Cloudflare chief: AI is currently helping defenders more than cybercriminals

In the interview, Matthew Prince distinguished finding vulnerabilities from exploiting them: current attempts to exploit the PHP flaw do not require AI, he said; attackers are using simple scripts to scan servers. But he believes AI is increasing how quickly an attacker can work out what to do after gaining access. Prince cited the compromise of a widely deployed Salesforce plugin by a Russian hacker about a year earlier. In his assessment, the attacker did not understand the Salesforce environment and acted inefficiently. AI could suggest what to look for and steal.

Prince said agent “swarms” remain expensive to run, potentially costing hundreds of thousands or even millions of dollars. As a result, typical cybercriminals are still using AI rather naively, though state actors such as China or Iran are a different case. His assessment is that AI currently helps defenders more than attackers by helping find vulnerabilities. He warned that the next two years will be fraught, as AI tools can patiently search the internet for problems. He expects frightening attack stories, but predicts that cooperation between frontier AI companies and organizations such as Cloudflare will ultimately make the internet more secure.