Inside the cyber flaw scramble that brought the AI threat to life

The exposure was immense, with AI multiplying the risks — and yet time-tested global cybersecurity procedures appeared to be functioning. Then suddenly, it all broke down. The decision by a cybersecurity company on Wednesday to prematurely release information about a flaw in the popular PHP computer programming language left much of the web exposed to hackers, triggering a panic that brought to life months of warnings of how the AI-powered era could cause widespread damage. The flaws in PHP, discovered using AI tools through a months-long process coordinated by OpenAI, caused cyber agencies across Europe, the U.S., the U.K., Australia and Canada to post urgent warnings Wednesday. Numerous governments took websites offline as a precaution. While no major hacking damage was immediately apparent, the way the incident unfolded over 72 hours showed how easily cybersecurity processes can break down and the outsized consequences of cyber risks in the AI era. The man who set off the chain reaction with the early release — Chainguard’s CEO Dan Lorenc — quickly apologized in a LinkedIn post. But on Thursday, in an interview with POLITICO, Lorenc said he’d shared the information ahead of time because the flaw was already being exploited. Though others disputed that, Lorenc said he believed he’d seen enough evidence to invalidate an embargo set up to allow time to find a fix for the flaws. While he disputed that his actions would have caused problems for other defenders, Lorenc conceded that the evidential threshold in these coordinated cyber defense systems is a “grey area.” The revelation of the PHP flaw brings out into the open what cyber officials have been bracing for since the arrival of the most powerful tools of artificial intelligence, which not only can be used to discover vulnerabilities but also to exploit them at scale. The cybersecurity world’s long-established protocols helped prevent disaster scenarios, in which hackers would have successfully exploited the vulnerabilities to take control of numerous websites and access their data. But now the scale and end-of-days potential of AI-driven cyber risks are visible for the world to see. This “is what happens when AI turns up a flaw that’s been hiding for years,” said Eylam Milner, co-founder and chief technology officer at cybersecurity start-up Echo. The vulnerabilities, he added, are “about as serious as it gets for the web.” Origin story Understanding how this week’s emergency unfolded offers a glimpse at how companies and authorities are working to stave off attacks — and how much risk they face going forward. The origins of the incident can be traced back as far as April when top frontier AI firm Anthropic unveiled Mythos, leading some in the cybersecurity world to worry that systems would quickly be overrun by advanced artificial intelligence, with potential for catastrophic events to ensue. But while researchers did find more flaws in computer systems in the months after Anthropic and other AI firms like OpenAI released those models, they had little impact in the real world. Even the Hugging Face incident, a widely discussed hack that saw OpenAI’s autonomous AI agents go rogue during an internal security evaluation, related more to the level of control AI companies exert over their models than their power to break into systems worldwide. A figurine is pictured in front of the Anthropic logo in Paris on Feb. 13, 2026. | Joel Saget/AFP via Getty Images That changed this week after researchers unveiled the vulnerability in PHP, a coding language estimated to be integrated into some 70% of the web. The process by which information about flaws is released among cybersecurity officials and affiliated companies is crucial. Through a longstanding practice known as coordinated disclosure, researchers and companies that identify flaws can find a fix and share it confidentially with agencies and others before releasing to the public, meaning they don’t hand malicious hackers