
The information displayed in the AIM should not be reported as representing the official views of the OECD or of its member countries.
AI systems, including OpenAI's GPT-5.6 Sol and Google's Gemini 4 Argon, uncovered two critical security vulnerabilities in PHP, a language powering most websites. The discovery led to widespread cyberattacks, forcing government, banking, and public service sites offline worldwide, and prompting emergency security patches and global cybersecurity alerts.[AI generated]
Why's our monitor labelling this an incident or hazard?
The event explicitly involves AI systems used to discover a critical security vulnerability in PHP, which is a foundational technology for many websites. The vulnerability has caused real harm by forcing many sites to shut down temporarily, disrupting services globally, and exposing sensitive data to potential theft. The AI's role is pivotal in both uncovering the flaw and the potential for misuse by attackers. The harms include disruption of critical infrastructure (websites and online services), potential data breaches (harm to property and communities), and security risks. This meets the criteria for an AI Incident because the AI system's use has directly led to significant harm and disruption.[AI generated]