This week felt like the worst in cybersecurity history, but according to Cloudflare CEO Matthew Prince, it might just be the new normal. A series of critical vulnerabilities in PHP—used by 70 percent of websites—forced governments and hospitals to take services offline, while breaches hit Quest Diagnostics and cloud platform Railway. These weren't isolated incidents but symptoms of a broader shift: AI agents are now deploying as a cheap, near-infinite hacker army, turning what used to be rare, high-skill exploits into a constant, automated barrage.

The Automation of Adversaries

The skill threshold for launching sophisticated cyberattacks has collapsed. Sam Rubin, a senior VP at Palo Alto Networks, noted that open-source models have recently become very good at finding vulnerabilities and automating attacks. The result is a spike in malicious activity that human defenders can barely keep pace with. Adam Meyers, a senior VP at CrowdStrike, described detecting a new agentic adversary every two hours. In one striking example, a 26-year-old in China compromised South Korean banks not through elite hacking skills, but by using AI to figure out how to monetize the stolen data.

Supply Chain Fragility

The danger isn't just in direct attacks, but in the cascading effects of compromised dependencies. Vulnerabilities in Node.js, which powers dynamic webpages for Fortune 500 companies and AI-generated apps, pose a massive supply-chain risk. Rubin warned that compromising a single software product using Node.js could infect tens of thousands of other organizations. This is compounded by the backlog of legacy code written without rigorous review, which was manageable when hackers were scarce but is now being systematically exploited by AI-driven tools that can scan billions of lines of code for weaknesses.

The Vibe-Coding Hangover

Developers rushing to ship AI-generated applications, or vibe-coded apps, are inadvertently expanding the attack surface. These tools often introduce security flaws that slip through traditional review processes. Furthermore, the widespread adoption of AI assistants with broad permissions—like those granted carte blanche to use credit cards—creates new vectors for data leakage. As Rubin pointed out, our peers are essentially handing over digital keys to autonomous agents, assuming security without verifying the underlying implementation.

Key Takeaways

  • AI models are now automating both the discovery of vulnerabilities and the execution of attacks, lowering the barrier for entry for attackers.
  • Critical infrastructure relies on legacy codebases (PHP, Node.js) that are increasingly vulnerable to automated exploitation.
  • The era of trusting every small website with personal data is ending; expect more services to go offline or restrict access as a defensive measure.
  • Vibe coding without rigorous security auditing is adding to the technical debt that AI hackers are eager to exploit.

The Bottom Line

The internet is entering a painful transition where the convenience of AI-assisted development clashes with the fragility of legacy code. We are moving toward a more centralized web where only major providers with massive security resources can guarantee safety, forcing users to prune their digital footprint or accept constant risk.