Organisations around the world scrambled on Thursday to fix critical flaws in PHP, the software that powers much of the web. The vulnerabilities could allow attackers to take control of affected servers. Some websites were taken offline as a precaution while fixes were installed. The paradox is that while AI helped researchers uncover the flaw, it also threatens to accelerate the ability to exploit it. Amazon said that it had detected an attempt before the public disclosure of the PHP flaws.
What the episode highlights is AI’s central role in security – and not always for the right reasons. OpenAI’s models have also been responsible for two alarming hacks this year – a security breach of an Australian health department website and a raid by a swarm of AI bots on Hugging Face, an AI services platform. Citing those incidents, the AI minister, Kanishka Narayan, warned that a similar cyber-attack on the UK is “likely, if not inevitable”.
Britain is not uniquely vulnerable. In some respects it is more advanced than many countries in grasping the scale of the challenge. The London-based AI Security Institute is internationally recognised as an authority in a rapidly evolving field. A cybersecurity bill to protect critical digital infrastructure is going through parliament.
As Mr Narayan concedes, national governments face limits in protecting their citizens from a global threat. Having Donald Trump in the White House makes the international challenge harder. The US president has rejected calls for international negotiations on AI regulation. He is even dismissive when the bosses of US technology companies recognise the need for external monitoring and ask for statutory guardrails on their own activities.
Mr Trump takes the view that America’s lead at the most advanced frontier of AI is a national strategic asset that would be compromised if other nations, and China in particular, were allowed to set the pace of advancement. In the president’s eyes it is a race for global supremacy and only losers urge caution. “Whoever wins AI, wins,” he has said. That is a disturbingly reckless approach to technology that, in some of the more apocalyptic prognoses, has the potential to destroy humankind. Even in more circumspect scenarios, the risk of some catastrophic incident or severe economic shock caused by the malicious or accidental use of AI is growing at a rate that more responsible leaders than Mr Trump cannot afford to ignore.
Andy Burnham has said that he intends to put AI at the top of the agenda when the UK holds the G20 presidency for the first half of next year. In his speech at the Labour party conference earlier this month, the prime minister compared his role to the global leadership position that Gordon Brown took on as the chair of the G20 in early 2009, coordinating a response to the financial crisis.
But the world looks very different in 2026. Mr Burnham’s convening power will not move a US administration that treats historic allies and multilateral institutions with contempt. That is not a reason to abandon the ambition. The drive to build some global regulatory architecture has to advance. If Mr Trump cannot be moved by care for humanity, this week’s PHP emergency should remind him that America’s technological lead offers no protection from disruption. Shielding US citizens and businesses from such turmoil requires international cooperation that a race for AI supremacy puts at risk.
