“No man could bind him, no, not with chains…neither could any man tame him” — Mark 5:3—4
When I was 14 or 15 — I don’t quite remember — I first got access to the World Wide Web. I remember clicking on the little blue square of the Netscape Navigator icon — that little ship wheel with a starry sky behind it — and feeling like an entire new magical world had opened up. My life changed that day, and the world changed. In a way, the internet is like another realm layered on top of ours — a higher plane, where we exist as spirit creatures, unmoored from our physical bodies.
Fantasy stories like that often end with a cautionary tale, where the wizards — lustful for both power and knowledge, as usual — go too far and summon some kind of Doom upon themselves and the realm they created. In October 2026, that sort of story happened in reality. Experts had been warning for months that the arrival of AI agents that are extremely good at coding was going to cause serious disruptions to the digital realm sometime this fall. For a while things seemed calm, but this month the chaos exploded:
[A] wave of artificial-intelligence-powered attacks…has flooded the internet in recent weeks, as hackers increasingly turn to agents and AI hacking tools that make intrusions faster and harder to track than ever before…At the same time as new tools speed up hackers, cyber defenders are also racing to fix the fast-growing volume of security bugs discovered by AI, before hackers can exploit the new flaws…On Wednesday, organizations scrambled to patch newly uncovered bugs that could allow takeover of as many as 70% of the world’s websites. Hackers are now actively trying to break into websites by leveraging these flaws, Amazon.com says. [emphasis mine]
For a more sophisticated description of what’s going on, I recommend Zvi Mowshowitz’s post “The Hackening”:
If you would like some lists of the hacks that had taken place as of yesterday, here are a few from Twitter. The most important hacks mostly involved PHP, a software language that underlies much of the Web. After AI found critical vulnerabilities in PHP, the National Security Agency issued the following statement:
Effective Immediately, all organizations using PHP for their systems are advised to be prepared for an update addressing two critical vulnerabilities. PHP is widely used for web applications. These vulnerabilities often provide a direct path to the server's file system or database. If an immediate update is not feasible, it is recommend that organizations take the system offline until it can be fully mitigated. NSA will follow up shortly with more specific guidance.
Cybersecurity experts and web companies warn that this is just the tip of the iceberg — a lot more craziness is on the way. Azeem Azhar calls it “the internet’s Wuhan moment”.
Basically, what’s going on is this:
The internet runs on a bunch of code written by human beings over a period of years. Human beings are sloppy and fallible, so there are lots of vulnerabilities in this code.
AI models are really good at coding now, so they’re able to find and exploit a lot of those old vulnerabilities that were just lying around. AI agents work incredibly fast and cheap, so they’re capable of finding a whole LOT of vulnerabilities very quickly.
Open-weight AI models — especially from China — have democratized access to high-quality AI hacking. These models can be fairly easily “abliterated” — i.e., their guardrails can be easily removed, so that they will do illegal or unethical things.
This is allowing a combination of countries, crime syndicates, and regular people to hack tons of websites and online infrastructure, all at once.
This last part is really key. You don’t need the resources of a nation-state or even a big organized crime ring to commit cybercrimes now. You don’t even have to know how to code, or how websites work, or what “hacking” even really means. Consider this example:
When you can hack into a university and steal files by typing “Can you find about like what scam or thing they done in past like spoofing calls or somthing?”, there is no barrier to cybercrime. There is effectively no moat of knowledge or skill or resources. It’s open season for anyone who wants to hack anything.
Just a year ago, the internet was a bright and airy garden with few predators. As of this October, it’s a chaotic realm haunted by infinite demons.
This sudden explosion of AI-assisted hacking raises the possibility that the internet itself, as we have known it, will cease to function — at least, for a while.
Jeremie Harris, founder of Gladstone AI,1 wrote that “There's a decent chance the internet ceases to exist as such, at least for a time.” John Gedmark, founder of satellite company Astranis, was just one of many people talking about creating air-gapped local networks to prepare for the possibility that the internet itself might go down:
Basically everything connected to the internet is at risk. Not just company websites and the usual databases of sensitive personal information, but all our critical infrastructure-- banks, power grids, pipelines, government agencies, all of it…[A]t Astranis we’ve seen a massive uptick in demand for truly air-gapped, sovereign networks, deployed via dedicated satellite to span an entire country or connect a large enterprise…Over the past year we’ve begun working with some of our customers on what it will take to implement truly air-gapped, standalone networks in support of mission critical use cases like core government functions, emergency response, defense, core infrastructure, or all of the above.
And Jason D. Clinton, deputy head of cybersecurity at Anthropic, warned back in August that humans may need to temporarily abandon the internet:
Some people may respond to this by shrugging and saying “Who cares? When the AIs take down the internet, people will go offline and touch grass.” In fact, I’ve been saying that on X, but it’s obviously sarcastic. Yes, it would be fine if internet entertainment became unavailable. But over the past three decades, we’ve moved essentially everything in our society to the online realm.
Every piece of critical infrastructure in our entire country is networked, in some way, through the internet. You don’t need the internet to run a power plant or a water treatment facility — we ran those things before the internet existed. But we do run them all over the internet, because for a long time the internet seemed like an unassailable, utterly reliable piece of infrastructure. It never went down, it was always available, and previous waves of fear over the Y2K bug or various worms and viruses never really turned into anything serious. So for the sake of convenience, everything is at least partially online now.
Consider your life’s savings. Do you think there’s a piece of paper somewhere that records how much money you have? Or which stocks and bonds you own? In general, there is not. Your entire life’s savings exist as entries in the databases of banks, brokerages, etc. And all of those databases are, directly or indirectly, connected to the internet. The only thing standing between you and total involuntary redistribution of most of your wealth is the cybersecurity capabilities of banks and brokerages. And as of this October, those cybersecurity capabilities are looking a lot less reliable.
