AI Hacking Code Red: Fund the Basics, Not AI

Anthropic deputy CISO Jason Clinton told security leaders to ask their boards for money for the basics, not for AI, and to hold on for about 18 months. Salesforce CEO Marc Benioff replied "Code red." The AI hacking code red warning is serious, but the evidence behind it is far thinner than the alarm suggests.

What did Clinton and Benioff actually say?

Clinton’s message was a budget instruction, not a technical alert. In a post on X, Anthropic’s deputy chief information security officer wrote that “as bad as things have gotten in the past 4 days, they are going to get a lot worse before they get better.”

The ask was specific: “security leaders, never let a crisis go to waste: please go to your boards and ask for help right now. not for ai, for the basics. (we need to hold on for ~18 months.)”

In an August post (year not stated; 2026 implied), Clinton predicted that “the vulnerability tsunami is coming in just a few months and there won’t be enough time to patch critical infrastructure.” The October post says the wave has started.

Benioff answered publicly: “Jason is 100% right. Code red.” That reply anchored an ABC News report published Oct. 31, 2026, which also circulated in r/cybersecurity_news.

Note who said what: a security leader at an AI lab told peers not to spend the emergency money on AI. Keep that line intact when “code red” reaches the board deck.

Which claims have no advisory behind them?

Neither the “70% of the internet” figure nor the Quest Diagnostics incident comes with anything a security team can act on. Sort the material first:

• Said: a senior AI-lab security leader expects disclosures to outpace patching for about 18 months.
• Claimed, unverified: two Oct. 21 bugs affecting up to 70% of the internet.
• Reported, unexplained: unauthorized access to Quest’s Quanum system on Oct. 22.
• Absent: CVEs, products, actors and any causal link between these events.

The report says the two Oct. 21 vulnerabilities sent companies and individuals scrambling to patch, yet names no CVE, vendor, product, affected version or research body behind the percentage. Without those, the number cannot be triaged.

Patch priority comes from the vendor advisory, affected versions, exploit prerequisites, CISA’s Known Exploited Vulnerabilities catalog and your own asset inventory. Log4Shell in December 2021 showed how far one embedded library can reach, but that precedent does not validate an unsourced percentage.

On Oct. 22, Quest Diagnostics, one of the largest providers of medical lab services, reported “unauthorized access” to its Quanum Lab Services Manager, in which “certain patient records” were accessed. The reporting gives no patient count, regulatory filing, attacker or method, and does not tie the incident to the Oct. 21 bugs or to AI.

Where AI changes the clock, not the bug class

Matt Shumer’s argument is about speed and operator skill. The AI engineer and investor listed three attacker advantages on X: models find vulnerabilities more easily; “AI can now break in on its own. No skilled hacker required”; and attacks outpace remediation.

The second point needs evidence. We have covered cases this year of autonomous agents stealing credentials at machine speed and five months when the attacker was the AI. None is connected to the October disclosures, and the ABC report names no actor or exploit class.

For defenders, the interval is the story. If discovery-to-exploit shrinks from weeks to hours, a 30-day patch SLA on internet-facing systems becomes a documented exposure window.

What should a board fund in the next 18 months?

Fund the controls that limit damage when you do not know which bug comes next. Credit freezes, IRS Identity Protection PINs and family safe words, which fill most of the original article, protect individuals. They are not a security program.

• Asset and dependency inventory. You cannot answer “are we in the 70%?” without knowing which products, versions and libraries face the internet.
• Emergency patch path. A tested out-of-band change process for edge systems, with rollback, measured in hours.
• Phishing-resistant MFA for admins. The article endorses any MFA, including emailed codes and 30-second authenticator codes. CISA classifies FIDO2 passkeys and hardware keys as phishing-resistant; one-time codes can be relayed.
• Recovery paths. Help-desk resets, SMS recovery and remembered sessions can bypass a strong login.
• Queryable logs. Identity provider, VPN, application and export logs kept long enough to tell account misuse from exploitation or exfiltration.

Practitioner’s note: in our engagements, the fastest route to sensitive data is rarely a fresh zero-day. It is a reused credential, an unmonitored admin portal or a recovery flow nobody tested, and AI makes those cheaper to find too.

If you run agents internally, put them in scope: AI agent penetration testing covers tool abuse and privilege paths a patch cycle never touches.

How do you brief leadership without laundering an unsourced number?

Lead with the said, claimed, reported and absent split, then attach your own numbers: median time to patch internet-facing systems, MFA coverage for privileged accounts and log retention. Those three figures tell a board more than any percentage in a news report.

Hygiene improves the odds but does not stop every compromise. The goal for the next 18 months is a shorter exposure window and a smaller blast radius, not immunity.

FAQ

Who is Jason Clinton and what is the vulnerability tsunami warning?

Jason Clinton is Anthropic's deputy chief information security officer. In an August post on X (year not stated), Clinton warned that a 'vulnerability tsunami' was months away and critical infrastructure could not be patched in time.

Did Salesforce's Marc Benioff declare a cybersecurity code red?

Benioff replied to Clinton's October post with "Jason is 100% right. Code red." It was an endorsement, not a Salesforce advisory or incident disclosure.

Is there a CVE for the bugs said to affect 70% of the internet?

Not in the reporting. The claim names no CVE, vendor, product or version, so it cannot drive patch prioritization until mapped to a vendor advisory.

Was Quest Diagnostics' Quanum incident an AI attack?

There is no evidence of that. Quest reported unauthorized access to certain patient records on Oct. 22, with no attacker, method or link to AI or the Oct. 21 bugs disclosed.

If the next 18 months are about shrinking exposure, start by finding out what an attacker sees today. An external network penetration test from agent::offense maps your internet-facing attack surface before someone else’s model does.