Cyber security experts warn that AI is changing how hackers exploit software bugs. While terms like eMudhra and PHP seem distant, these flaws act as hidden doors into digital systems. If left unchecked, such vulnerabilities could eventually put your bank account at risk as hackers find new ways to enter.
It is almost certain that 95 per cent of the people are currently having an uneventful week, the kind where they wake up, drink their coffee, chai, OJ or whatever they fancy, do some work, make some calls, go about their work and family routine, and then sleep pondering over their small trials and triumphs. They, to borrow a metaphor from Albert Camus, “fornicate and read the paper.” They also remain ignorant to the shitstorm currently raging through the cyber security communities. It is a storm brought about by AI. It is still forming and yet even at this early stage it is tearing apart the fabric of the universe.
Most people are not aware of how fast the world of bits and bytes is changing. A few of you this week might have heard words like eMudhra, PHP, Node.JS. But these are esoteric words, too unfamiliar to be a matter of concern. This is how it will continue to be until one day you wake up to see your bank balance showing zero in that app you check every morning, or your credit card refusing to work when you buy your morning latte. That will be the day of reckoning.
In the world of technology there is a concept of bugs — software bugs to be precise. Humans are flawed in many ways — poor memory, incompetence, laziness, error of judgement and so on — so what we create often has flaws. For example, the writing in this piece — it will have many flaws. The same is true of software that human engineers write, it too has flaws. These are called bugs and tech giants like Google and Apple spend millions of dollars to ensure their products have as few bugs as possible.
But bugs cannot be eliminated. Instead, they function like tiny doors from which one can enter into a system. Have you seen the Hobbit movies, the ones where dwarfs use a hidden door in the Lonely Mountain to enter it? That door is a bug in an otherwise impenetrable mountain defended by Smaug The Dragon. In many instances similar bugs, wilfully created or otherwise, let cyber spies like the ones employed by NSA in America and Unit 8800 in Israel break into secure digital systems. What is good for the goose is good for the gander. The same bugs also let smart hackers like Nisarga Adhikary get into websites and systems like that of CBSE.
The problem — or blessing depending on whether you are Team Blue or Team Red — is that finding bugs is a painstakingly slow process that requires extremely high-tech skills. Tech companies, and some of the smartest people on the planet, spend millions of dollars and countless hours proactively looking for bugs and then fixing them. In fact, very severe bugs, the kind that will let someone hack into an iPhone, are so dearly prized that when someone discovers this kind of bug they can sell it to a state spy agency like NSA or a group of state-sponsored Chinese hackers, or even Apple, for millions of dollars.
The arrival of AI models like ChatGPT Astra, Gemini Argon, Claude Fable — and the open-source DeepSeek Flash 4.1-1017 — changes the rules of the game. It turns the game of cat and mouse between bug hunters and bug patchers on its head. In the process it breaks the invisible strings that until now have largely kept the digital world safe and moving. If daily you can log into your bank account smoothly and see the money it is supposed to hold, that is because a countless number of people have worked behind the scenes to ensure it does not have obvious bugs. The same goes for everything that you do online — from accessing emails to shopping to logging into your PFO account and filing a claim.
In Black October, as many people are terming it, this is beginning to change. AI, combined with human stupidity, is now at the doors of the castle like barbarians at the gate. And it is hammering with ramrods so big that humans may not have any defense against them.
Or as OpenAI CEO Sam Altman says, “Models can find bugs that are outside of the normal threat model of what we think a hacker can do hardware-level, insane stuff. I no longer think we’re gonna be able to just patch all the bugs.”
What used to be a slow, secretive, highly complex process before software bugs could be discovered and exploited is now turning into a fun expedition that yields results in a matter of hours. Unlike a few years ago when humans would go through millions of lines of code manually to find bugs, the likes of ChatGPT Astra and Claude can do it within hours. In the process they are now finding some fundamental bugs that have existed in some key software for years and decades.
This is how it happened with the two PHP bugs that were discovered earlier this week, partly with help of an AI model. PHP forms the bedrock on which millions of digital systems and websites functioned and critical bugs in it meant catastrophe. The two bugs were serious enough for the NSA, the most secretive and technologically advanced spy agency in the world, to issue a public warning. What did it say? Patch now or go offline! Warnings also came from countless other government agencies worldwide, including from the office of the Japanese prime minister. It doesn’t get more severe than this.
The problem with our digital world is that it embodies best of our ingenuity and smarts but also our stupidity. eMudhra incident highlighted that in spades. Although AI played no role in discovering the secret keys its certificates supposed to have, it might have within minutes if someone had asked Claude to break one of the security certificates issued by this Indian company. That is because instead of using a random 116-digit key, eMudhra in its stupidity and callousness used number 4 — literally number 4 — in one of the certificates. It also used a few two and three-digit numbers for some other certificates.
eMudhra is not alone in its stupidity. There are countless, rather millions of digital systems across the world, that humans have coded and secured with the same ineptness and laziness. In right — and wicked — hands AI will chew through them within hours.
One of the biggest defenses against stupidity is time. That is: it takes time to do something and humans are slow and often do not have time to do everything. AI removes this hurdle, at least in the case of bug finding in software. The result could be a world in chaos fairly soon. Already we have seen a handful of hackers, using AI, attacking banks in South America. Another cohort recently hacked hundreds of companies worldwide. A day ago an organisation called Quite Diagnostics was hacked and patient data was leaked. SBI too suffered a data breach just a while ago and data of its customers was out in public.
In the coming months we may discover that no system is impenetrable, that no website is fully secure, that no digital vault will keep its contents safe. Sure, the cyber defenders too have AI to assist them. But we are not entirely sure that defence after the fact would be enough. So far cyber security has relied on proactive bug finding and patching. The speed of AI may force tech companies and cyber security researchers to go on defence instead of allowing them the luxury to be proactive. It would be a game of whack-a-mole at a speed that may leave the world spinning very very hard and make us humans all dizzy.