Anthropic Security Chief Warns Cyberattacks Will Get Worse Before They Improve

Anthropic's Deputy Chief Information Security Officer warned on October 22, 2026 that cyberattacks will worsen before defensive tools catch up. Jason D. Clinton posted the assessment on X after a wave of breaches and disruptive attacks hit organizations across Europe.

His message to security leaders was blunt: use the current crisis to secure organizational backing now.

"As bad as things have gotten in the past 4 days, they are going to get a lot worse before they get better," said Jason D. Clinton, Anthropic's Deputy Chief Information Security Officer.

Clinton urged chief information security officers to go to their boards immediately. He asked them to request funding for fundamental security measures rather than AI-related initiatives.

"Security leaders, never let a crisis go to waste: please go to your boards and ask for help right now. Not for AI, for the basics," he wrote.

What is driving the warning?

Clinton repeated a caution he first issued in August 2026 about a coming surge in software vulnerabilities. He warned that critical infrastructure operators may lack sufficient time to patch serious weaknesses as the number of exploitable flaws grows.

He pointed to the concept of "vulnzero," the goal of eliminating software vulnerabilities entirely. He expects advanced AI security tools to become cheaper over time. That could let developers find and fix weaknesses before software reaches production.

Until such tools enter everyday development practice, the advantage sits with attackers. Hostile actors can already use existing AI capabilities to find weaknesses in older software, automate the discovery of security flaws, and exploit known vulnerabilities before defenders deploy patches.

The industry-wide alert comes with a hard timeline attached: Clinton called on security leaders to sustain focus for roughly 18 months while AI-driven attack capabilities keep evolving.

How bad are the current attack numbers?

Global attack attempts rose 48 percent in September 2026 compared with the same month a year earlier, according to cybersecurity company Check Point.

Recent incidents in Switzerland show how attackers reach targets through technology partners:

• The federal pension fund Publica, hit through software vendor PK Softech, which suffered a malware attack that potentially exposed salary information, retirement savings, account numbers, addresses, social security numbers and spousal details.
• The City of Zurich's pension fund, also affected by the same incident chain.
• The Swiss Broadcasting Corporation (SRG), online magazine Republik and space company Beyond Gravity.

Republik disclosed that attackers exploited a vulnerability in the Metabase analytics tool. A patch had been available since August 6, 2026. The magazine did not install it in time. Attackers accessed names and email addresses of current and former readers, plus additional personal details for some individuals.

The incidents exposed weaknesses in software suppliers and third-party services. They demonstrated how attackers can compromise organizations indirectly through their technology partners.

What breaches show the potential scale?

Denmark's central population register lost approximately 8.8 million records to theft after attackers exploited access through a private IT company. In Britain, retailer ASOS reported a breach involving customer information. A separate attack on Discord's third-party security provider exposed account-related data.

Cybersecurity experts cite two structural factors increasing exposure. Digital services keep expanding, and technology dependencies keep growing more complex. Supply chain breaches (attacks that compromise a target through a software vendor or connected service) let attackers bypass direct defenses entirely.

Expanded incident-reporting rules may also inflate the volume of public reports. The European Union's NIS2 and DORA frameworks (directives governing cybersecurity and operational resilience reporting for critical and financial sectors) require organizations to notify authorities about incidents. Organizations that notify authorities may also disclose incidents publicly for transparency, increasing the number of attacks reported in the media.

What should enterprises do now?

Clinton's guidance is narrow and immediate. Prioritize patching discipline, vulnerability management and board-level support over AI spending. The Metabase incident illustrates the cost of delay: a patch existed for more than two months before attackers used the gap.

He urged the technology industry to prepare for an extended period of elevated risk. Stronger defensive capabilities will take time to develop and deploy at scale. Until then, defenders must close known gaps faster than attackers can find them.