The Register says AI agents for IT work only stay useful when they read live endpoint data, not a stale inventory. Matt Psencik says the installs that worry him most are the ones a security team does not know it owns.
The report centers on PHP2Shell, a pair of critical flaws in PHP, and says details leaked before the planned disclosure. PHP shipped fixes the next day, but the harder job was finding every copy of PHP that might still be exposed.
Matt Psencik and hidden PHP
Psencik, a threat research engineer at Tanium, put the visibility problem in one sentence: "The installations that worry me most are the ones a security team doesn't know it owns."
That warning fits the article’s core claim because some PHP copies were bundled inside other software, and some were extracted by hand onto Windows machines that never registered as installed applications.
Endpoint data under pressure
The piece says a periodic snapshot cannot answer where software runs on the day it matters, and it says teams often have to pivot across an asset inventory, a vulnerability scanner and an external attack surface tool just to answer that question.
Every hop adds delay, and every console is another chance to disagree with the last, which is exactly the kind of drift that slows automated response when a system has to decide fast and act without human review.
AI, speed and control
The article argues that endpoint data needs four qualities: accuracy, speed, control and shared truth. It also says AI works best as the operator and the interface for defenders when it acts on that live data rather than on stale snapshots.
The tension is that AI can also help attackers, not just defenders. Frontier AI helped researchers find the PHP2Shell flaws, while several security firms reported exploitation attempts before PHP released its fixes, and Cloudflare said it saw early attacks hours ahead of the patch.
In April, Anthropic said its Claude Mythos Preview model found thousands of previously unknown flaws across every major operating system and browser, which shows the same tooling that helps defenders search faster can also accelerate offense. The article leaves one practical question hanging: how many total PHP installations needed verification before teams could trust their view of exposure.
