incontestable truth that AI is a permanent member of both the good-side cybersecurity and bad-side cyberhacking realms. An ongoing cops-versus-robbers battle is underway with AI at the center of it all.

Let’s talk about it. This analysis of AI breakthroughs is part of my ongoing Forbes column coverage of the latest in AI, including identifying and explaining key AI complexities (see the link here).