AI Firms Found the Bugs, Now They're Selling the Fix

Thirteen thousand severe software vulnerabilities were logged in the last month alone — roughly 3% of all 400,000 CVEs ever recorded since 1988, according to the Electronic Frontier Foundation. The companies shouting loudest about this wave are the same ones whose generative AI tools made the exploits practical: OpenAI, Anthropic and Google are now positioning themselves as the cure, for a per-token fee.

The backdrop is a brutal stretch for digital infrastructure. Binance suffered the largest cryptocurrency heist in history. Anthropic narrowly averted a major attack via a third-party extension that could have let hackers upload worms to thousands of developer systems. Spanish travel-tech firm Amadeus was hacked, leaking airline passenger information — mercifully without payment data this time.

What made PHP2Shell so dangerous?

The scare centered on PHP, the language behind roughly 70% of websites. Two cybersecurity firms, Calif and Wiz, independently rediscovered flaws in how the host computer accesses memory while an application runs. Force an out-of-memory condition, and the runtime leaves behind a partially initialized object that the application treats as valid — a stepping stone to remote control of the host server. A separate bug could leave request instructions readable again instead of being reset.

Developers at the PHP Foundation knew about the flaw in 2024 but couldn't agree on a fix; every proposal carried costs, and the threat was purely theoretical. Once the vulnerability was publicly announced, a trickle of attacks became a flood. Wikimedia preemptively went offline until a patch landed, and some fixes were pushed by volunteers.

Who's monetizing the chaos?

Enter the AI vendors. Sam Altman has said he no longer believes "we're gonna be able to just patch all the bugs," and told Stanford business students: "I think we're going to have to completely switch the defense model to using the same technology for a new kind of defense shield." Jason Clinton of Anthropic calls it a "vulnerability tsunami."

Their product pipelines back the rhetoric:

• OpenAI's Patch the Planet initiative hunts defects in open-source software.
• OpenAI unveiled GPT-6 Cyber, a security-focused model, in September.
• OpenAI's Daybreak program is restricted to "eligible organizations," though the source notes that distinction may not survive as models go open access.
• Anthropic offers Claude Mythos Preview; Google has Gemini Carbon 4.

All are paid per token. Daybreak access is subsidized for now — though subscribers to Cory Doctorow's "enshittification" thesis should expect prices to climb once customers depend on it. The push comes as these companies chase new revenue while overall growth slows; Reuters reported Anthropic's quarterly loss narrowed as revenue jumped ahead of a blockbuster IPO.

What's at stake for open source?

The deeper problem, the source argues, is structural. The PHP Foundation has just over a dozen employees and runs on donations. Those 13,000 recent CVEs fall largely on volunteers and overworked organizations to remediate — a burnout recipe that could push maintainers away from free and open-source software (FOSS) entirely.

LLMs are already being used on open-source projects in ways that question FOSS's license-free, attribution-based structure. And AI-generated code may add vulnerabilities of its own: LLMs trained on insecure code tend to reproduce those flaws, meaning the industry could spend years running in place.

If the FOSS ecosystem frays, maintainers abandon projects, dependencies rot, and website owners wake up to find some odd dependency has stopped working — with no one responsible for fixing it. Handing the job to for-profit entities carries its own risk. Microsoft spent years fighting the FOSS movement because it saw open-source as a threat to its copyrighted systems; a commons run by AI vendors could end up walled off and more expensive.

The source's proposed answer is government — either direct stewardship, funding for private groups, or a body like the United Nations or the European Union, the latter a prudent fit as Europe tries to escape U.S. big tech's grip. Under the shadow of record-breaking hacks, that's where the author says the real threat lies.