![\"\"](\"https://substackcdn.com/image/fetch/$s_!rt5_!,f_auto,q_auto:good,fl_progressive:steep/https%3A%2F%2Fsubstack-post-media.s3.amazonaws.com%2Fpublic%2Fimages%2F820366d7-7814-4e40-b4e8-b2afe71e40e4_1054x548.png\")
It is January 2020 all over again. Something is spreading fast. Most people haven’t noticed, and the people who have are worried.
Software, the internet, and cyberspace in general are currently under relentless attack. PHP2Shell was a key plank to fall: PHP runs about 70% of the world’s websites. But the breadth of attacks is more comprehensive than that, and the exploits will keep growing. On the same day, Node.js, a popular JavaScript library, patched a critical flaw, and Microsoft said a Chinese state-aligned group had used a swarm of AI agents to break into accounts.
The attackers have company. AI agents are spreading across the internet. Matthew Prince, who runs Cloudflare, a network company, reckons they will outnumber human users 1,000 to one within five years. My own agents already browse more than I do. The internet was built so that anyone could plug in. Increasingly, that \"anyone\" is a machine, and some of those machines are hunting.
Mr Prince sums it up: “We’re going to have a couple of years where every single week it’s going to feel like the sky is falling.” He is right. It will get worse before it gets better. And the internet that comes out the other side will be safer, and less open, than the one we built.
AI became a serious security player in April, when Anthropic held back Claude Mythos. But capabilities trickle down. By August, an open-weight Chinese model, GLM 5.3, had nearly caught up with Mythos. So are the open models to blame?
Not right now. Plenty of evidence points to closed models being used by bad actors in attacks. Recently, some attackers used a combination of open-weight models and Claude: Claude for thinking and cheaper models for relentless attacks. OpenAI's closed models carried out an attack on Hugging Face in June, during cybersecurity evaluations. They were never told to attack Hugging Face, they breached it to steal information that might help them pass the test.
Told to find vulnerabilities, the models are relentless. Microsoft says one Chinese group used an open-source swarm of AI agents to gain control of cloud accounts in under three hours. It made 2,900 login attempts a minute across more than 2,250 organisations. You can scale them like any software, dozens, hundreds, thousands in parallel. And they don’t analyse vulnerabilities the way humans do—they will look in places we might not. One researcher using AI found PHP2Shell in a week. Wiz, a Google-owned security firm, says a world-class team would once have needed months. And this is why the chart looks like this.
![\"\"](\"https://substackcdn.com/image/fetch/$s_!A4jH!,f_auto,q_auto:good,fl_progressive:steep/https%3A%2F%2Fsubstack-post-media.s3.amazonaws.com%2Fpublic%2Fimages%2Ff971c66f-0c5f-4de1-99e2-e4db7f88258c_2700x1500.png\")
But open-weight models are getting better. They are cheaper to run and they are increasingly available through third parties. But apart from those advantages, open-weight models have another: they can be abliterated.
For members:
Why it gets worse first
Where the next wave of attacks comes from
What the internet becomes