You know the scene in Aliens where Ripley and her surviving comrades are huddled in a darkened supply room, sweating it out as their motion trackers beep louder and louder — and then the aliens start crashing through the ceiling? That has pretty much been the state of the web for the past few weeks.

The sudden bug apocalypse was, in a way, caused by AI — not because AI agents went rogue, but because they were following orders to pinpoint critical vulnerabilities across the internet, and they found some whoppers.

What the crawlers turned up

It started with critical flaws in PHP, the scripting language that roughly 70 percent of websites depend on, and quickly spread to Brotli, a file compression format commonly used by web servers, and Node.js, a software engine used by a huge share of modern web apps. On top of that came word that eMudhra, a distributor of digital certificates that websites and apps use to verify their identities, had been passing out compromised credentials.

If that all sounds like gobbledygook, substitute mad cow disease for PHP or a milk recall for Brotli. These have been staple elements of the internet for years, and now suddenly we cannot trust them. The uncomfortable part is not that any single one of these components was flawed. It is that they were flawed simultaneously, quietly, and in code paths that most people never look at until something falls over.

Why everything seemed to break at once

Why did so many things on the web break all at once? It turns out they did not. Many of those vulnerabilities had been hidden and undiscovered for months or even years. Today's advanced AI models are finally powerful enough to shine a light on them — and they did, all at once, because the same models are cheap enough and fast enough to be pointed at enormous volumes of source code in parallel.

That is a structural change, not a one-off event. Historically, vulnerability research was a bottlenecked human activity: a small pool of skilled researchers working through code by hand, prioritizing whatever looked most valuable or most reachable. An AI agent reads far faster, does not get bored by sprawling dependency trees, and can compare one codebase against thousands of others to spot the pattern that recurs. The result is that latent flaws which once waited years for a human to notice are now surfaced in weeks, or days, or in bunches.

The upside is enormous: bugs get fixed before attackers find them at scale. The downside is that the fix queues arrive all at once, and the people doing the fixing are the same small, exhausted group as always.

A basement full of bugs

Having spent years diligently patching and updating a personal homelab, the assumption going in was that the setup was in reasonably good shape. So the obvious experiment was to point a pair of AI coding agents at it and ask them to crawl into the basement and take a closer look.

What they found were bugs. Lots of them. That PHP vulnerability? Check — a self-hosted RSS reader and a read-it-later app were both wide open to remote code execution through crafted requests. The Brotli bug? Present as well, in unpacked packages sitting on all four Raspberry Pis. The compromised certificates were still trusted by the homelab's VPN, and unpatched Node.js runtimes lurked inside a handful of other services that had been quietly running for months without attention.

None of these were exotic. Every one of them was the kind of thing a scanner would have flagged months earlier if anything had been aiming a scanner at it. But a homelab is the classic case of infrastructure that nobody audits, because the operator is also the only sysadmin, and the operator is busy.

Patching the resulting pile of vulnerabilities is still a work in progress. The agents have been filing one to-do item after another, with a second and third model acting as auditor, hopscotching from one code repository to the next in search of new bugs to squash. One system — a Raspberry Pi 3 that is more than a decade old — is currently down for the count after a failed reboot to install patched OS packages. So it is a bit of a mess.

And that is just one home setup, hosting nothing mission-critical. For the internet at large, it is something of a miracle that sites and services are still standing.

The patch treadmill and the people who keep it running

The heroes of the past few weeks were the systems administrators who dropped everything, worked through nights, and rebuilt packages under pressure. That work is invisible when it succeeds and catastrophic when it is skipped. It is also, increasingly, a job that AI agents can only partially do: they can identify a vulnerable version, read a changelog, and propose a patch, but they cannot always tell whether applying it will break the one bespoke service that a small business depends on for orders.

Meanwhile, the incentives are grim. The same class of models that surfaced this batch of critical flaws will surface the next batch, and the batch after that. Vulnerability discovery is becoming continuous rather than episodic, which means remediation has to become continuous too. Most organizations, and nearly all hobbyists, are still organized around the opposite assumption: that security is a project with an endpoint rather than a standing bill.

So the pattern now is a loop: wait for AI to find the latest batch of five-alarm bugs, then wait for AI to help fix them, then wait again. Around and around.

More in AI this week

• One chatbot now supports texting with its personal agent, complete with back-and-forth tapbacks. Nice, but getting your own agent still starts at $100 a month.
• Reviewers spent time with an AI-focused RTX Spark laptop from a gaming perspective, and it holds up. But these $2,600-and-up systems are built for agents, not Grand Theft Auto.
• Anthropic's long-awaited IPO filing is packed with eye-popping statements, including a warning that all the world's insurance providers could not cover a catastrophic AI incident.
• Had it up to here with AI-generated summaries at the top of search results? A browser extension wipes them off the page.
• It is all too easy to go with the flow of an AI's recommendations. In one recent study, professional analysts went with their agent's advice 86 percent of the time — even though the agents had been instructed to arbitrarily lean one way or the other.
• Startup conference season has come and gone, but it is not too late to get an AI vibe check from the show floor, where agent-washing was everywhere and demo fatigue was real.

Prompt of the week: the three-in-one prompt

Three separate prompts have been covered in this space before. One discourages an assistant from pretending to be human, with warm little flourishes and self-referential chatter. One stops it from wasting time and tokens by re-explaining the question, restating the context, or padding the answer to seem thorough. One prevents the closing sales pitch — the inevitable paragraph beginning with a variation of if you like, offering follow-up questions nobody asked for.

Individually, all three works well. The useful question is what happens when you combine them, because custom instructions have a tendency to conflict: constraints that shrink an answer can also make it terse in ways that lose detail, and instructions meant to sound professional can accidentally strip out the disclaimers that matter.

With help from two frontier models, I built a single three-in-one prompt that addresses all three objectives at once, and it performed well in initial testing. The structure that worked was to lead with identity and voice, then define output discipline, then explicitly close the ending loop rather than relying on a general instruction to be concise. It is built in three layers: one that sets the voice as a direct, non-human assistant and bans persona flourishes; one that commands a single-pass answer with no restatement of the question and no padding; and one that explicitly forbids closing offers, upsell questions, and follow-up suggestions unless they are requested by name.

The lesson is that instructions at the end of a conversation carry more weight than instructions at the start, so forbidding closing pitches must sit in the final clause — not buried in paragraph one. And layering all three objectives into a single paragraph produces cleaner results than pasting three separate rules that quietly contradict each other.

Source:PCWorld News