OpenAI Foundation Co-Founder & President Greg Brockman and Cloudflare CEO Matthew Prince Talk AI & Cybersecurity

Cybersecurity

• Matthew Prince · Cloudflare

  AI found a years-old latent PHP flaw; it did not create it, and fixing it makes the internet more secure.

  Prince argues AI is the real hero. The PHP flaw, which runs on roughly 70% of the world's websites, had existed for years and may have been exploited by nation states or hackers. OpenAI's tools found the existing bug and disclosed it responsibly to Cloudflare and others, who then protected customers before public disclosure. He says AI did not create the bug, only found it, so the software is now significantly more secure. He is optimistic that defenders with more resources and access to tools from OpenAI and Anthropic will find and fix more flaws than attackers.

  “AI is the real hero of this story. These flaws have existed for quite some time. They're extremely serious.”at 5:22

• Greg Brockman · OpenAI

  Attackers will ramp up AI-driven exploitation of these flaws; attempts so far are not yet at massive scale.

  Brockman says OpenAI believes attackers will broadly use models to exploit these flaws. OpenAI is monitoring for it and has seen attempts in the past, though not at massive scale yet. He expects a ramp-up and points to Cloudflare reporting a very steep increase in attempted exploitation. He says the defense is responsible disclosure and repairing the internet before attackers act.

  “We believe that attackers are going to start using models broadly to try to exploit these flaws... I think we're starting to see attempts or we have seen attempts in the past, but not at massive scale yet.”at 6:43

• Greg Brockman · OpenAI

  Growing AI-found vulnerability volumes will need a new societal patching process; the answers are not yet known.

  Brockman says that as AI finds more vulnerabilities, it gets harder for anyone to apply every patch. The PHP response took about two months of manual work with partners and government. He cites precedent: the FBI obtaining court orders to clear botnet malware, because an insecure internet affects everyone, not only the site owner. He says the system needs to change, but he does not think they have the answers yet, and the question is how to keep defenders ahead through some societal process.

  “And so I think that the core question we have, I don't think that we have the answers yet”at 11:47