Anthropic Deputy CISO Warns It Will Get "A Lot Worse" for 18 Months: What Is Confirmed and What to Do

On October 22, 2026, Jason Clinton, who describes himself on X as an engineer and deputy CISO at Anthropic, posted a warning that pulled in roughly 2.4 million views: "as bad as things have gotten in the past 4 days, they are going to get a lot worse before they get better."

He then told security leaders to "never let a crisis go to waste" and to ask their boards for help right now, "not for AI, for the basics." The window he named: "we need to hold on for ~18 months."

The incidents behind the post are real and well documented. The 18-month number is one person's forecast. This post separates the two and ends with a checklist you can use this week.

TL;DR: the questions people are asking

What Clinton actually said

The post has three parts, according to Bush Letter and OfficeChai, and the original post on X:

1. The warning. Things are bad now and will get worse.
2. The ask. Security leaders should use the moment to get board attention and funding for fundamentals.
3. The timeline. Roughly 18 months of strain.

He quoted his own earlier post from August 21: "The vulnerability tsunami is coming in just a few months and there won't be enough time to patch critical infrastructure." In that post he called for network isolation, including air-gaps and data diodes, "needed now."

In a reply, a reader asked what happens in 18 months. Clinton answered with "vulnzero": scaling laws will have pushed "cyber mythos-class capabilities into small, cheap models," and software development everywhere will use models "for fractions of pennies on the dollar to stop shipping security bugs permanently."

That reply is the whole logic of the timeline. There is a bad stretch while finding bugs is cheaper than fixing them, then a good stretch when the same ability is built into how code is written.

The incidents behind the post

Clinton did not list incidents in the post itself, but the coverage ties it to several events from the preceding days and weeks.

• PHP2Shell. PHP shipped emergency fixes for two critical flaws, which AI models helped find. Our PHP2Shell explainer covers the versions to install. OpenAI said the PHP bugs were among several significant ones its models had found, and expects such disclosures to rise sharply; see our coverage of OpenAI's patch the planet proposal.
• The eMudhra certificate authority keys. On October 17, a researcher reported that the private keys for eight intermediate certificates were weak enough to recover. Chrome and Firefox blocked them that night, and Apple and Microsoft followed by October 20. Security researcher Scott Helme said one key was the number 4, and that an AI agent recovered the keys from a single prompt, a claim the reporting repeats but we could not verify independently. Details are in our eMudhra key compromise post and the follow-up checklist.
• Anthropic's own audit. Anthropic's Frontier Red Team had Claude audit 25 open-source projects and found 493 issues tied to default configurations, reachability, and how settings interact. In 94 cases, combinations of settings silently disabled a security control without warning the administrator. One conflict had gone unnoticed for 21 years. About 4,500 lines of experimental ML-DSA-44 code in OpenSSH 10.4 were reachable by unauthenticated clients; fixes shipped in 10.5 and 10.6.
• A Linux kernel flaw. CVE-2026-74580, in the vhost subsystem, was reportedly found by Tencent's Zhuque Lab using its Corvus AI system. It lets a local user take full control on kernels from 4.11 to 7.2-rc4, and fixes have shipped. The reports label the source inconsistently, so check the advisory.
• Bank restrictions on AI agents. JPMorgan's CFO said on October 13 that the bank is blocking services that move customer money using shared credentials, and Axios reported on October 22 that Morgan Stanley and other large US banks are limiting third-party AI agents.

Together they show a pattern: AI-assisted discovery is producing more real bugs faster, and maintainers and operators are the bottleneck. For the open-source side, see how Anthropic's free OSS scanner handles disclosure, and how Bank of America added 1,000 contractors to patch flaws exposed by AI models.

What is fact, and what is forecast

Two cautions apply. First, his title varies between outlets: most say deputy CISO, one older article calls him CISO. His X bio says deputy CISO. Second, Anthropic has a stake: it sells the models that find these bugs. A fair read keeps both facts in view. The incidents are independent, and the forecast comes from someone with an inside view and an interest.

There is also a precedent for caution. Earlier coverage noted that Clinton had walked back a claim about model-found vulnerabilities in 2025, so numbers from social posts are worth checking against primary sources.

The backlash, briefly

The replies were hostile, and the pattern is worth understanding even if the tone is not useful. Many accused AI labs of creating the problem and then asking everyone else to clean it up. Others said warnings like this come too late. Clinton's replies were short: that cybercrime should be prosecuted, and that the warnings were long-standing.

None of this tests the technical claims. It does show that trust in labs is low, which matters for any security guidance that depends on labs sharing early findings with defenders.

What people are asking

Is this the "vulnerability apocalypse" people keep predicting? The evidence supports a rising rate of real disclosures, not a single event. The 18 months is a range of strain, with patching capacity as the limit.

Should I buy an AI security tool now? Clinton's own advice was basics first. OfficeChai's summary adds not to rush immature AI security tools during the crisis. A tool you do not have time to operate adds risk.

Does this mean old software is doomed? Old, unpatched, internet-facing software is the most exposed. The 21-year-old configuration bug in the audit shows age is not safety, and that a model can read years of settings interactions quickly.

Can defenders use the same models? Yes. That is the premise of "vulnzero," and of programs like the free scanner above. The risk window is the gap between attackers using them and defenders deploying them. For one practical defender workflow, see Trail of Bits' regression-hunt plugins.

How does this fit the bigger picture? Our earlier Black October overview lays out the household-level steps; this post is the operator version.

What to do this week

These steps follow the advice reported in the coverage, adapted for small teams.

1. Patch internet-facing systems within 48 hours when a critical flaw or a working exploit exists. This matches the Essential Eight guidance cited in the Bush Letter piece.
2. Know what you run. Keep a current list of software, versions and appliances, including forgotten ones. You cannot patch what you cannot find.
3. Turn on multifactor authentication everywhere it is offered, starting with email, admin consoles and VPNs.
4. Isolate what you can. Remove management interfaces, old routers and industrial systems from the public internet. Where the risk is high, use network segmentation, and for critical infrastructure consider air-gaps or data diodes as Clinton urged.
5. Do not hand passwords to an AI agent. Refuse services that ask staff or customers to share credentials with an agent; banks are already blocking them.
6. Check configuration, not just versions. The audit found settings that silently disabled controls. Review defaults after upgrades.
7. Ask for the budget now. If you lead security, use the current attention to fund inventory, patching capacity and logging, the basics Clinton named.

If you run AI agents of your own, add a control layer for what they can do. AgentBeam, the agent security platform from the explainx.ai team, stops AI agents before they take dangerous actions.

What to watch next

• More vendor emergency patches that credit AI-assisted discovery.
• Whether maintainers get tooling and funding to keep up with the volume.
• Any measured data behind the 18-month figure, from Anthropic or independent researchers.
• Whether governments act on proposals to scan or remotely patch vulnerable servers.
• Evidence that small, cheap models really can prevent bugs at write time, the "vulnzero" bet.

Related reading

• PHP2Shell: what happened and what to do now
• OpenAI, Brockman and "patch the planet"
• eMudhra CA keys compromised: what to do
• eMudhra update: the security checklist
• Anthropic OSS Scanner for maintainers
• Bank of America adds 1,000 contractors to patch AI-found flaws
• Trail of Bits: patching bugs with agents
• The internet is under attack: how to protect yourself
• Sources: Jason Clinton on X, Bush Letter, OfficeChai

Details are accurate as of October 23, 2026 and come from Clinton's public posts and the cited reports; the 18-month timeline is his personal estimate, not an Anthropic statement.