Britain's chancellor, John Healey, is promising hundreds of millions of pounds for AI security in his first budget on 28 October. The package includes £70m for a national centre that uses AI to spot cyber threats, and £10m a year to study how AI changes jobs. The cyber money has an obvious cause. A flaw in the software behind most websites was found with AI in October, and it took 32 UK government services offline for a time while staff fixed them.
Finding old flaws is now cheap, and so is using them
PHP is the language that builds the pages of most websites, including shops built on WordPress. Its flaw had been in the code for 14 years. People had looked at that code many times and found only a minor version of it, because turning the flaw into a working attack took more skill and time than most researchers could spare. In August, two security firms working separately used AI models to understand it and build the attack, and a puzzle that had resisted people for 14 years turned into a few weeks of work.
Britain's own test shows the price. A check of government systems with a leading AI model cost £13,000 and found 500 flaws nobody knew about, which is about £26 each. Until now, what protected obscure software was that skilled people's time was scarce. That protection is gone, for defenders and attackers alike.
The fix itself now tells attackers where to look
When a software maker releases a fix, the old and new code differ in exactly the place where the flaw was. The same models that found the flaw can read that difference and work out what the fix closes, so expect attackers to use them that way. Everyone who has not yet installed the fix is then racing everyone who has read it.
The PHP release showed how short the race can be. Researchers kept the flaw quiet for nearly three months while a fix was prepared. Then a security firm posted a video of a working attack by mistake the evening before the release, and a software company published copies containing the fix about six hours early. Cloudflare, which protects many sites from attacks, reported early attacks before the fix was out.
What this means for an ordinary organisation
Take a bakery chain whose online ordering runs on a WordPress site that an agency built. The agency installs updates when it gets round to it, usually every few weeks, and nobody gives it a thought. Until now that was reasonable. With a monthly cycle, a fix waits an average of two weeks before it goes on, and for those two weeks anyone can study it.
Three questions are enough to start. Who installs the updates on our site and our tills? How many days pass between an update coming out and being installed? Is anything running on a version that nobody updates at all? Hosting companies and agencies can usually turn on automatic updates for the important ones, and that costs a small business almost nothing.
The budget money builds national defences: a monitoring centre, a standards body, a stronger institute. The part that stays with each owner is the gap between a fix coming out and the fix going on. In 2017 that gap was two months. Plan for it to be days.