In October, cybersecurity experts feared that the discovery of critical vulnerabilities using artificial intelligence would lead to a wave of successful attacks. So far, however, the scenario has proved less catastrophic than expected: despite millions of hacking attempts, the number of confirmed successful attacks remains small. One reason is that the vulnerabilities have proved difficult to exploit in practice; another is that companies managed to take protective measures in time.

The situation reminds experts of Y2K, or the “year 2000 problem”: in the late 1990s, fears that computer systems would be unable to handle the arrival of the new millennium correctly prompted organizations to undertake extensive preparations. A catastrophe was avoided through coordinated efforts. Companies may now have a similar window of opportunity to prepare for a new wave of cyberthreats, Axios reports.

Why widespread vulnerability discovery has not yet led to catastrophe

The alarm was triggered by critical vulnerabilities in PHP, a programming language that powers a substantial share of websites. They were discovered by OpenAI's AI agents. Problems in Brotli, a widely used data compression library, soon came to light as well.

These discoveries raised concerns that malicious actors could use AI to find weaknesses in software at scale and quickly create attack tools. However, discovering a vulnerability and turning it into a working exploit are not the same thing. Despite numerous attempts to develop attack code, exploiting the flaws proved more difficult than expected.

Protective measures also played a role: companies began checking their systems and fixing vulnerabilities without waiting for widespread consequences.

Still, the situation's relative stability does not mean the threat has been exaggerated. Samantha Lewis, head of threat intelligence at Armadin, warned Axios that the next such situation could arise at any moment. According to her, another wave of attacks need not be years away—it could begin within hours.

October served as a warning to the entire industry

The month has already been unofficially dubbed “Black October” because of a series of vulnerability discoveries and attacks on infrastructure related to AI development and use.

Beyond PHP and Brotli, several incidents affecting developer platforms and artificial intelligence tools also drew attention. Breaches of OpenCode, Railway and LiteLLM put users' API keys and other credentials at risk.

Rob Joyce, the former head of the U.S. National Security Agency's cybersecurity division, warned that the industry is moving from a period of mass vulnerability discovery to one of widespread system compromises.

The main change is that AI accelerates several stages of attackers' work at once: finding flaws, analyzing code and preparing potential attacks. This means defenders will have to respond faster, even if far from every discovered vulnerability proves exploitable.

Greg Clark, CEO of cybersecurity company ExtraHop, called the developments both the most alarming and the most exciting of his career. He said the technology genuinely works and could transform the industry. Rubrik CEO Bipul Sinha, meanwhile, described the current period as an “era of cyber tsunamis” from which no one will be fully protected.

Defense must be built on basic measures

Experts say companies do not need to abandon existing approaches to security. Instead, they should strengthen fundamental safeguards and prepare in advance for a sharp increase in the number of vulnerabilities being discovered.

Justin Timothy, a cyberthreat intelligence consultant at GuidePoint Security, recommends prioritizing robust multifactor authentication. Even if attackers can find technical flaws faster, basic security measures can make it harder to access critical systems.

Bipul Sinha advises organizations to identify which services and processes are most important to keep running and develop plans in advance to restore them after an attack. During a major incident, the ability to bring key systems back online quickly may prove just as important as preventing the initial intrusion.

Greg Clark suggests training corporate AI tools to recognize an organization's most valuable data and systems and determine how to protect them automatically. Samantha Lewis urges companies to proactively check their systems for exploitable vulnerabilities before the next critical flaw becomes public.

Security is therefore measured not only by the ability to prevent a breach, but also by readiness to detect an intrusion quickly, limit the damage and restore operations.

The Y2K lesson: a respite does not mean the danger has passed

At the end of the 20th century, the Y2K problem sparked fears that many computer systems would fail as the date changed from 1999 to 2000. Widespread disruption was avoided through advance software testing and updates, as well as coordination between companies and government organizations.

Today's situation is different in nature, but the similarity is that the warning came before the worst-case scenario materialized. Companies have an opportunity to use this time to fix known vulnerabilities, assess their infrastructure and prepare response plans.

AI is already making it easier to find weaknesses in long-established software. Even if the current vulnerabilities are difficult to exploit, future flaws may make it much easier to develop a working attack.

The current lull should therefore not be taken as proof of security. As with Y2K, avoiding the worst-case scenario depends not on luck, but on timely preparation. In the AI era, response speed, infrastructure resilience and the ability to restore systems after successful attacks are becoming especially important.