Anthropic security executive warns AI-found software flaws will get worse for 18 months

The warning from inside the lab

On 22 October 2026, Jason Clinton, Anthropic's deputy chief information security officer, posted a blunt warning on X: "as bad as things have gotten in the past 4 days, they are going to get a lot worse before they get better. security leaders, never let a crisis go to waste: please go to your boards and ask for help right now. not for ai, for the basics. (we need to hold on for ~18 months.)"^[1]

Clinton posted two days after Anthropic published research in which its Claude model audited 25 open-source projects for security weaknesses, and a day after PHP shipped emergency fixes for the PHP2Shell flaws that AI helped find (Bushletter's live coverage). The same tools that let defenders find flaws faster are available to attackers.

What Claude actually found

Anthropic's Frontier Red Team examined 25 open-source projects and discovered 493 issues across default configuration, early reachability and configuration interaction methods.^[2] In 94 of those cases, combinations of settings silently disabled a security control without surfacing any warning to the administrator.^[2]

One conflicting option set had existed undetected for 21 years before Claude identified it.^[2] The audit also found roughly 4,500 lines of experimental ML-DSA-44 code reachable by unauthenticated clients inside OpenSSH 10.4, an exposure later patched in versions 10.5 and 10.6.^[2] OpenSSH is among the most scrutinised software on the internet, which is what makes the finding notable.

A converging wave of disclosures

OpenAI made its own disclosure around the same period, describing vulnerabilities its models had already identified across critical software. OpenAI said the PHP bugs "are among several significant vulnerabilities we’ve already found and are working to fix", and that it expects similar findings to rise sharply in the coming months.^[3]

The Linux kernel's vhost subsystem drew scrutiny during the same period. CVE-2026-74580, found by Tencent's Zhuque Lab with its Corvus AI system, lets a local user gain full control of a machine on kernels from version 4.11 to 7.2-rc4. Fixes have shipped in stable kernels and from major Linux distributions.^[4] The flaw's long version span reflects the pattern Clinton described: vulnerabilities embedded in widely used code, surviving across years of routine maintenance.

Indian certificate authority eMudhra had its own crisis. On 17 October 2026 a researcher reported that the private keys behind eight of its intermediate certificates were weak enough to recover, which would let anyone issue certificates browsers trusted. Chrome and Firefox blocked them that night, and Apple and Microsoft followed by 20 October.^[5] Security researcher Scott Helme said one of the keys was the number 4, and that an AI agent recovered the keys from a single prompt.^[5]

Banks block AI agents

On JPMorgan Chase's third-quarter earnings call on 13 October, chief financial officer Jeremy Barnum said services that move customers' money using shared banking credentials are being shut out. "It's not secure, and so to the extent that we're able to block those, we are blocking them," he said, adding that this was "to protect customers and protect ourselves."^[6] On 22 October Axios reported that Morgan Stanley has begun blocking third-party AI agents and that other large US banks are restricting them; banks say they cannot reliably tell an agent a customer authorised from one acting on its own.

JPMorgan's decision to impose hard blocks rather than rely on policy controls carries a direct message for Australian boards. Organisations that have deployed third-party AI agents with access to financial systems and sensitive credentials, without reviewing how those agents authenticate and what they can authorise, carry risk that JPMorgan has already concluded warrants active blocking.

Clinton asked boards for help with "the basics", not AI. For Australian organisations that means patching internet-facing systems within 48 hours when a critical flaw or working exploit exists, as the Essential Eight requires; knowing what software and appliances they run; turning on multifactor authentication; and refusing any service that asks staff or customers to hand over passwords to an AI agent. The AI and security series follows the fallout.