• Everyone complains about AI-generated junk.
• But decades of sloppy human-written software may be a much bigger problem.
• This week's "Black October" freakout was caused by human slop, not AI.

The internet has a slop problem. And for once, we can't blame AI.

Most of us spend hours online every day without thinking much about the software holding everything together. We assume somebody, somewhere, has made sure it all works properly.

So it probably came as a shock this week to discover just how vulnerable some of that software is.

The cybersecurity freakout dubbed "Black October" has inspired warnings about AI-powered hackers, digital catastrophe, and even advice to stockpile cash and canned food.

At first glance, AI looks like the villain. But this is largely a human-made mess.

Here's the problem.

The internet runs on decades of software, some of it containing security weaknesses that have been overlooked, tolerated, or simply left unfixed.

For years, that was a manageable gamble. Fixing software takes time and money. Exploiting obscure weaknesses often required considerable expertise. Companies could convince themselves that the risk wasn't worth worrying about.

AI is changing that calculation. Someone who once needed years of training to hunt for weaknesses can now get help from an AI model. These tools can also examine software at speeds that humans can't match.

Suddenly, all those problems we've been ignoring look more urgent.

"Over the last 10 years the risk acceptance process has morphed from a way to accept risks to enable the business, to a way to justify never fixing security issues," Joel de la Garza and Zane Lackey, partners at a16z, wrote on Friday.

That's quite an indictment. The result is a recent surge in published vulnerabilities.

This looks like AI is creating new security problems. But it's actually AI exposing weaknesses that humans left behind.

Slop irony

The irony is delicious. We've spent the past couple of years complaining about "AI slop." Turns out human slop can be pretty consequential, too.

"The funny thing is everyone was saying AI slop code will cause a cyber crisis but it's actually all the old human slop causing it and the AI is just cleaning it up," software engineer Ben Kaufman wrote on X on Thursday.

"Humans have been the ones writing and reviewing each other's code for decades," tech founder Anant Jain wrote on X. "If we're being intellectually honest and holding ourselves to the same bar we hold AI to, we'd have to admit that we haven't been all that good at it either."

Humans are sloppy

Anyone who's worked with other humans for a decade or two knows exactly how this happens.

It's Friday afternoon. You've almost finished a project. You could spend another few hours making it perfect, or declare it 90% done and head off to that dinner party. We've all been there.

AI agents don't have dinner parties. They don't get tired on Friday afternoons. They can keep searching, testing, and trying again. That persistence is now colliding with an internet built by busy, imperfect humans who often settled for "good enough for now."

A tragedy of the commons

There's another wrinkle here, though, and it's an important one.

Much of the software underpinning the internet is freely available for anyone to use. Some of it is maintained by volunteers or small groups of experts, even as enormous technology companies depend on it.

In 2020, the cartoonist Randall Munroe captured this absurdity in an xkcd comic. Modern digital infrastructure still rests precariously on tiny foundations.

It's funny because it's uncomfortably close to reality. Take the specific PHP problems from this week. These flaws have existed for years, and the PHP Foundation acknowledges that limited resources and disagreements over fixes contributed to delays in fixing them.

Tom Occhino, chief product officer at Vercel, brought up Munroe's cartoon during my recent interview with him.

He explained that AI is finding weaknesses even in software that the industry has treated as dependable for decades.

This is partly a version of the tragedy of the commons: Everyone benefits from a shared resource, but no one has sufficient incentive to take responsibility for maintaining it.

And let's be clear: The volunteers keeping essential software running aren't the villains here. The companies benefiting from their work have a much greater responsibility.

Occhino thinks AI could help solve the problem it is exposing.

He described an idea being discussed at Vercel: Create a foundation or coalition that funds efforts to identify vulnerable software and replace it with safer alternatives.

"We need a consortium. We need a coalition," he told me.

He suggested companies could contribute computing resources and AI tools to the effort. Nothing has been formally announced, but the idea is compelling.

Indeed, OpenAI's Patch the Planet effort is an example of what's possible.

Rather than simply using AI to create more software, the industry could use it to repair what already exists.

Occhino put it nicely: Companies need to spend less time chasing new ideas and more time asking how to make existing systems "just work really, really well."

That's a better response than panicking about the imminent collapse of the internet.

AI didn't create decades of neglected software. We did. Perhaps it's time to clean up our own slop.

Sign up for the AI Insider newsletter here. Reach out to me via email at abarr@businessinsider.com

• Cybersecurity researchers say the PHP vulnerability has repercussions for normal people, too.
• Even if you don't own a website, hackers could use the vulnerability to steal your information.
• One quick fix: diversify your passwords.

If you're still using the same password for everything, it might finally be time to get on that.

While the major cybersecurity vulnerabilities that OpenAI agents helped expose on Wednesday primarily impact the owners and operators of websites, it could also give hackers the opportunity to hijack your personal information, researchers said.

"Be extra careful visiting ANY web site in the next few days," Changpeng Zhao, the cofounder of cryptocurrency platform Binance, said on X.

OpenAI said on Wednesday that researchers using its AI models uncovered two "critical" flaws in the infrastructure of PHP, a popular open-source programming language used on about 70% of the world's websites.

Because digital commerce websites, for instance, can store personal shopper information in PHP systems, that information would be accessible to a bad actor exploiting the web provider's system if that provider hasn't updated it.

The National Security Administration warned that hackers using one of the PHP exploits could "steal sensitive data, disrupt services, or move deeper into a network."

"Even if you yourself are not building software and that's not where your core business is, a lot of your life does depend on companies that depend on those systems," Madeline Lawrence, cofounder of Aikido Security, an application security platform, told Business Insider on Thursday.

"And they could be deeply, deeply vulnerable," she added. She said that one day after the disclosure, cybersecurity platform Cloudflare reported millions of attempts to exploit the vulnerability.

If you do own a website, PHP has released updates it says will help shield websites from hackers. Instructions for applying those updates are available on PHP's homepage.

For everyone else, here are a few tips cybersecurity researchers say you can use to protect your info.

• Don't reuse passwords; use a password manager.
• Check for security advisories from your bank.
• Use two-factor authentication on your devices and accounts — especially for email, banking, and your password manager.
• If your data has been breached, expect more convincing scams and phishing emails.
• Turn auto-updates on and restart your computer weekly.

"You can ask your claude code to audit what on your laptop is out of date and needs updating," Peter Wildeford, head of policy at the AI Policy Network, a bipartisan nonprofit that advocates for safety guardrails and federal oversight, added in a post on X.

Though Lawrence called the vulnerability "very severe," she cautioned against people running to close their bank accounts to protect themselves.

"Assume that if you're getting a notification that your data has been leaked," she said. "Take action on that because you could have credentials or information floating around the dark web."

Governments and corporations worked throughout the night to update software.