The short version: AI tools have become very good at finding software weaknesses, which helps the people who fix them and the people who attack them, and the time between a flaw being found and being exploited has dropped from months to minutes. This does not mean the web is suddenly unsafe. It means a well-built, well-maintained website is still safe, while a neglected one is more exposed than it was a year ago. The response is not panic, it is proper upkeep.
This is a real shift in how website security works, not a passing news story, so it is worth understanding calmly. Here is what changed, what the experts actually say, and what it means in practice for a small business site.
What actually changed
For years, finding a serious software vulnerability took a skilled human researcher a lot of time. AI has compressed that. Tools now exist that can comb through enormous amounts of code and surface flaws that had gone unnoticed for years, sometimes decades. The clearest public example came in early 2026, when Anthropic revealed a model capable of finding and exploiting software vulnerabilities at a scale beyond all but the most skilled human researchers, and chose not to release it openly because of the risk. In mid-2026 the US government went further and ordered the most capable versions taken offline entirely. When the people who build these tools, and their regulators, treat the capability as dangerous, it is worth taking seriously.
The key point is that this cuts both ways. The same ability that lets a security team find and patch a weakness before anyone exploits it also lets an attacker find and exploit it faster. As one security industry chief put it, the gap between discovery and exploitation has gone from months to minutes.
What the experts actually say
The measured voices in security have been calm about this, which is reassuring. The respected cryptographer Bruce Schneier has pointed out that finding a flaw in order to fix it is currently easier for AI than finding one and successfully exploiting it, which still gives defenders an edge for now. Others have framed it as the acceleration of a trend already underway rather than a sudden cliff edge. The consensus, even among the cautious, is that this is a genuine shift in degree, not the end of the safe web. The direction is clear even if the pace is not.
Why platforms like WordPress are most exposed
The risk is not spread evenly. Platforms with very large shared codebases present the biggest target, because a single flaw found in a popular component can affect a huge number of sites at once. WordPress and its vast ecosystem of plugins is the obvious example, simply because it runs so much of the web. This is not a reason to abandon WordPress. A WordPress site that is built well and kept properly updated is still a perfectly safe choice. It is a reason to take the upkeep seriously, because a WordPress site left to drift between updates now carries more risk than it used to.
Why a smaller attack surface helps
This shift has quietly strengthened the case for modern static and headless builds. A site assembled ahead of time and served as flat files has far less for an attacker to push against: no live database to break into, no plugin code interpreting visitor input, no content system running on the server with every page load. That was a nice property a year ago. It is a more meaningful one now. We are not saying every site should be rebuilt this way, only that the trade-off has shifted, and we will be honest with you about it.
What this means for your website
The practical conclusions are simple and not at all alarming. If you run WordPress, make sure it is genuinely maintained: updates applied, sensible security in place, backups taken, someone keeping an eye on it. Proper managed hosting now does more real work than it used to, and is worth it. If you are planning a new site where speed and safety matter more than heavy functionality, a modern build is worth a serious look. None of this is a reason to worry about the site you have. It is a reason to make sure someone is actually looking after it. This piece sits within what your website is built with, and the practical side of keeping a site safe is part of the hosting and care we do, including putting a compromised site right when the worst has already happened.
Update: July 2026
Since this was published, the story has moved on, so here is a short note to bring it up to date.
The most capable models referred to above, Anthropic's Fable 5 and Mythos 5, were released in June, briefly suspended by the US government over a security concern, and then brought back. Fable 5 returned for general use on 1 July, and the more capable Mythos 5 was restored to a set of vetted organisations for defensive security work. So the point about the most capable versions being taken offline was true for a short window in June, but they are available again now.
Two things became clearer in the process, and both make the picture calmer rather than more worrying.
First, this ability to find software flaws at speed is not one rare, tightly held model. Anthropic's own testing confirmed that several cheaper and widely available models, including open-weight ones that anyone can download, can find the same flaws. That sounds alarming, but the honest reading is the opposite of panic. It is a general shift in what today's tools can do, not a single superweapon, and the broad industry view is that AI is currently speeding up familiar attacks rather than inventing new kinds.
Second, on timing: the sharper way to put it is that the gap between a flaw being disclosed and being exploited has fallen from around two months in 2024 to a matter of hours in 2026. That is the figure behind the shorthand, and it makes the same point without the drama.
None of this changes the practical advice. A website that is built well and looked after properly is still a safe website. If anything, the past few weeks have strengthened the case for proper upkeep, not weakened it.