The BaseEssayDon't Worry About the Vase

The Hackening

Zvi Mowshowitz collects reactions to the PHP flaws found with AI and other recent hacks, argues the episode weakens the case that defenders will outpace attackers, calls for more patching resources and wider defender access, and lists personal security steps.

Open the source ↗
About Anthropic or ClaudeClaude, made by Anthropic, wrote this entry. It follows the same rules as every other entry, whoever the entry is about.

Why it matters

The same thing, for different readers.

What it means for you

Zvi Mowshowitz advises ordinary people to take basic security steps now, such as a password manager and app-based two-factor login, and not to panic or cancel travel.

For lawmakers

Zvi Mowshowitz argues officials should put far more resources into patching and widen defenders' access to strong cyber tools, with trusted identity checks.

For researchers

Zvi Mowshowitz notes defenders found the PHP bug on 1 August yet exploitation began 17 October, so an 11-week lead may not be enough.

The question it raises

Zvi Mowshowitz asks whether it is ethical for AI and chip companies to start a race in which everyone must buy defenses.

In their own words

Every quotation was found, word for word, in the text we saved from the source. That shows the words are there; it does not make them true, or prove the speaker meant them as quoted.

From the source’s own text.

“defenders actually had a full 11 week lead, as the defenders found this bug on August 1, yet this took so long that we started to see exploitation on October 17. If we need more time than that, we are cooked.”
Zvi Mowshowitz, writerZvi Mowshowitz on why finding the PHP bug first did not reassure, in a reply to the debate over whether defense outpaces offense.
Found word for word in the sourcestarts inside a longer claim, right after “that”
“I think this is an update against defenders being advantaged, and it is distressing to see people calling Nate’s statement ‘disinformation.’”
Zvi Mowshowitz, writerZvi Mowshowitz sides with Nate Soares's view that the PHP episode counts against the defense-favoring theory.
Found word for word in the source
“We have passed the Point of No Return on swarms of attackers and defenders battling it out on cybersecurity, and the defenders had better mostly win.”
Zvi Mowshowitz, writerZvi Mowshowitz after quoting Yo Shavit on the ethics of a cyber arms race, while saying the race should be slowed.
Found word for word in the source
“Remember this is a long haul problem, not an acute crisis. You want precautions that you can sustain.”
Zvi Mowshowitz, writerClosing personal advice from Zvi Mowshowitz after listing basic security steps.
Found word for word in the source

The record

Questions
How is AI used in attacks, defence and war? · Can AI systems act beyond what people intended or allowed? · How fast is AI advancing, and where is it heading?
People
Zvi Mowshowitz (Wrote it) · Nate Soares (Mentioned, MIRI) · Dean W. Ball (Mentioned, OpenAI) · Jason Clinton (Mentioned) · Peter Wildeford (Mentioned)
Also covered by
LessWrong
What we read
We read the whole source.
Found by
The Radar, run of October 24, 2026, via zvi-mowshowitz (tier 1: the source’s own channel or an official record)
Cite this
Don't Worry About the Vase, “The Hackening”, October 23, 2026. Entry in the Ctrl AI Base, https://ctrlai.com/base/zvi-mowshowitz-2026-10-23-the-hackening
Our notesThe post is a long roundup of other people's posts and reports (Reuters, Axios, Microsoft, OpenAI); only Zvi Mowshowitz's own prose is quoted. Numbers and dates about the PHP bug are Zvi's or those quoted, not independently checked. Contested claims such as 'GPT-5.6 Sol found the flaw' are reported by Zvi from others.