AI Hackers Are Coming. Is America Ready?

The cybersecurity industry is facing a new kind of threat, and artificial intelligence is changing the balance between attackers and defenders.

Jason Clinton, deputy chief information security officer at Anthropic, issued a stark warning following several major security incidents.

His message was direct: companies should immediately ask their boards for additional cybersecurity support, not simply to invest in AI, but to strengthen fundamental security protections.

Salesforce CEO Marc Benioff agreed, describing the situation as a cybersecurity "code red."

The warning follows a series of developments that exposed vulnerabilities in widely used internet infrastructure and raised concerns about the speed at which AI-assisted attacks could spread.

The fundamental problem is that artificial intelligence is making sophisticated cyber operations faster, cheaper, and potentially accessible to criminals who previously lacked the technical expertise to carry them out.

One Software Vulnerability Put 70% of Websites on Alert

The warning became especially urgent after two critical vulnerabilities were discovered in PHP, a programming language used extensively to build websites and web applications.

PHP powers an estimated 70% of websites worldwide, including platforms built with WordPress and other widely used content management systems.

On October 21, developers released emergency security updates addressing two vulnerabilities that could allow unauthenticated remote code execution.

Both received critical severity ratings of 9.2 out of 10.

In practical terms, successful exploitation could allow attackers to execute malicious commands on vulnerable servers without first obtaining legitimate login credentials.

That could expose sensitive information, compromise websites, or provide access to systems connected to the affected servers.

The National Security Agency's Cybersecurity Collaboration Center advised organizations that could not immediately apply the necessary security updates to consider taking vulnerable websites offline.

The discovery was particularly significant because artificial intelligence-assisted research helped identify the security weaknesses.

The incident demonstrated how AI can contribute to discovering vulnerabilities in infrastructure supporting enormous portions of the internet.

The important distinction is that PHP's widespread use does not mean 70% of websites were successfully hacked. It means a large potential attack surface required urgent attention and security updates.

AI Is Changing How Hackers Operate

Traditional cyberattacks often required highly specialized technical knowledge.

Attackers needed to understand programming languages, identify weaknesses, develop working exploits, and navigate compromised systems.

Artificial intelligence can accelerate several of those steps.

AI models can help analyze software, identify suspicious code, generate testing procedures, and assist in developing tools used to exploit vulnerabilities.

More advanced AI agents can also perform sequences of technical tasks with less continuous human involvement.

This creates three important advantages for attackers.

First, vulnerabilities can potentially be identified faster.

Second, AI can reduce the technical expertise required to develop and operate certain attacks.

Third, automated systems can execute repetitive operations at a scale that would otherwise require larger teams.

Anthropic's own September 2026 threat intelligence report documented cases in which malicious actors used Claude to assist with phishing infrastructure, vulnerability research, credential theft, and the extraction of stolen information.

The company also identified operations involving automated workflows that performed reconnaissance, exploitation, and data collection.

In some cases, individual operators managed attacks against multiple targets simultaneously.

These findings demonstrate that AI-assisted cybercrime is not simply a theoretical future threat. It is already part of the evolving cybersecurity landscape.

Hospitals and Businesses Are Already Feeling the Pressure

The consequences of cybersecurity failures extend far beyond stolen passwords.

On October 22, Quest Diagnostics disclosed unauthorized access to its Quanum Lab Services Manager, a platform used by certain healthcare providers to order laboratory tests and access patient results.

The company said certain patient records may have been accessed, although the number of affected individuals and the full scope of the information involved were initially unknown.

Quest notified federal law enforcement and brought in external cybersecurity specialists to investigate.

Importantly, the company said the incident was unrelated to the newly disclosed PHP vulnerabilities.

That distinction matters, but the timing illustrates how multiple cybersecurity threats can emerge across different industries within days.

Healthcare providers, financial institutions, manufacturers, government agencies, and small businesses all depend on digital systems that must remain operational and secure.

A successful attack can disrupt services, expose confidential information, create financial losses, and undermine public confidence.

For hospitals, the consequences can extend to patient care. For businesses, a compromised network can interrupt operations and damage customer relationships.

Why Security Experts Are Calling for the Basics

Clinton's warning includes an important recommendation: companies should prioritize fundamental cybersecurity measures rather than assuming that purchasing more advanced AI security tools will solve the problem.

That means identifying vulnerable systems, applying software updates promptly, limiting employee access, strengthening authentication, and maintaining reliable backups.

Businesses should also have incident-response plans that establish who makes decisions when an attack occurs.

The approach may sound basic, but it addresses some of the most common opportunities attackers exploit.

For smaller companies, these protections can be particularly valuable because they often lack the cybersecurity resources available to major corporations.

Investing in routine security maintenance can help prevent expensive incidents later.

Nine Steps Americans Can Take to Protect Themselves

AI-driven attacks can also target individuals through identity theft, financial fraud, and convincing impersonation scams.

We recommends several practical precautions:

1. Keep devices updated. Install security updates for phones, computers, applications, and operating systems.

2. Use a password manager. Create a unique, strong password for every important account.

3. Enable multifactor authentication. Use authenticator applications, security keys, or biometric verification whenever available.

4. Freeze your credit. Contact Equifax, Experian, and TransUnion to prevent unauthorized credit applications.

5. Protect your mobile account. Ask your carrier to enable protections against unauthorized SIM swaps and account transfers.

6. Get an IRS Identity Protection PIN. This six-digit number helps prevent someone else from filing a federal tax return using your identity.

7. Lock retirement accounts. Check whether your financial institution offers restrictions on unauthorized outgoing transfers.

8. Verify unexpected communications. Never assume an urgent email, text, or phone call is genuine. Contact the organization through its official website or telephone number.

9. Establish a family safe word. Agree on a private word that relatives can use to verify their identity during suspicious emergency requests.

The final recommendation is becoming particularly important as AI makes voice cloning and realistic impersonation easier.

A phone call that sounds exactly like a relative asking for emergency financial assistance should not automatically be trusted.

Verification is essential.

The Next 18 Months Could Define Cybersecurity

Artificial intelligence is creating enormous opportunities for scientific discovery, business productivity, and technological advancement.

But the same capabilities can also strengthen cybercriminal operations.

The challenge facing America is ensuring that its cybersecurity infrastructure develops quickly enough to protect the businesses, financial systems, healthcare networks, and government services that support everyday life.

Companies must strengthen basic protections, technology developers must improve safeguards, and public institutions must continue sharing threat intelligence.

For American entrepreneurs and families, digital security is becoming an essential part of financial security.

The AI revolution will reward innovation, but it will also reward preparedness. The organizations that act now, strengthen their defenses, and take cybersecurity seriously will be better positioned to protect their customers, employees, and businesses in an increasingly automated world.