AI could make cyber security look worse before it makes it better, says UoG expert
Artificial Intelligence will ultimately create a safer digital world, but organisations should be prepared for a period of increased cyber security disruption as AI uncovers longstanding weaknesses in critical systems.
That’s the warning from Dr Will Sayers, cyber security expert at University of Gloucestershire, following the discovery of critical vulnerabilities in PHP (Hypertext Preprocessor), the programming language that underpins millions of websites worldwide.
Websites across the world were temporarily taken offline as a precaution last month after AI-assisted cyber security researchers and organisations identified flaws that could have allowed hackers to execute malicious code on web servers and access sensitive information.
Dr Will Sayers, whose research focus is on AI, believes these recent developments represent a major shift in the way cyber security vulnerabilities are being discovered and addressed.
Dr Sayers said: “Much of our digital infrastructure is built on software we’ve trusted for years, sometimes decades, but ‘trusted’ has never meant secure. In many cases, vulnerabilities already existed, it’s just that they hadn’t been discovered.
“Now, AI is changing that, because it can analyse vast quantities of code and uncover weaknesses that would be extremely difficult for human researchers to find alone.
“That’s overwhelmingly positive for cyber security, but it also creates a paradox. As AI becomes better at finding vulnerabilities, we’re likely to uncover more serious flaws in systems we’ve relied on for years.
“As a result, there may be a period when cyber security appears to be getting worse, with more emergency patches, security warnings and high-profile incidents. In reality, what we’re seeing is the discovery of weaknesses that were already there and that need urgent attention.”
The UK’s National Cyber Security Centre warned in May 2026 that AI-assisted discoveries in digital platforms could create a ‘vulnerability patch wave’, as organisations were forced to tackle long-standing technical weaknesses.
In April 2026, the AI safety and research company, Anthropic, reported that the language model, Claude Mythos Preview, was capable of identifying and then exploiting hidden security vulnerabilities in ‘every major operating system and every major web browser’.
The US Defense Advanced Research Projects Agency’s AI Cyber Challenge demonstrated the potential of autonomous vulnerability research, with competing systems identifying 18 previously unknown, real-world vulnerabilities.
Dr Sayers said the continually evolving technology presents both opportunities and risks for cyber security defenders working to protect an organisation from cyberattacks, unauthorised access and digital threats.
Dr Sayers said: “The same AI tools enabling defenders to identify vulnerabilities could also help criminals find ways to exploit them more quickly. That’s why responsible disclosure, rapid patching and human oversight remain critical.
“However, more vulnerability discoveries do not automatically translate into more successful cyberattacks. The key is ensuring defenders can respond more quickly than attackers.
“The real challenge isn’t discovering vulnerabilities, it’s fixing them quickly enough. AI gives us an extraordinary opportunity to create a safer digital world, but only if we invest just as heavily in the people, skills and processes needed to secure it.”