The Great Unlocking: AI is Brute-Forcing the Internet's Forgotten Doors

### The End of Deterministic Security

For years, the cybersecurity industry operated on a predictable, if flawed, cadence: a researcher found a bug, disclosed it to a vendor, and a patch was eventually deployed. It was a slow-motion game of cat and mouse. But we have entered a post-deterministic era of exploitation. According to reporting from 404 Media, the integration of large language models (LLMs) and AI agents into the hacking toolkit is fundamentally altering the physics of offensive and defensive security.

This isn't about sentient machines or rogue agent swarms. Instead, AI is acting as a massive force multiplier for a truth we have long ignored: the infrastructure of the modern internet is a crumbling edifice of outdated code and forgotten configurations. As 404 Media notes, much of our digital life runs on software that is vulnerable, obsolete, or was installed by employees who left their companies years ago, leaving behind systems that no one knows how to update.

### Turning Every Knob

In the past, finding a critical vulnerability required deep human expertise and painstaking manual labor. Now, AI is enabling a form of automated, internet-scale brute-forcing. 404 Media describes this shift through a sobering analogy: if every piece of software is a door, AI allows attackers to turn the knobs of every single door simultaneously to see which ones are unlocked—including buildings that human researchers never thought to check.

We are seeing this play out in real-time. 404 Media reports a recent surge of vulnerabilities discovered across a wide array of services, including:

* **PHP**: The foundational language of much of the web. * **Node.js**: A primary alternative to PHP. * **Gitlab**: A critical software development platform. * **Plex**: Media server software. * **Railway**: A cloud provider. * **OpenCode**: A platform for coding agents. * **eMudhra**: An Indian entity providing website security certificates.

Some of these discoveries are not merely trivial. Researchers from OpenAI, Wiz, and Calif used AI to uncover a major vulnerability in PHP, dubbed "PHP2Shell." The speed of exploitation following the discovery was staggering. Matthew Prince, CEO of Cloudflare, told 404 Media that in the 10 hours preceding the public announcement of PHP2Shell, the Cloudflare network saw thousands of exploit attempts. That number surged to tens of thousands within 45 minutes of the announcement, hundreds of thousands within two hours, and eventually climbed into the millions.

### The Collapse of the Defender's Window

OpenAI has argued that its AI-driven research was conducted ethically, claiming the discovery created a "Defender's Window" that allowed critical infrastructure and governments to prepare before the bug was disclosed. However, the reality on the ground suggests that this window is slamming shut.

While AI can accelerate the discovery of bugs and the creation of fixes, the actual deployment of those fixes remains a human-centric bottleneck. 404 Media questions whether companies are actually deploying these AI-generated fixes any faster, suggesting the answer is likely "no."

Furthermore, the barrier to entry for attackers has vanished. 404 Media highlights that people are already using AI to hack Internet of Things (IoT) devices to run new software, a process that now requires essentially no expertise. The threat is compounded by the rise of "abliterated" AI models—versions designed to ignore safety constraints—and open-weights models that can be used for offensive hacking without the guardrails found in commercial products.

### A Landscape of 'Dry Tinder'

Among the experts, the mood has shifted from professional concern to genuine alarm. 404 Media reports that some AI employees have gone "full prepper," advising people to hoard water, purchase shelf-stable food, buy gold and cash, and disconnect from the internet.

Matthew Green, a Johns Hopkins professor and renowned cryptographer, provided a stark assessment of the current state of global connectivity. Green suggested that the entire internet is essentially "dry tinder," and the only reason it hasn't ignited is that "teenagers haven't found the matches yet." He compared the current security climate to a movie scene where one must throw anything available in the path of approaching zombies simply to slow them down.

As AI continues to shorten the gap between vulnerability discovery and exploitation, the industry is facing a crisis of unpredictability. The tension is so high that it is already fracturing professional norms; 404 Media notes that the security company Chainguard faced criticism for breaking an embargo on the PHP vulnerability disclosure to post fixes.

We are no longer dealing with isolated bugs; we are dealing with a systemic failure of the internet's architecture, now accelerated by an intelligence that doesn't sleep and doesn't miss a single unlocked door.