I know my headline probably seems a little over the top, but if you have been reading anything about what technologist Zvi Mowshowitz calls “The Hackening,” you may be prepared to cut me a little slack — especially since I am far from the only one putting it in those kinds of terms. “Read this website while you still can,” was the headline on a piece in The Atlantic that noted government, hospital, and school websites across Europe and in the US had gone dark, as well as the websites of the Finnish national health agency, the Port of Rotterdam, and the Paris police force. AI is “changing everything about hacking [and] no one knows what happens next,” 404 Media wrote. The latter piece quotes Matthew Green, a Johns Hopkins professor and one of the most respected cryptographers in the world, as saying that “we’re in the part of the movie where you need to throw whatever you can in the path of the zombies and hope it slows them down,” and “so many people discovering that the whole Internet is dry tinder and the only thing keeping it from burning is the fact that teenagers haven’t found the matches yet.”
Some employees of AI companies are going full “prepper,” 404 Media notes, recommending that people pull their money out of their bank accounts, disconnect from the internet, buy long-dated or shelf-stable food, hoard water, and purchase hand-crank emergency radios in case the internet and/or the power grid goes down. And that was before the recent PHP exploit, which opened a potential back door to about 85 percent of the websites on the internet (Cloudflare CEO Matthew Prince said the vulnerability was exploited millions of times within hours of the news). Mowshowitz lists a number of additional security risks that came quickly on the heels of the PHP issue , including a GitLab flaw that affects 12 years worth of releases. Some of the vulnerabilities seemed so ridiculous as to almost be funny: it was revealed that an Indian entity named eMudhra, which provides website security certificates, used a private key — something that would ideally be many characters long — that was simply the number 4.
As 404 Media details, there have also been reports about vulnerabilities in Node.js (a Javascript-based language that is an alternative to PHP), as well as the media-server software Plex (which I use), a cloud provider called Railway and a coding platform known as OpenCode. In a recent piece entitled “The Internet Breaks,” Noah Smith quotes Jeremie Harris, founder of Gladstone AI, as saying that there’s a decent chance that the internet “ceases to exist as such, at least for a time.” In the same piece, he notes that Jason D. Clinton, the deputy head of cybersecurity at Anthropic, warned in August that humans might need to temporarily abandon the internet by ensuring that their computers were “air-gapped,” which is programmer and cybersecurity lingo for turning off your WIFi or removing your Ethernet cable to ensure that hackers and malware can’t get into it.
Note: This is a version of my Torment Nexus newsletter, which I send out via Ghost, the open-source publishing platform. You can see other issues and sign up here.
And there is likely a lot more of the same kind of thing coming: OpenAI said that while these exploits or bugs are significant, they are “among several significant vulnerabilities we’ve already found and are working to fix, and we expect similar findings to increase sharply in the coming months.” Azeem Azhar drew an analogy to the spread of COVID-19, calling the PHP vulnerability the internet’s “Wuhan moment.” None of this should come as a surprise, although the speed of the wave might be faster than even some AI experts were expecting. After all, it was only a few months ago that Anthropic warned its new Mythos model was capable of finding tens of thousands of exploits in commonly-used software programs and hardware — the kind that the entire internet runs on, in other words — and in fact was so potentially dangerous that the company initially didn’t release it to the public. As I wrote in a Torment Nexus post at the time:
According to the company, Mythos has “already found thousands of high-severity vulnerabilities, including some in every major operating system and web browser,” such as Linux, flavours of which run on virtually every web server and a majority of corporate networks in the world. Anthropic says that Mythos reveals a stark fact, which is that AI models “have reached a level of coding capability where they can surpass all but the most skilled humans at finding and exploiting software vulnerabilities.” Given the rate of AI progress, the company says these capabilities will likely proliferate, and the “fallout — for economies, public safety, and national security — could be severe.”
(Note: In case you are a first-time reader, or you forgot that you signed up for this newsletter, this is The Torment Nexus. Thanks for reading! You can find out more about me and this newsletter in this post. This newsletter survives solely on your contributions, so please sign up for a paying subscription or visit my Patreon, which you can find here. I also publish a daily email newsletter of odd or interesting links called When The Going Gets Weird, which is here.)
The open web is closing
As a result of Mythos and its abilities, Anthropic put together a private consortium called Project Glasswing (a glasswing is a type of butterfly — like the kind in the “butterfly effect,” the idea that even a small change somewhere can eventually produce catastrophic consequences). The consortium consists of large technology and financial companies like Amazon Web Services, Apple, Cisco, Google, JPMorganChase, the Linux Foundation, Microsoft, and NVIDIA. The idea behind the group was that these companies and groups could theoretically evaluate the new model and its security-cracking or otherwise dangerous abilities and help others harden their systems. Whatever the group might learn about Mythos and its abilities would be shared publicly, Anthropic said, and the company donated $100 million in usage credits to participating organizations (it recently committed up to $ 1 billion to an initiative called “Protect The Planet”).
I think it’s worth pointing out that at the time Anthropic talked about Mythos and its theoretical bug-finding abilities, a number of prominent skeptics said the whole thing was marketing BS designed to promote the company’s upcoming IPO. David Sacks, for example, said that Anthropic was “running a sophisticated regulatory capture strategy based on fear-mongering.” On a related Tyler Cowen post, a commenter wrote: “A lot of this stuff is self serving. Look at how important what we’re doing is! Give us hundreds of billions of dollars!” Bloomberg’s Matt Levine called fear-mongering about AI “business negging” (negging is slang for negative comments men make to get a woman interested in them). Sam Altman, Levine said, “got OpenAI to a $150 billion valuation by saying: ‘Nobody should allow us to build our product, we’re going to destroy humanity.'”
I haven’t checked in on what Sacks or Levine are saying at this point, but hopefully they will agree that PHP exploits and other vulnerabilities that involve a majority of the internet-connected devices on the planet is no longer just a theoretical problem, and even the most vociferous critic couldn’t possibly argue that revealing these kinds of dangerous exploits is all part of some kind of marketing plan. Scott Alexander, who blogs at Astral Codex Ten, wrote a long critique of the idea that all of the AI danger talk is a marketing ploy for OpenAI and Anthropic, pointing out (among other things) that Dario Amodei of Anthropic and other leaders of the AI industry have been warning about the potential dangers of the technology for some time — long before their companies were worth billions of dollars. And surveys show that the AI experts who aren’t affiliated with big companies “are just as concerned as the ones who are,” Alexander wrote.
While they might present more of an existential threat to the foundations of the internet, exploits and backdoors in common software aren’t the only risk to the “open web” that many of us have gotten used to over the past few decades. Another problem is that AI models have effectively changed the dynamics — and the economics — of the internet and the web more fundamentally than anything I can think of. Even Google, whose “link economy” has powered the growth of much of the modern web over the past 25 years or so, has been forced to jump on the AI train, which means that searches now produce primarily answers powered by its Gemini model, rather thank links to web sources (although the links are still there if you search through the AI’s answer). I wrote recently about how this link economy is on its last legs, and the resulting decline in revenue for news websites and other media outlets has been precipitous.
Not everyone is as worried about the future that this might bring, however. Ben Thompson, who has been writing his Stratechery newsletter since 2013, argued in a recent piece (The End of the Internet) that while the ad- and click-driven economy that we got so used to may be going away, that opens up the possibility for writers and news organizations to follow his subscription model. The answer to drowning in abundance, Thompson argues, is to “purposely limit your audience — to go small. That is an economic model that works, and notably, there are a lot of bloggers on that list who are using that model today. Blogging is alive and well, it’s just constrained, and thus worth paying for.” As one of the hoi polloi trying to make a go of this model via Substack and Patreon and Ghost and other platforms, I wish I was as optimistic as Ben. Part of the problem is that Twitter — which he admits drove a lot of his early success — is effectively gone, or no longer useful, and nothing has come along to take its place (sorry Mastodon).
Endgame for the internet
Anil Dash, an open-web advocate who helped build the Typepad blogging platform a thousand years ago or so, wrote recently about what he called the “engame for the open web,” namely the rise of AI. “You must imagine Sam Altman holding a knife to Tim Berners-Lee’s throat,” Dash wrote. “All the signs are pointing to the fact that we might be in endgame for ‘open’ as we’ve known it on the Internet over the last few decades.” The open web, Dash says, meant that anyone could create and publish content using open standards and tools, and then share that work with anyone, anywhere in the world, without asking for permission. Now, he says, when we look at everything from content to code, from communities to culture, “we can see example after example of that open web under attack. Every single aspect of the radical architecture I just described is threatened, by those who have profited most from that exact system.”
Dash closes his piece by saying he believes that “ultimately, if given the choice, people will pick home-cooked, locally-grown, heart-felt digital meals over factory-farmed fast food technology every time.” I wish I was optimistic about that too, but I think most people will opt for the easiest route in almost every case, and that means silos and walled gardens. My friend Ben Werdmuller said in 2024 that “the open social web is the future of the internet,” and maybe there was a chance at one time but I think that time (if it ever existed) has passed. I am a fan of the open web from way back, and whenever possible I use open standards and open systems, and for a time I was optimistic about open or decentralized social media like Bluesky and Threads — which said that it was committed to “federating” with others — and Mastodon. Threads never followed through on the promise to be open, and Bluesky and Mastodon are relatively tiny (this is part of the reason I returned to Twitter/X, a decision that was not very popular with a number of friends who see it as a Nazi bar in which I am participating).
Mike Masnick of Techdirt, one of the friends who reacted negatively to my return to X, wrote that he thinks AI might be our best shot at taking back the open web. Like me — and a lot of other early bloggers and web denizens — Mike spent a lot of time learning HTML by clicking “view source” on websites that he liked (one of my first websites has been recreated here). He says he thinks that using agents and AI tools could do something similar for the web now, allowing for customization and tinkering etc. I agree that this is great! But I don’t know that Mike designing his own sites or tools with AI is going to change much (no offense) and I don’t see the vast majority of people doing either of those things, no matter how easy it becomes. There’s a reason that Facebook became so popular, and Twitter too for that matter — they were easy, and even though they were walled gardens in a sense, they were well kept (mostly) and the walls were hidden.
Surprisingly perhaps, there are those who are hoping the internet does die. Wired recently published a piece saying “Please let the internet die.” Any rational observer, the magazine argued, can admit that the current iteration of the web — and the social fabric woven into it — is not what it used to be. “Symptoms of advanced cultural decay can no longer be ignored. This thing is eating itself,” writes Miles Klee. It’s not necessarily that people have gotten worse, he says — one cybersecurity firm found this spring that agents already outnumber human users, their traffic surging by 8,000 percent through 2025. No wonder, he says, that “seemingly everyone has at some point caught themselves scrolling through a wasteland of brainrot and asked, ‘What the hell am I even looking at?’ Underlying that question is another: ‘Is it always going to be like this?'” I think we can safely say that it is not always going to be like this — it will get worse.
Maybe Ben Thompson is right and the future of the internet is just services that take care of the security of everything for you, as opposed to you coding your own site (like an idiot, I am still running my own server single-handedly — although I have significantly improved my security by using Tailscale and Cloudflare tunnels, among other things, after getting hacked earlier this year by ransomware). And maybe the future of social is just personal chat groups on apps like WhatsApp and Discord and Instagram, with friends and family members instead of random strangers. Which is fine I guess. But it makes me more than a little sad, because I have enjoyed talking to random strangers on services like X and through blog comments, and many of them became close friends! Perhaps those days are gone, as Ben says, and the do-it-yourself internet is “an insane invention from a time that is, sadly, gone forever” and the internet as we knew it is dead.
If you liked this newsletter (even if you didn’t agree with it) please consider upgrading to a paid subscription, or donating through my Patreon. Got any thoughts or comments? Feel free to either leave them here or you can also reach me on Twitter, Threads, BlueSky or Mastodon. And thanks for being a reader.