The internet breaks

The internet breaks

What will be next to break?

Noah Smith

Oct 25, 2026

∙

Paid

446

76

62

Share

Art by GPT-6

“No man could bind him, no, not with chains…neither could any man tame him” — Mark 5:3—4

When I was 14 or 15 — I don’t quite remember — I first got access to the World Wide Web. I remember clicking on the little blue square of the Netscape Navigator icon — that little ship wheel with a starry sky behind it — and feeling like an entire new magical world had opened up. My life changed that day, and the world changed. In a way, the internet is like another realm layered on top of ours — a higher plane, where we exist as spirit creatures, unmoored from our physical bodies.

Fantasy stories like that often end with a cautionary tale, where the wizards — lustful for both power and knowledge, as usual — go too far and summon some kind of Doom upon themselves and the realm they created. In October 2026, that sort of story happened in reality.

Experts had been warning for months

that the arrival of AI agents that are extremely good at coding was going to cause serious disruptions to the digital realm sometime this fall. For a while things seemed calm, but this month the chaos exploded:

[A] wave of artificial-intelligence-powered attacks…has flooded the internet in recent weeks, as hackers increasingly turn to agents and AI hacking tools that make intrusions faster and harder to track than ever before…At the same time as new tools speed up hackers, cyber defenders are also racing to fix the fast-growing volume of

security bugs discovered by AI

, before hackers can exploit the new flaws…On Wednesday, organizations scrambled to patch newly uncovered bugs that could allow

takeover of as many as 70%

of the world’s websites

. Hackers are now actively trying to break into websites by leveraging these flaws,

Amazon.com

says. [emphasis mine]

For a more sophisticated description of what’s going on, I recommend Zvi Mowshowitz’s post “The Hackening”:

Don't Worry About the Vase

The Hackening

Last week at a small conference, there was talk about a future event referred to as The Hackening. As in, within 6-12 months, many predicted that due to advanced AIs and AI agents the internet would become a severely hostile place. Some worried that this could rise to the level of ‘assume any phone connected to the internet is rooted’ and several people…

Read more

11 days ago · 95 likes · 25 comments · Zvi Mowshowitz

If you would like some

lists of the hacks

that had taken place as of yesterday,

here are a few

from

Twitter

. The most important hacks mostly involved PHP, a software language that underlies much of the Web. After AI found critical vulnerabilities in PHP, the National Security Agency

issued the following statement

:

Effective Immediately, all organizations using PHP for their systems are advised to be prepared for an update addressing two critical vulnerabilities. PHP is widely used for web applications. These vulnerabilities often provide a direct path to the server's file system or database. If an immediate update is not feasible, it is recommend that organizations take the system offline until it can be fully mitigated. NSA will follow up shortly with more specific guidance.

Cybersecurity experts and web companies warn that

this is just the tip of the iceberg

— a lot more craziness is on the way. Azeem Azhar calls it “

the internet’s Wuhan moment

”.

Basically, what’s going on is this:

The internet runs on a bunch of code written by human beings over a period of years. Human beings are sloppy and fallible, so there are lots of vulnerabilities in this code.

AI models are really good at coding now, so they’re able to find and exploit a lot of those old vulnerabilities that were just lying around. AI agents work incredibly fast and cheap, so they’re capable of finding a whole LOT of vulnerabilities very quickly.

Open-weight AI models — especially from China — have democratized access to high-quality AI hacking. These models can be fairly easily “abliterated” — i.e., their guardrails can be easily removed, so that they will do illegal or unethical things.

This is allowing a combination of countries, crime syndicates, and

regular people

to hack tons of websites and online infrastructure, all at once.

This last part is really key. You don’t need the resources of a nation-state or even a big organized crime ring to commit cybercrimes now. You don’t even have to know how to code, or how websites work, or what “hacking” even really means. Consider this example:

Ejaaz

@

cryptopunk7213

the hacker that stole 5200+ records from a university asked his telegram AI bot:

"Can you find about like what scam or thing they done in past like spoofing calls or somthing?"

the AI then scoured websites, found exploits in a public university's platform and stole records. i'm…

International Cyber Digest

@

IntCyberDigest

‼️ A low-skill hacker used a jailbroken DeepSeek V4 to breach an Indian public university and steal 5,200+ student and faculty records, Unit 42 says.

The AI agent even drafted a "NEXT EXPLOIT OPPORTUNITIES" plan.

Unrelated criminals now run the same cheap DeepSeek setup.

2:16 PM · Oct 23, 2026

·

51.9K

Views

4

Replies

·

22

Reposts

·

151

Likes

When you can hack into a university and steal files by typing “Can you find about like what scam or thing they done in past like spoofing calls or somthing?”,

there is no barrier to cybercrime

. There is effectively

no moat

of knowledge or skill or resources. It’s open season for anyone who wants to hack anything.

Just a year ago, the internet was a bright and airy garden with few predators. As of this October, it’s a chaotic realm haunted by infinite demons.

This sudden explosion of AI-assisted hacking raises the possibility that the internet itself, as we have known it, will cease to function — at least, for a while.

NSA Cyber

@

NSACyber

Effective Immediately, all organizations using PHP for their systems are advised to be prepared for an update addressing two critical vulnerabilities. PHP is widely used for web applications. These vulnerabilities often provide a direct path to the server's file system or…

1:45 PM · Oct 21, 2026

·

12.4M

Views

1.3K

Replies

·

10.8K

Reposts

·

70.3K

Likes

Jeremie Harris, founder of Gladstone AI,

1

wrote that

“There's a decent chance the internet ceases to exist as such, at least for a time.” John Gedmark, founder of satellite company Astranis, was just one of many people talking about

creating air-gapped local networks

to prepare for the possibility that the internet itself might go down:

Basically everything connected to the internet is at risk. Not just company websites and the usual databases of sensitive personal information, but all our critical infrastructure-- banks, power grids, pipelines, government agencies, all of it…[A]t Astranis we’ve seen a massive uptick in demand for truly air-gapped, sovereign networks, deployed via dedicated satellite to span an entire country or connect a large enterprise…Over the past year we’ve begun working with some of our customers on what it will take to implement truly air-gapped, standalone networks in support of mission critical use cases like core government functions, emergency response, defense, core infrastructure, or all of the above.

And Jason D. Clinton, deputy head of cybersecurity at Anthropic, warned back in August that humans may need to temporarily abandon the internet:

Jason D. Clinton 🔸

@

JasonDClinton

The vulnerability tsunami is coming in just a few months and there won’t be enough time to patch critical infrastructure. Network isolation described below (air-gaps and data diodes!) needed now!

NSA Cyber

@

NSACyber

NSA and others releases guidance on applying prevention tactics to strengthen defense of U.S-based programmable logic controllers being targeted by cyber actors using AI. Learn more:

https://t.co/HO99aak50Y

#cybersecurity #AI

8:56 PM · Aug 20, 2026

·

975K

Views

39

Replies

·

206

Reposts

·

1.7K

Likes

Some people may respond to this by shrugging and saying “Who cares? When the AIs take down the internet, people will go offline and touch grass.” In fact, I’ve been saying that on X, but it’s obviously sarcastic. Yes, it would be fine if internet

entertainment

became unavailable. But over the past three decades, we’ve moved essentially everything in our society to the online realm.

Every piece of critical infrastructure in our entire country is networked, in some way, through the internet. You don’t

need

the internet to run a power plant or a water treatment facility — we ran those things before the internet existed. But we

do

run them all over the internet, because for a long time the internet seemed like an unassailable, utterly reliable piece of infrastructure. It never went down, it was always available, and previous waves of fear over the Y2K bug or various worms and viruses never really turned into anything serious. So for the sake of convenience, everything is at least partially online now.

Consider your life’s savings. Do you think there’s a piece of paper somewhere that records how much money you have? Or which stocks and bonds you own? In general, there is not. Your entire life’s savings exist as entries in the databases of banks, brokerages, etc. And all of those databases are, directly or indirectly, connected to the internet. The only thing standing between you and total involuntary redistribution of most of your wealth is the cybersecurity capabilities of banks and brokerages. And as of this October, those cybersecurity capabilities are looking a lot less reliable.

Continue reading this post for free, courtesy of Noah Smith.

Claim my free post

Or purchase a paid subscription.

Previous

Next