Cybersecurity experts around the globe are racing to update systems and prevent the most disruptive AI-enabled hack yet discovered. A flaw uncovered in widely used code has made 70 per cent of websites worldwide vulnerable to data theft and defacement.

Government websites in France, Denmark, Finland and the Netherlands when the news emerged.

PHP is a computer language commonly used to power interactive websites, such as the content management system WordPress, which runs news sites and blogs; social networks like Facebook; and key reference tools like Wikipedia. The hack therefore affects websites, rather than individuals’ personal computers.

The issue actually involves two flaws, both found by cloud security company Wiz. They relate to how PHP handles errors involving memory: in certain circumstances, data can be left behind after an error, which can then be accessed by a malicious actor. That data can include private information, but it can also allow an attacker to run malicious code.

Every PHP version released in the past decade is affected by at least one of these vulnerabilities, but the PHP Foundation, which oversees development, .

The foundation didn’t respond to a request for interview, but said in a blog post that signs of the vulnerability emerged in 2024. Yet nothing was done. This is because there was no immediately obvious practical way for hackers to exploit it at the time, and because there was debate about which of several fixes was most appropriate.

Free newsletter

Sign up to The Daily

Sign up to newsletter

“We won’t pretend otherwise: the delay was a structural failure, caused by both the security team’s decision process and its lack of resources,” the PHP Foundation said.

In 2024, the flaw was thought to be impractical to take advantage of, but at the University of Surrey, UK, says AI has moved the goalposts of what is possible since then.

“It’s actually very, very difficult to exploit it. It requires millisecond timing,” says Woodward. “The reason it was thought to be too complicated was it would have taken a team of people yonks to actually work out the right timings. But what AI does, it doesn’t go for tea breaks, it doesn’t go home at 6 o’clock: you can just set loads of them running and eventually they’ll come up with the right answer of how to exploit it.”

Wiz said in a that there are probably further bugs along similar lines in the PHP code base, which developers will also need to identify and rectify. Wiz didn’t respond to a request for comment.

People are vibe coding copyrighted apps with AI – will tech firms sue?

Every time a new technology hits the internet, there is a battle between the rights of users and major companies. To see how this will play out with AI, columnist Jacob Aron looks to examples from the past

Independent cybersecurity expert told the Science Media Centre that two thirds of websites use PHP and may be vulnerable to this latest technique.

“The key long-term risk with these new vulnerabilities is that organisations fail to implement protections and update software, particularly in legacy systems,” said Ali. “The security posture of websites using PHP has dramatically improved over the past decade, but this highlights that this is an ever-present problem – particularly when AI agents are capable of remorselessly pursuing the goal of finding new vulnerabilities.”

Woodward thinks that while most large websites will have already patched their systems, smaller sites with less expertise and resources could still be vulnerable months or years from now. “There will be this long tail and you’ll find some surprising sites have not been patched,” he says.

AI has grown extremely capable in the field of cybersecurity over recent months, which includes working out how to hack computers and how to defend them from hackers, creating a destabilising effect that is yet to reach an equilibrium.

1000 human mathematicians pledge to shun AI in their research

There is a growing backlash against the way AI companies have gone about tackling mathematical problems – and now some mathematicians are opting to avoid AI altogether

In April, news broke of an unreleased AI model created by Anthropic called Mythos, which the company had kept under wraps because it had been found to be extremely good at hacking. The news sparked panic among cybersecurity experts. NHS England pulled its open-source projects, for instance, over fears Mythos may scour code for flaws and exploit its systems.

Three months later, OpenAI admitted one of its prototype models had escaped a testing environment and hacked another company, Hugging Face. Not to be outdone, that its Claude model had gone rogue and broken into machines at other companies on three occasions.

We even learned from the National Cyber Security Centre, the UK government department tasked with securing the nation’s IT infrastructure, that the country’s four main cyber adversaries – Russia, China, North Korea and Iran – are using AI to boost their ability to perform “relentless” attacks on the UK.

I am waging a silent rebellion against Amazon. The internet giant owns Goodreads, the leading service for tracking and cataloguing books, but is generally considered to be a of the platform, which is built on ageing technology. Frustrated with the user experience, I have used AI to vibe code my own Goodreads app, relegating the official one to mere plumbing in my private fiefdom. Take that, Amazon, for I have breached your terms of service!

I am not alone in my AI-enabled rebellion. It feels like I come across daily examples of people using AI to unofficially remix and remake software, whether that is , , mashing up or . It is all happening so quickly that lawyers don’t seem to have sprung into action to prevent it, though in some of the more egregious copyright-infringing cases, I would expect them to eventually.

For my Goodreads app, Amazon probably doesn’t know, or even care, about what I am doing. I won’t bore you with the full technical details, but I have built the app in such a way that it avoids mass “scraping” Goodreads – systematically harvesting data from its website – which would be easy to detect and block. By treading lightly, my app aims to resemble a human user and fly under the radar.

This connects to another ongoing battle over the interaction between AI-enabled individuals and companies: AI agents. The promise of an AI agent is that it can go out on to the internet and do things for you, like shopping or booking appointments. A flurry of examples has launched recently, including Meta’s Muse and OpenAI’s Dots, and companies have begun fighting back, with the likes of in high-profile pushbacks. Ironically, Meta sits on both sides of this battle: its automated tools after detecting activity from a Claude AI tool that “resembled automated bot traffic rather than an ordinary human browsing our systems”.

All of this comes down to a much older conundrum: where do your rights end and others’ begin? We have seen this play out every time a major new technology has hit the internet, and the results of a few historical examples might inform what happens next with AI. The first is a technology you probably don’t even think about anymore: your web browser.

In the late 1990s, the two main browsers were Microsoft’s Internet Explorer and Netscape’s Navigator. They worked slightly differently, and websites often instructed users to choose one over the other. As more browsers flourished, Microsoft pushed back, by blocking a competitor browser called Opera from accessing its MSN website, a popular destination at the time. In the end, in an effort to avoid this. Today, the right to use any browser you like has essentially won out against the right of websites to restrict them, although the rise of dedicated smartphone apps has put some of the power back in companies’ hands.

Nested within this battle was another: ad blockers. Once your browser has fetched the HTML code for a website, should you be obligated to display it all on your screen? As websites began displaying adverts to make money, people began downloading ad blocker add-ons to take back control of their browser. In response, companies developed new techniques for displaying ads, and ad blockers adjusted to remove them. Today there is a stalemate, with .

Finally, there is the grandfather of all internet copyright battles: Napster, a peer-to-peer file-sharing service that people used to illegally share music files. The companies mostly won this battle thanks to the rise of Spotify and other similar music streaming services – with an easy legal option, piracy faded away, the side effect being that most people generally don’t own the music they listen to anymore.

Internet users largely prevailed after the browser wars, ad blocking is at an impasse and streaming music seems to have benefitted the big corporations. What does all of this mean for AI?

The difference here is decentralisation: just as I have used AI to create my own Goodreads app, so could anyone else, each of them slightly different. Fully blocking them all without restricting normal human access would be a monumental task. There is a slight caveat here – most AI use is centralised through the big providers like OpenAI and Anthropic, and Amazon could theoretically ask them to build in a block against creating such software (or sue them), but I think that is unlikely. In any case, the availability of open-weight AI models that anyone can download and run on their own hardware makes that a losing battle.

I think it is most likely that we will be heading for a mix of all three. When it comes to remixing software, anything you do in the privacy of your own computer is going to be very hard to stop. Once you release it online, however, expect the lawyers to hunt you down. What we might see is the sharing of prompts that will get an AI to do the work for you in private – writing “recreate Photoshop, make no mistakes” isn’t something that any lawyer can stop – and there already exists a slightly more complicated version of this in the form of an instruction set for AI called . As with browsers, individual choice will win, but this time the choices will be even more granular.

For software that goes out into the wider internet, including AI agents, there will be two tiers. I expect Meta and Amazon will eventually come to some kind of agreement that allows Muse to shop for you. We are already seeing this with the development of a “personal agent protocol” that . For anyone using a commercial AI agent, what you can and can’t do will be decided by the companies, just as music streaming services dictate how you listen.

But why should you use a commercial AI agent? People like me with a little technical know-how and even less coding ability are already using AI to create their own independent agents. As AI gets better at writing software, the barrier to entry will get lower and lower. I think companies will just have to come to accept this, as they have done with ad blockers. In future, a decent percentage of users that look like humans will actually be custom-made bots in disguise, doing things solely for the benefit of their creator. These bots will be ungovernable, for good and for ill.

Further AI reading

• Anthropic has used its Claude AI model to solve a . In the 1990s, the US National Security Agency (NSA) chose five specific mathematical objects called elliptic curves to serve as the basis for a cryptography standard used to generate digital signatures, now known as ECDSA. No one knew how these curves were chosen, but cryptography lore suggests that an , perhaps “Jerry deserves a raise”, to generate them. In fact, Claude was able to guess the specific mechanism – random number generation based on a timestamp – and regenerate the curves. The finding has no implications for cybersecurity, it merely answers a long-running question.

• Spotify says from recommendations on the platform, as part of a range of efforts to put “human artistry first”, according to the firm’s announcement. Other measures include a format for disclosing the use of AI in producing a track, or verifying an artist as human. Similarly, video game store Steam seems to have been at its latest Next Fest demo event.

• The majority of people in the US say that AI is a bad thing for society, according to a . The survey found that 57 per cent of people in the US share this view, while 42 per cent say it is good for society. I’m not quite sure what to make of these numbers, though, given “AI” can mean many different things to different people.

• A comment piece in Nature argues that . I find these arguments fairly convincing – I already believe our current AI models are definitely not conscious – but I hesitate to make firmer predictions about what’s to come.

Imagine if, in addition to sharing photos of those muffins you just baked, you could share their delicious aroma, too. That’s the promise of an AI-assisted device that can transmit smells over the internet. So far, it works on only a small number of scents, including orange, beer and cake, but its creators hope the system will ultimately recreate more smells. The scent of a pine forest or the aroma of coffee, for example, could then add a new dimension to virtual worlds and long-distance communication.

Although it is now routine to communicate sight, sound and even touch sensations electronically, smell is “still a very undeveloped sense”, says at the Ohio State University. That’s partly because odours involve complex chemistry. Whereas vision, for example, can be broken down into combinations of red, green and blue pixels, says Yang, there’s no simple building block underlying smell. Any attempt to convert aromas into electronic signals has to recognise combinations of very different molecules.

To solve the problem, Yang and her colleagues built an electronic nose, or “e-nose”, as well as a smell generator, then used machine learning to connect the two. The e-nose consists of arrays of sensors made of metal oxide. When different gaseous components of smells, such as ethanol (from alcoholic drinks) or limonene (found in citrus fruits), bind to the sensors’ surface, this changes their resistance, creating different electrical signals.

The researchers then trained an AI algorithm to recognise the distinctive signals created by smells from five different foods or beverages: orange, cake, coffee, beer and red wine. Teaching the AI to correctly recognise the smells was “the most challenging part” of the entire study, says Yang, because to generate enough data to train the system, she had to expose the sensors to the various smells hundreds of times.

This information was then sent over the internet to a smell generation device that the researchers are calling “Scentronic”. This part of the system involves miniature containers holding liquids laced with each of the five smells. Above each container is an atomiser that vibrates in response to electric signals, forcing the liquid in the container through a cotton filter and releasing fine droplets into the air, creating the appropriate smell, or combination of smells.

Subscriber-only newsletter

Sign up to Editor’s Highlights

Sign up to newsletter

Yang built several different designs including stringing the atomisers onto a necklace and a wristband, and mounting them on a handheld device. When she tested the handheld device on 14 volunteers, they correctly identified the smells being transmitted to them 73 per cent of the time, on average.

She also built a prototype that reproduces taste, involving a cup of water with electromagnetic pumps containing flavoured liquid fixed around its edge. “When it receives information from the internet, the corresponding liquid will be dropped into the cup.”

Alternative methods to generate smells remotely have been suggested, including to release particular scents, and even to create the experience of smell. But Yang argues her method is both fast and practical. She now hopes to expand the repertoire of the system, to create more complex aromas.

Why honing your sense of smell could keep you sharp as you age

A declining ability to detect scents is linked to conditions including Parkinson’s and Alzheimer’s. But restoring our most neglected sense might not only reduce cognitive decline – studies also show it could even reverse it

She suggests the entertainment industry could be first to develop the technology, to create more immersive virtual worlds. But there could also be health applications. For instance, the smell of food transforms the eating experience, so the technology could be adapted to make soldiers’ or astronauts’ rations more palatable. The Scentronic system could also enable doctors to assess distortions in patients’ sense of smell, for example, in post-viral illness or neurodegenerative disease.

The Scentronic system is “a great idea” and a step in the right direction, says at University College London, although she points out that recognising a smell and then releasing a matching one from a limited library is very different from the ease with which we can transmit sound and vision. “There’s still a long way to go before we can truly record and replay smell experiences.”

Making quantum computers error-proof is one of the biggest challenges currently facing the technology. Researchers at Google Quantum AI have now demonstrated one way to do so more efficiently. Their work suggests the smaller quantum computers that will be available in the next few years could be more impactful than expected.

Quantum computers can run mathematical operations, analogous to addition or multiplication, that conventional computers cannot. This makes them suitable for solving some problems that had previously been considered unsolvable, such as those that underpin cryptography.

Most important among the quantum operations the computers run are “non-Clifford gates”, which are the key ingredients for algorithms that transcend conventional computation.

But there is a problem. Quantum computers are very error-prone, and their building blocks, called qubits, must be encoded into special groups, or “logical qubits”, before they can execute operations reliably. Executing non-Clifford gates in an error-corrected way requires large numbers of qubits, which means having to build very large quantum computers – a formidable engineering challenge.

Now, at Google Quantum AI and her colleagues have used the firm’s Willow quantum computer to show that the error-correction process can be made more efficient. Their new technique ultimately reduced Willow’s errors 40 times.

At the centre of their advance is the idea of a “magic state”, which is a special quantum state that qubits must assume before the quantum computer can run error-corrected non-Clifford operations. Creating these states had, so far, been a real bottleneck for quantum computing, says Rosenfeld. “It eats up a lot of qubits and a lot of time,” she says.

Free newsletter

Sign up to Professor Hannah Fry’s column

Sign up to newsletter

In 2024, her colleagues at Google Quantum AI proposed a more efficient method for creating magic states called “magic state cultivation”. Here, instead of many imperfect qubits being repeatedly combined and manipulated into a magic state that is then put towards running an error-corrected operation, the magic state is “grown” within a smaller patch of qubits.

The Google researchers showed that magic state cultivation could, in theory, enable quantum computers to run consequential programs with just one-tenth the number of qubits we had expected they would need. The new experiment by Rosenfeld and her colleagues proves that magic state cultivation works in practice.

This is not the first time that new methods for making magic states have lowered a quantum computer’s error rates. Advances in creating magic states and error-correcting non-Clifford gates have also been achieved in . Willow’s qubits, which are based on tiny superconducting circuits, achieved error rates similar to those past experiments, but Rosenfeld says that they work more quickly, potentially reducing the quantum computer’s overall runtime.

Atom-based quantum computers are catching up in the race to usefulness

A quantum computer made from extremely cold atoms can correct its own errors during long computations, an important prerequisite for becoming truly useful

“This is an impressive demonstration of a promising recent idea pioneered by Google,” says at the University of California, Davis. “It’s an approach that can make fault-tolerant quantum computing substantially cheaper.” The new work demonstrates one of the building blocks necessary for universal quantum computing and could be a “gamechanger” in terms of building intermediately sized quantum computers with hundreds of logical qubits, says at ETH Zurich in Switzerland.

at Imperial College London says that while this experiment is a significant step forward, Willow’s errors will need to be reduced further before it can tackle truly useful problems. Additionally, Kim says that in the experiment, Willow generated good magic states only for a fraction of its computational runs: only 8 per cent of Willow’s computations produced high-quality magic states that could then be put into further use.

Rosenfeld says that this percentage ought to increase as she and her colleagues refine the technique and improve Willow’s hardware. It is, in this case, also affected by a very careful benchmarking technique that the team used, which may not be used in future applications, she says. “This is the first demonstration that the concepts work. We’re not done.”

Much of the AI industry is built on stories, from the idea that AI could kill us all to the goal that it might one day become superintelligent. This often leads to problems, because when people have a story in their head, they don’t always look at the facts on the ground to check that they actually match the fiction. That has happened this week, with widely reported claims from Anthropic that we are mere “months away” from . That’s a great headline, and it’s hard to resist clicking, but it almost certainly isn’t true.

Let’s start with looking at what Anthropic has actually done. Two researchers at the company, and , ran an experiment in which they installed a small AI model, Gemma4-26B-A4B, across 15 Android TV boxes, the kind of thing you might plug into a TV to gain access to streaming apps. Such devices are computational weaklings, with tiny CPUs (the processor that runs software) and little RAM (the memory that stores data for software while it runs), which is why the Anthropic researchers needed 15 to store one model. Even then, the model could produce only 0.39 tokens per second, the unit of AI input and output, which is roughly equivalent to 18 words per minute. This is painfully slow – around 10 times slower than normal human speech.

Nothing in this part of the experiment is surprising. We know that AI models normally need to run on GPUs, a specialised and more powerful type of processor than a CPU, and large numbers of them – that is why AI firms are building massive data centres. What Zhou and Freeman argue is that such that a model distributed across TV boxes, smart ovens or other internet-enabled appliances could endlessly copy itself to create a form of “digital slime mold” that gums up a large chunk of these devices globally. Those three words are great, concise storytelling, but they paper over what’s really happening here.

When they actually tried to get a model to copy itself in this way, it failed. Three models were unable to set themselves up at all. A fourth model, GLM-5.2, succeeded in four out of five tests, but only at setting up another model, Llama3.1-8B, which is about 100 times smaller. The pair argues this is a fair test because it shows that a future smaller model with the same capabilities as GLM-5.2 could set itself up, but this is still far from self-replication. The claim that such a feat might be “months away” comes from extrapolating lines on a graph.

Putting all those objections aside, the broader question is why would anyone want to create self-replicating software? We already have an answer for that, and it doesn’t involve AI. Computer code that copies itself from one device to another is called a worm, and they have existed for more than 50 years. In the 1970s, Bob Thomas and Ray Tomlinson at US firm BBN (the latter invented email, as it happens) created a . It was not particularly complicated, and merely output the message “I’M THE CREEPER: CATCH ME IF YOU CAN”. Tomlinson paired this with Reaper, a piece of code designed to find and delete Creeper, making it the first antivirus software.

It wasn’t until about a decade later that such self-copying software was called a worm, after a term coined in the sci-fi novel The Shockwave Rider by John Brunner – storytelling becomes useful again. John Shoch and Jon Hupp at Xerox Palo Alto Research Center, arguably the Anthropic of its time, to describe how an experimental worm “seemed to grow out of control”, leaving “dozens of machines dead”. Sound familiar?

Big, clunky worms

was deployed on to the internet in 1988 by Robert Morris, a student at Cornell University in New York state. It is thought that thousands of computers were infected and crashed, a significant chunk of the online population at the time, and Morris became the first person charged under the US Computer Fraud and Abuse Act. Today, worms are deployed by cybercriminals to hijack computing hardware and make money. For example, in 2017 the was the result of a worm copying itself across computers and encrypting them, demanding payment in bitcoin to unlock. It infected more than 200,000 computers in a single day, including many in the UK’s National Health Service, and caused an estimated $4 billion in economic losses, although only around $100,000 of that was people paying the ransom.

If worms can be that bad, surely an AI-powered worm would be even worse? Actually, no, because an AI worm would find it much harder to replicate. According to Zhou and Freeman’s experiment, it would take multiple days for their AI worm to copy itself just once. That doesn’t mean such a worm couldn’t scale to large numbers, but it would be slower, taking more than two weeks to achieve the 200,000 devices WannaCry managed in a single day. That is because even small models like Gemma4-26B-A4B are large files – around 14 GB for the version in the experiment, which is about 4000 times larger than WannaCry – and these take time to transfer. That would make an AI worm much more noticeable, as network managers would be likely to investigate the source for such large data transfers and shut them down – something Zhou and Freeman admit.

What does an AI worm gain from all that extra data? Not a lot. Zhou and Freeman say that, assuming it could take more than 2 million Android TV boxes, the computing power available would be equivalent to around 40 high-end GPUs. To put that in context, leading AI firms like Anthropic typically operate hundreds of thousands these computer chips, and it would cost you around $100 an hour to rent access to that much computing power. It is hard to see why a cybercriminal would choose to do this rather than use a standard worm like WannaCry.

This is where we come back to storytelling. A long-standing fear for many in the AI sphere is that a model could “exfiltrate” itself, distributing itself across the internet and so resisting being shut down (before presumably killing us all, for some reason). Anthropic “whistleblower” Jacob Coxon . Could it be that an AI worm is proliferated by such an AI, rather than a human cybercriminal? Well, maybe. But the models that are most effective at hacking are also the largest ones – Mythos, a model Anthropic refused to release to the public because of its hacking capabilities, is estimated to require dozens of terabytes of storage and is more than 1000 times larger than Gemma4-26B-A4B. This is not something you sneakily copy around the internet, but it does make a great digital ghost story.

What I find particularly interesting is that this story about theoretical AIs hacking into devices and copying themselves seems to be crowding out a very important fact: actual AI hackers that attack computers already exist, and they are running on Anthropic’s own servers. In July, of a model gaining unauthorised access to third-party organisations. This was discovered only after an investigation prompted by reports that OpenAI’s models had done the same. Since then, more and more reports of such hacking have come out, including an OpenAI hack of an Australian government website, and on unnamed third-party breaches that came out just a few days before the AI worm research was published. The AI firms say they are taking steps to avoid this happening in the future, but it seems to me that big AIs on powerful server farms are the thing we need to worry about, not a model barely capable of sputtering out a few words per minute. Yes, future smaller models may become more capable, but hardware is always going to be a constraint – not least because the rise of AI server farms means that consumer hardware is seeing RAM shortages.

As I said at the top of this article, a self-replicating AI that takes over your smart oven is a great story, and I can see why it has spread so rapidly. But stories like this are a cognitive worm, hacking your critical thinking abilities by going straight for your fear response. Could this someday be a concern? Perhaps, although this article has hopefully poked holes in some of the storytelling logic behind the idea. Is it something we need to worry about in the next few months? Absolutely not.

Further AI reading

• OpenAI announced that a “” was found hidden in its offices. The company says it used its own AI models to investigate the device and traced it to a specific employee, who has been . OpenAI says it has no indication that any proprietary or customer data was accessed – but who needs a malicious AI when humans are ready and able to do the job?
• Character.ai is . The service let users create “characters” with specific personalities and it has courted controversy and multiple lawsuits over and .
• Epic Games, the makers of Fortnite and other video games, is pivoting towards using AI. “The aim isn’t to do the same stuff with fewer people, but to enable everyone here to build MORE and BETTER stuff”, . Games have been surprisingly resistant to AI, with multiple controversies about the technology’s use in game development exploding in recent years, but when one of the biggest game-makers on the planet goes all in, it may be hard to ignore.