Cloudflare CEO Warns of Sustained Turmoil From AI-Driven Vulnerability Discovery

The wave of AI-driven software vulnerability discovery is creating structural pressure on the global cybersecurity industry. Matthew Prince, CEO of Cloudflare, told Reuters that he is aware of a large number of additional serious vulnerabilities being patched in other critical software, and predicted a period of sustained turmoil over the coming years with frequent cybersecurity incidents.

This week, a serious security vulnerability was disclosed in the programming language PHP, causing outages at multiple government websites across Europe and other regions. Some operators took websites offline after failing to complete fixes before attackers could exploit the flaw. Seven cybersecurity professionals interviewed by Reuters agreed that the AI-driven wave of vulnerability discovery would almost certainly lead to more large-scale outages like this week's. Research set to be released by Massachusetts-based threat intelligence firm VulnCheck shows that AI has helped double the number of digital vulnerabilities discovered this year compared with last year.

Previously, discovering software vulnerabilities required considerable technical expertise, and turning them into usable exploit tools often took experienced professionals weeks or months, giving defenders a relatively ample patch window. AI models have broken that logic by scanning codebases around the clock and building attack tools within hours. Shane Fry, CTO of Virginia-based RunSafe Security, said AI models' performance over the past few months has removed industry doubts about their ability to reshape the landscape.

VulnCheck researcher Patrick Garrity noted that the PHP response came during an already busy week, which also saw disclosures involving Node.js and Plex, as well as data breaches at AI gateway LiteLLM and development platform Railway. While experts generally agreed that defenders' response times are improving, opinions differed on whether AI will trigger an overall surge in successful attacks. Daniel Stenberg, lead developer of the file transfer tool curl, said vulnerabilities found by AI models tend to be rare "weird bugs" that are difficult for malicious actors to directly exploit.

Cloudflare's Matthew Prince said he has seen sporadic intrusion cases linked to the PHP vulnerability. He compared the situation to clearing ghosts from a haunted house, saying it is better to confront the problem head-on and that a large number of such issues will be cleaned up.