Cyberattackers have made “millions” of attempts to take advantage of a critical hole in a building block of the internet, a key cybersecurity provider said early Thursday.

Two top European cyber officials later told POLITICO that hackers have so far struggled to exploit the vulnerability.

Cybersecurity agencies worldwide continue to scramble to respond to the public revelation Wednesday of a flaw in PHP, a foundational computer programming language used to underpin 70% of the internet. 

Matthew Prince, the CEO of Cloudflare, an internet services company that is widely used by websites to block cyberattacks — giving it a high level of visibility over what hackers are doing — said in a post on X that it’s seen “millions” of “attempts to exploit” the flaw.

Cloudfare saw thousands in the 10 hours before the flaw was publicly announced, meaning information must have leaked, then tens of thousands in the 45 minutes after the announcement, hundreds of thousands within two hours, and now millions, Prince said.

Amazon’s cloud division also said the flaw is “now being broadly exploited in the wild.”

But Thomas Caspers, vice president of Germany’s cyber agency BSI, said in an interview that though his agency has also seen attacks, it has not seen any successful use of the flaw by hackers. 

“It seems a little bit more complicated than expected to exploit,” he said. “When we had the planning process before the release of the patch, we were expecting a much faster track of the attackers.” 

Caspers is not certain why this is the case at this stage, but said it appears that successfully making use of the flaws is harder than expected. Global cyber officials were part of a process coordinated by OpenAI, to find and fix the flaws. “An ad hoc exploitation seems a little more difficult than expected,” he said.

The challenge for bad actors may also be linked to the major AI providers building guardrails so their tools can’t be used to exploit flaws, he said. When a POLITICO reporter as a test asked ChatGPT and Claude, models from OpenAI and Anthropic respectively, how to exploit the PHP vulnerabilities, both chatbots declined to provide the information. The two companies did not immediately respond to requests for comment. 

Numerous European government departments took their websites offline as a precaution to Wednesday’s developments. As of Thursday morning, key French websites such as the justice ministry and the data protection authority still featured a message they were undergoing maintenance. 

Matthijs van Amelsfort, the head of the Dutch cybersecurity agency, told POLITICO that his agency has no indication that the flaw is “actively being misused” but said that can change, particularly because AI makes it easier to exploit flaws. The agency took its website offline on Wednesday, but it is now back up.

This article has been updated.

BRUSSELS — The European Commission’s cybersecurity division is rolling out a plan to use artificial intelligence to respond to high-risk cyberattacks, according to a document obtained by POLITICO.

The undated document, written by the Commission’s IT department, sets out how to prepare the EU executive’s cyber defenses for “emerging AI-driven threats.” It proposes an action plan to shore up defenses in light of AI, with the most urgent move being the speed of response to attacks.

Governments have rushed to grapple with the rising threat brought by AI’s ability to expose and exploit cybersecurity vulnerabilities. Incidents like OpenAI’s accidental intrusion into Hugging Face have prompted calls, including at the highest political level, to be more wary of advanced AI models.

Being able to respond quickly to cyberattacks is most crucial in “high-risk scenarios,” the EU executive’s internal cyber defenders warned, saying that the ability to detect an attack is “not sufficient if containment measures cannot be taken quickly enough.”

Officials at the in-house IT department, DG DIGIT, are planning to use automated “protective measures” in specific high-risk scenarios, it said. Those scenarios were redacted in the document, which was provided to POLITICO in response to a freedom of information request.

The plan does not amount to “uncontrolled automation” and there will be strict controls in place including human oversight, according to the document.

As well as laying out the response plan, the document sets out the cybersecurity challenges the Commission faces from AI.

The most advanced AI models are expected to “significantly increase the speed, scale and adaptability of cyberattacks” and the Commission must therefore have defenses in places for an environment where “attacks are likely to become faster, more frequent and more scalable,” it said.

Risks include situations where “malicious activity occurs outside EC [European Commission] normal working hours, spreads more rapidly across systems, or results in large-scale exfiltration or operational disruption before manual intervention can be organized by EC,” they said.

The Commission’s cyber division has sought approval internally to move ahead with the plans, it said, though it’s not clear whether the plans have yet been put in place.

The Commission didn’t respond to a request for comment.