AI Exposes Fragile Defenses for Email and Bank Accounts

AI detected a critical flaw in PHP before anyone could make a fix, putting systems that guard email and bank accounts under a harsh spotlight. News of the flaw leaked last Thursday, sending much of the internet searching for patches and fixes. Tyler Cowen says stronger defenses can buy time and prevent a crisis, but the episode also showed how much depends on protections that may not exist yet.

The flaw reaches beyond one website

PHP is a programming language used to build websites. Cowen wrote that many older websites would probably become permanently dysfunctional after the flaw came to light. Many governments took their websites offline temporarily to limit hacking risks, shifting the cost of a vulnerability onto public services and the people who rely on them.

AI commentator Zvi Mowshowitz called the episode “probably worst day in cybersecurity history. So far.” Cowen said the flaw probably wouldn't crash the economy, but warned future problems could prove more serious. Patches, fixes and government websites going offline showed the scramble institutions faced once the weakness became public and a repair wasn't available.

The episode's reach matters. The systems at issue aren't just technical abstractions. Cowen said systems guarding email and bank accounts are vulnerable to attacks. Those services hold access to messages and money, while users don't control the software defenses behind them. Cowen's prescription is to build the best defenses possible, buying time and preventing a crisis; his warning is that time may be all those defenses can buy.

A larger question about the barriers

Cowen is also following concerns about possible AI breakthroughs in cryptography. Such advances could, in theory, expose email, online transactions and bank accounts. He cited headlines reading, “Vitalik Buterin Warns AI Could Break Lattice Cryptography Within Two Years” and “Claude AI Solves 25-Year NSA Cryptography Mystery in Just 30 Minutes.” Those headlines describe concerns and a reported breakthrough, not evidence in Cowen's article that the cited accounts or transactions have already been exposed.

The Claude example involved an AI model from Anthropic, where Cowen said he is an economic adviser. Cowen wrote that the model broke through a barrier no human had managed to cross. That raised a blunt question in his account: whether any barrier was safe. The question lands in a world where governments, websites and account holders rely on defenses that must keep working even as AI finds weaknesses.

Cowen said the PHP flaw was unlikely to bring down the economy. He didn't dismiss the possibility that future problems could be more serious. His argument is to prepare before a crisis, but the article also describes a system where news of a flaw can spread before a fix is available, older websites may not recover, and governments respond by taking their own sites offline.

Who is making the warning

Cowen is a columnist at The Free Press and the Holbert L. Harris Professor of Economics at George Mason University, where he serves as faculty director of the Mercatus Center. He's also an economic adviser at Anthropic, the company behind the AI model in the cryptography example. The article appeared in The New Economy, a series on technology, business, markets and forces remaking work and life.

The page also advertised a Tyler Cowen AMA on AI and other things, scheduled for Friday, October 30th, at 2 p.m. For now, the warning is less about a single crash than about dependence: systems central to email, transactions and banking need defenses that can keep pace with vulnerabilities their users can't see.