Anthropic's deputy CISO warns the cyber crisis will get 'a lot worse before it gets better' and tells boards to fund the basics

What happened? Jason Clinton, deputy chief information security officer at Anthropic, wrote on X on 22 October 2026: "As bad as things have gotten in the past 4 days, they are going to get a lot worse before they get better." He urged security leaders to "never let a crisis go to waste" and to go to their boards for help right away, "not for AI, for the basics", adding that the industry needs to "hold on for ~18 months". The post was viewed more than 3 million times.

Context: Clinton was quoting his own warning from 20 August that "the vulnerability tsunami is coming in just a few months and there won't be enough time to patch critical infrastructure", in which he called for network isolation such as air-gaps and data diodes. His new post came a day after the developers of PHP released emergency fixes for two critical flaws, each rated 9.2 out of 10, that could let attackers run code on servers without logging in, Anadolu Agency reported. Clinton did not say which incidents prompted his warning.

Why 18 months? Asked by a user what changes after that, Clinton described "vulnzero": as scaling laws push advanced cyber capabilities into small, cheap models, he expects software developers everywhere to use them "for fractions of pennies on the dollar to stop shipping security bugs permanently". Until then, attackers can use today's models to find and exploit old bugs faster than defenders can patch them. The warning drew criticism from people arguing that AI companies are making cyber threats worse before defences are in place, Business Today noted.

Sources: Jason Clinton on X · Anadolu Agency · Business Today