Anthropic's Deputy CISO Jason D. Clinton Says Cybersecurity Will Get Worse in the Next 18 Months
Jason D. Clinton posted on X that the situation has been bad for the past 4 days and will get worse in the future. He advises security leaders to seek support from the board now, focusing on basic measures rather than AI, and states that we need to hold on for about 18 more months.
The post references his tweet from August 20, when he warned that a tsunami of vulnerabilities was imminent, and that critical infrastructure might not be patched in time, suggesting the implementation of network isolation (air gaps and data diodes) now.
In a reply, Clinton introduced the concept of "vulnzero." He predicts that in about 18 months, the law of expansion will compress Mythos-level cybersecurity capabilities into small, inexpensive models that developers can use at very low costs, eliminating the delivery of software with security vulnerabilities.
He further stated that model saturation in the cybersecurity field might occur around mid-2027 for high-end models, while vulnzero could emerge around mid-2028. He acknowledged that there would still be other security issues at that time.
Clinton previously mentioned at DEF CON and other events that the next 18-24 months could be the most stressful period in practitioners' careers, warning that open-source weight models might soon possess similar offensive capabilities.
From a market mechanism perspective, the enhancement of AI model capabilities accelerates the speed of vulnerability discovery and exploitation, outpacing the traditional patching rhythm. Defenders are advised to prioritize strengthening basic isolation and asset visibility; model vendors and toolchains are expected to change the cost of security checks in software delivery after capabilities are downscaled.
Source: Public Information
ABAB AI Insight
Anthropic's Deputy CISO Jason D. Clinton stated on X that the cybersecurity situation has worsened over the past 4 days and will get worse in the future, urging security leaders to seek board support for basic measures, expecting to hold on for about 18 more months.
In terms of capital pathways, he views the current crisis as a window for resource demands, with resources prioritized for traditional isolation methods like air gaps and data diodes rather than new AI defense budgets. He also predicts that the law of expansion will allow Mythos-level capabilities to be downscaled into small, inexpensive models.
This echoes his August warning about a tsunami of vulnerabilities and insufficient patch windows for critical infrastructure. We are currently in a phase where AI accelerates vulnerability discovery and exploitation, making it difficult for traditional patching rhythms to keep up.
Essentially, this is a technological substitution. The enhancement of model capabilities alters the cost structure of security checks in vulnerability discovery and software delivery. The mechanism is that high-end capabilities will be downscaled with the law of expansion, making low-cost real-time checks possible, thereby changing the delivery model of vulnerable software.
ABAB News · Law of Cognition
It has been bad for the past 4 days, and it will get worse in the next 18 months.
We need basic isolation now, not just AI budget.
Small models may achieve vulnzero in 18 months.