AI hacking claims: The 70% PHP figure and disputed attacks
The video traces four AI hacking claims back to their sources. It explains why PHP's reported use by about 70% of websites is not a breach count, while distinguishing real flaws and attack attempts from confirmed compromises.
It examines reported agent access to Indian business records, an unconfirmed ₹300 crore lender-loss estimate and Cathedral's disputed account of access to Anthropic business systems. A separate Linux exploit claim remains unreproduced.
A test project shows why deleting a key leaves it in Git history. The video concludes with software updates, credential rotation, least-privilege agent access and checking original sources before sharing claims.
Key points
- The 70% figure describes PHP usage, not hacked websites; serious flaws and attack attempts do not establish mass compromise.
- Agents reportedly reach Indian business records through exposed credentials and excessive permissions, not a demonstrated firewall bypass.
- The ₹300 crore lender-loss estimate and AI attribution remain unconfirmed, despite an official warning about secret-key theft.
- Anthropic acknowledges some business-system access but disputes Cathedral's account of the timing and extent.
- Anthropic's separate Linux exploit claim remains unproven because the exploit is unpublished and no reproduction is reported.
- The practical response is to update software, rotate exposed keys, limit agent permissions and trace claims back to their sources.
Chapters
The description and key points were written with AI from the video's transcript and checked against it, then reviewed by Vishal on . The video plays from YouTube. How we write and check our work.
