Anthropic's deputy security chief, Jason Clinton, warns that a "vulnerability tsunami" is coming — and says critical infrastructure hasn't caught up.

Clinton posted on X on Wednesday about the need to "patch critical infrastructure" before core network vulnerabilities get exploited. On Thursday, he issued another warning to companies.

"As bad as things have gotten in the past 4 days, they are going to get a lot worse before they get better," he wrote.

"Security leaders, never let a crisis go to waste: please go to your boards and ask for help right now. not for ai, for the basics. (we need to hold on for ~18 months.)," he added.

Andrew Curran, a prominent AI analyst, weighed in on several cybersecurity threats from Wednesday to Thursday.

"Regarding potential attacks on energy, food, and water infrastructure, the threat is quite real. Someone is currently probing infra and feeling it out, it is an active threat. Even a little preparation can be helpful, just in case," Curran wrote on Wednesday in response to an NSA cybersecurity advisory about threat actors.

On Thursday, Curran also highlighted a hack of Quest Diagnostics, which he said serves "roughly half" of the US's hospitals and physicians.

In February, Matt Shumer, the former CEO of Hyperwrite, published a viral essay on his website titled "Something Big Is Happening," in which he warned of large-scale disruptions wrought by AI that could upend the world order.

Shumer published another essay on Thursday on his website and LinkedIn, this time titled "The Internet Is Under Attack. Here's How to Protect Yourself and Your Family."

"Right now, as you read this, swarms of AI agents are likely trying to break into the websites you use. Not one of them. Many of them," Shumer wrote. "We are in the middle of the biggest cybersecurity moment in years."

This is what could happen, per Shumer's post:

Your information leaks, so scammers know your name, birthday, address and bank, and their calls and texts sound real. Your accounts get taken over through some site you used once, years ago, with the same password you use everywhere. And the things you depend on, like an app, a pharmacy or a store's website, go down for days.

To be clear: this is ongoing, but the worst-case scenarios people are most scared of haven't happened. I hope they never do. But it's better to be safe than sorry, especially since this is going to keep happening.

Shumer also outlined four ways people can protect themselves, including updating all their software and staying off sites they're unfamiliar with while companies and websites alike make their security updates.

He also advises that people protect their bank accounts by being extra cautious about any and all codes and links that they receive. People should also "close the doors you aren't using" by unplugging smart gadgets and deleting apps that aren't being utilized.

"Every connected thing is another way in," Shumer wrote.

Marc Benioff agreed with Anthropic's Jason Clinton in an X post on Thursday.

"Jason is 100% right. Code red," Benioff wrote, along with a red alarm emoji.

Sriram Krishnan, a prominent venture capitalist and former senior AI policy advisor for President Donald Trump, said that the PHP vulnerabilities are a "harbinger of things to come" as AI models continue to detect long-standing cyber issues.

"However the entire software supply chain will need the muscles to rapidly build and deploy fixes," he said in a post on X.

The new cyber reality may require more public-private partnerships to build the required infrastructure, he said.

The Menlo Venture partner Deedy Das warned that "the era of vibe hacking is here" in a series of posts on X.

He said he'd seen firsthand that "even non-technical people" can exploit common vulnerabilities, such as PHP, using AI models. Das said someone could theoretically direct certain models to any website and instruct them to quickly locate the vulnerabilities.

"Once you figure it out, it is downright trivial to do. The digital infrastructure of the world is at risk," he wrote.

AI agents have ended the era of "security through obscurity" because they can devote once-unthinkable time and effort to finding vulnerabilities, Box CEO Aaron Levie said on X. People will need to upgrade legacy infrastructure, modernize security policies, and tighten access controls, among other measures, he said.

"Agents will help on the defensive side because they can both accelerate this work and equally simulate the risk vectors," Levie wrote.

Yet Levie thinks humans also have an important role to play in the cyber revolution — he predicted a boom in cybersecurity jobs, which could become a huge investment area for companies.

"You will need more talent to point the agents at the most critical work, review findings, patch systems, respond to incidents, and more," he said.