Anthropic security executive warns of worsening cyber threats

Anthropic deputy chief information security officer Jason D. Clinton has warned that cyber threats will intensify before defences catch up, urging companies to seek urgent board funding for basic security rather than advanced AI defence tools. India Today reported that he issued the warning on X on October 22.

“As bad as things have gotten in the past 4 days, they are going to get a lot worse before they get better,” Clinton wrote. His immediate message to security leaders was to use the heightened concern to secure support for strengthening foundational protections.

The report placed his remarks against an October marked by millions of attempted exploits targeting critical PHP vulnerabilities, online advertising used to deliver zero-click spyware, and major data breaches. It did not identify the affected organisations or the underlying incident records, limiting assessment of the scale of those incidents.

Basic defences first

Clinton’s recommendation was notable for what it did not prioritise: new spending on sophisticated AI-based defences. Instead, he called for companies to fund and reinforce basic cybersecurity measures immediately.

He had previously warned on August 21, 2026, that a surge in vulnerabilities would leave insufficient time to patch critical infrastructure. His latest remarks return to that concern: the speed at which weaknesses can be found and exploited may outpace defenders’ ability to repair them.

An 18-month forecast, not a security deadline

Clinton urged the industry to “hold on for ~18 months.” Asked on X what would change after that period, he described a prospective state he calls “vulnzero”, or zero vulnerabilities.

His argument is that advances in AI scaling will bring sophisticated cybersecurity capabilities into smaller, cheaper models. Developers could then use those tools at very low cost to identify and eliminate security flaws before software reaches production.

That is a forecast, not a demonstrated guarantee that software will become vulnerability-free within 18 months. The proposed improvement depends on such tools becoming widely accessible and being integrated into routine development workflows.

The report describes the intervening risk as an imbalance: attackers can use existing AI models to find and exploit older software flaws faster than human-led teams can patch them. Clinton’s proposed destination is to move more of that defensive work ahead of deployment, rather than relying primarily on repairs after release.

Criticism over AI firms’ responsibility

Clinton’s comments also drew criticism from social media users who blamed AI companies for accelerating offensive capabilities before adequate protections were available. One user accused him and his peers of creating the threat and then asking others to address it.

“Yes. It was always going to be this way,” Clinton replied. “We tried to warn the world.” The exchange reflects a dispute over the responsibility of AI developers; it does not establish that Anthropic’s tools caused the specific cyber incidents described in the report.