AI Security Scanners: Claude Security, OpenAI and WordPress

Something changed in website security this month, and most site owners missed it. In October 2026, AI companies went from talking about security to finding real bugs in the software that runs much of the web.

Anthropic reported three of the seven security issues fixed in WordPress 7.1.3. OpenAI, working with Trail of Bits, reported another, and later described its role in fixing the critical PHP flaws released on October 21. Anthropic launched a free scanner for open source projects and moved Claude Security to continuous scanning. WordPress.org now runs several AI models over every plugin release before it goes out. At the same time, as Reuters reported, attackers are using AI agents to break into websites.

Here is what is happening, why it matters and what it means for a small business website.

AI found bugs in WordPress itself

WordPress 7.1.3, released on October 6, fixed seven security issues and four bugs. Of the seven security issues:

Anthropic reported a denial of service issue in WP_Http::make_absolute_url(), a second order SQL injection in WXR export and a bug that let Author role users make posts sticky.
Trail of Bits with OpenAI reported a stored cross site scripting issue on the Comments admin page.
Patchstack, independent researchers and the WordPress security team reported the rest.

That is a big shift. A few years ago, reports like these came almost entirely from human researchers. Now AI models are reading huge codebases and finding subtle problems, like second order SQL injection, that are easy for people to miss.

AI helped with the PHP emergency

On October 21, OpenAI described its part in coordinating fixes for the critical PHP vulnerabilities (CVE-2026-109618 and CVE-2026-109619). It released a PHP version checker skill for its Codex coding agent, proposed a five stage response framework for widely used software and committed $1 billion in subsidised access to its Daybreak security tools for frontline defenders.

If you have not checked your server yet, our PHP security update guide explains exactly what to do.

New AI security tools launched this month

Claude Security goes continuous

On October 21, Anthropic moved Claude Security to continuous repository scanning, with automatic fix tracking, threat models informed by your team and integrations through its API and MCP. It is in public beta for Enterprise customers, with $25,000 in monthly credits for two months through December 31, 2026.

Anthropic OSS Scanner

Anthropic also launched a free service that periodically scans critical open source projects for vulnerabilities, with possible proofs of concept and proposed patches. Many WordPress plugins and PHP libraries are open source, so this could catch problems before attackers do.

AI reviews every WordPress plugin release

WordPress.org now uses several AI models plus Jetpack Scan to score each plugin release during a cooldown period. High risk releases are blocked automatically, and plugin committers get the findings by email. This helps protect against supply chain attacks, where a trusted plugin is updated with malicious code.

The other side: AI driven attacks

The same capabilities are being used against websites. Reuters reported that one hacker used AI agents to target more than 1,200 sites and breach over 100 companies for about $50 per success. When PHP announced its fix, Cloudflare saw millions of exploit attempts within a day. Our post on AI agents hacking 100+ websites covers how that campaign worked.

The result is a race. Defenders find and fix bugs faster with AI. Attackers exploit them faster with AI. The gap between a patch being released and attacks starting has shrunk from weeks to hours.

What this means for your website

1. Patching speed is now the most important security habit

When AI finds more bugs, more patches come out. When attackers use AI, unpatched sites get hit sooner. Turn on automatic updates for WordPress minor releases and trusted plugins, and check for updates at least weekly.

2. Fewer plugins, better plugins

Every plugin is code someone else wrote. Choose actively maintained plugins with recent updates and good support. Remove anything you do not use.

3. Custom code deserves a scan

If your site has custom themes, plugins or functions written for you, nobody else is scanning that code. AI tools like Claude Security, Codex and GitHub’s scanners can review it. Ask your developer whether they do this.

4. Watch the boring infrastructure

PHP versions, server packages, hosting panels and old staging sites are where AI agents look when the main site is solid. Keep them updated or remove them.

5. Use AI carefully yourself

If you or your developer use AI to write code, review it. AI written code can include the same kinds of bugs AI scanners find. Our post on whether AI generated code is reliable covers the risks.

What this means in the US, UK and Australia

United States: Most of these AI security tools launched in the US first, and US ecommerce sites were specifically targeted in the Reuters campaign. US businesses on managed hosting benefit fastest, since hosts are adopting AI scanning across their fleets.

United Kingdom: The NCSC backed taking unpatchable sites offline during the PHP emergency. Cyber Essentials certification, which many UK contracts require, includes keeping software patched within 14 days of a critical update. With AI shrinking the time to exploit, aim for days, not weeks.

Australia: Australian ecommerce sites were among those targeted by AI agents. The ACSC’s Essential Eight puts patching applications and operating systems near the top, with tighter timeframes for internet facing services. AI driven attacks make that guidance more urgent.

Will AI make websites safer overall?

Probably, in the long run. Software that millions of sites depend on, like WordPress core and PHP, is getting reviewed more thoroughly than ever. The risk sits with sites that do not apply fixes. For a small business, the answer is not to buy an AI security product. It is to make sure someone is keeping your site, plugins and server up to date, every week.

A simple weekly security routine

You do not need a security team to keep up. Fifteen minutes a week covers most of the risk for a small business site:

Monday: check the WordPress Updates screen, take a backup and apply plugin, theme and core updates.
Same day: glance at Site Health for PHP version warnings and failed checks.
Once a week: review new user accounts and remove anyone who should not be there.
Once a month: confirm a backup restores correctly on staging.
Whenever a big vulnerability hits the news: ask your host or developer the same day whether you are affected.

Put it in your calendar. The businesses that get hacked are rarely the ones with the worst technology. They are usually the ones where nobody was checking.

Sources

Need a hand with this on your own site? See our WordPress development services.

Frequently asked questions

Did AI really find bugs in WordPress?

Yes. Anthropic reported three of the seven security issues fixed in WordPress 7.1.3, and Trail of Bits with OpenAI reported another.

What is Claude Security?

An Anthropic tool that scans code repositories for vulnerabilities. It now scans continuously and is in public beta for Enterprise customers.

Does WordPress use AI to check plugins?

Yes. Several AI models and Jetpack Scan score each plugin release, and high risk releases are blocked automatically.

Can Web Brick Studio keep my site patched?

Yes. Our care plans cover weekly updates, PHP checks, security scans and backups. Get in touch.

AI Is Now Finding Security Bugs in WordPress and PHP: What Claude Security, OpenAI and the New Scanners Mean for You