Home > Blogs > Will AI-Driven Cyber Attacks Consolidate the Internet?

Will AI-Driven Cyber Attacks Consolidate the Internet?

Could the current ‘AI arms race’ lead to a centralisation of power of the internet and the release of legislation to regulate cyber security matters in the business-to-business sector?

It seems the opposite of non-sequitur to firmly state that we are amidst a revolutionary arms race in technology due to the advent of generative and agentic artificial intelligence (AI).

This week has seen many website operators scrambling to take their platforms offline whilst they attempt to update to the latest versions of their PHP code that runs approximately 70% of all websites on the internet. This was due to the exploitation of a vulnerability in PHP identified and attacked by AI-leveraged cyber hackers. That vulnerability was allegedly sitting surreptitiously for over a decade before cyber attackers used AI to identify and exploit it.  

With the PHP attack and OpenAI’s infamous ‘Hugging Face’ incident, it is evident that AI poses an immense threat to cyber security preparedness and the wider internet as a whole. There could, however, be another unfortunate consequence of this AI arms race. That is, namely, a consolidation of the internet as we see it.

To explain this using simple logic, at the rate that AI-leveraged cyber attacks are developing and AI-leveraged cyber security to counter the same, smaller businesses will simply not have the resources, expertise, nor time to keep up. This may therefore lead to the centralisation of online platforms amongst a few tech conglomerates and subsequently smaller businesses will be forced to maintain their online presence solely on such platforms in order to simply exist (yet alone succeed).

The major risk of this is the common trend which often arises from such consolidation of market position – unfair competition which leads to the abuse of power. SMEs and niche businesses which are forced to use consolidated platforms might be at the behest of onerous platform terms, lacklustre cyber security support, uncompetitive pricing, mismanaged digital infrastructure, obscure appeal and complaints processes and so forth.

Of course, there currently exists some form of centralisation already what with online marketplaces, multimedia platforms, and video games stores being the norm. However, we are talking about centralisation borne out of necessity, as opposed to opportunity. We could therefore see the total elimination of D2C ecommerce, on-premises infrastructure, independent cyber security software and more.  

This then brings into question what regulation might be introduced to mitigate such risks. Indeed, we already have regulations, such as the Platform to Business Regulations, which regulate online ‘intermediation’ services between businesses insofar as transparency duties and controls on powers of suspension.

The goal of a ‘consolidated platforms’ legislation borne from cyber security needs would be to balance the bargaining power between the giant platforms and the smaller business users. Rules might be introduced such as statutory rights for smaller businesses on receiving minimum dedicated cyber security support from the larger platforms. Duties on interoperability, portability, and disclosure, in order to keep smaller businesses in the loop about cyber security, may also feature. Standardised API performance and pricing could also be introduced. On the extreme end, we could possibly see digital platforms seeing utilities-like classification and control.

This is all, of course, speculation as we are in the early days of AI still. Nonetheless, amongst the jeers and ululation of AI taking people’s jobs, I think the PHP scenario certainly demonstrates that tech is, in reality, a people matter, since the consequences impact them the most. We will thus certainly be seeing developers, c-suite execs, cyber security experts, regulators, lawyers and other professionals trading blows with cyber attackers over the coming years.

About the author

Nabiel Junjua (CEO & Solicitor) is a commercial and technology lawyer with a keen insight into the intersection between commercial law and digital regulation. You can learn more about Nabiel here and contact him for support on your digital business.