At first, the X headlines this morning about the latest AI-powered cybersecurity incident seemed dire. But by the time I had a cup of coffee and began parsing all the cyber jargon, I was reassured that an apparent solution was on its way to plug a major new security hole that could make websites vulnerable to cyberintrusions. Since August, a coalition led by OpenAI has been working to address critical vulnerabilities in PHP, an open-source programming language that undergirds the web. But there was bad news, too: This type of long-simmering response to the latest AI-discovered vulnerabilities may not be viable for much longer.

For months, OpenAI has been harping on what it calls the “ defender’s window ”—the critical period of time when cybersecurity experts, armed with advanced AI models, can identify and patch vulnerabilities before attackers exploit them first. The issue is that the gap is rapidly narrowing between cybercapable models from leading U.S.…