Every panic needs an origin story, and this one has a good one. Alistair Barr, writing in Business Insider, describes a friend — “a very sane, experienced person, and quite senior at one of the largest internet companies on earth” — who recently ripped the connected devices out of her home, ordered paper bank statements, and stockpiled canned goods in her basement. Barr’s household, just to be safe, ordered paper bank statements too. This was a few weeks ago. It seemed eccentric. Then came this week.
What happened this week: AI models exposed serious security weaknesses in software used by roughly 70% of websites, and, per Axios, US banks started finding AI agents inside customer accounts — “including some that appear to be acting without their owners’ instructions,” which is a sentence that should not exist and now does. The tech world’s response was proportionate in the way tech-world responses are. On X and Reddit, warnings of a looming “Black October” metastasized into visions of AI ending civilization. One lengthy X post warned of a potential “global cyberattack/AI swarm” and offered a survival checklist: cash in small bills, printed phone numbers for your neighbors, downloaded maps, a hand-crank radio, a gallon of water per person per day. And, Barr adds, a manual can opener — you don’t want to survive the AI apocalypse only to be defeated by a tin of beans.
Nikita Bier, a prominent app developer and X’s former head of product, distilled the mood into six words Wednesday night: “It’s time to turn off the internet.”
Now. Should you? Barr put the question to someone with unusual standing to answer: Stephanie Cohen, chief strategy officer at Cloudflare, a company that helps protect about 20% of the internet. “The world is a little bit scary right now,” she conceded at Cloudflare’s annual conference in San Francisco. Her account of the problem is bracingly simple. The internet runs on decades of software riddled with old security holes. The holes were survivable because exploiting them took rare skills and fixing them took money nobody wanted to spend. AI changes both sides of that ledger at once — it lets unskilled people attack, and it finds weaknesses at a speed no human team can match. The result, measured in newly published Common Vulnerabilities and Exposures, is an explosion, and a frantic race between breakers and fixers.
Her message, though, was “surprisingly reassuring,” per Barr, and the reassurance is not just vibes. Cloudflare shipped protections for the latest vulnerability to all its customers, free tier included. OpenAI has launched an initiative called Patch the Planet — working with Cloudflare and other security professionals to aim AI at widely used software, find the flaws and help repair them. Tom Occhino, chief product officer at Vercel, told Barr his company is talking to partners about a nonprofit that would fund “a swarm of good AI agents” to roam the internet finding and fixing software flaws. And Amazon on Thursday launched Continuum, a service that uses AI agents to find security holes and propose fixes, explicitly inviting the maintainers of freely available software — the unpaid humans holding up large parts of the internet — to use it.
The incentive structure here is worth a beat. Imagine you run an AI lab and your product is, among other things, very good at finding security holes. You have just created both a problem and a market for its solution, and the cheapest reputation-management strategy available is to point the solution at the problem, loudly and in public. That is roughly what Patch the Planet is. This is not a criticism! Self-interested altruism is still altruism if the patches land. Software engineer Ben Kaufman captured the whole absurdity in one X post: “The funny thing is everyone was saying AI slop code will cause a cyber crisis but it’s actually all the old human slop causing it and the AI is just cleaning it up.”
Cohen’s bet is that the freakouts are productive — that panic exposes issues and rams urgency into an industry that has deferred maintenance for thirty years. “We may end up in a world where actually we’ve become significantly more secure at the end,” she said. Barr’s dry rejoinder: “The trouble is getting there.”
The better insight, though, belongs to Occhino, and it is smaller and stranger than any swarm. The reason decades of “slop” now matter is that everything is connected. The tech industry spent years bolting the internet onto thermostats, refrigerators, doorbells, cars and bank accounts on the assumption that connected automatically meant better. It didn’t, always. Occhino isn’t panicking about his bank account — modern banks have real protections, and he recommends turning on extra login security — but he offered the neatest lesson of the week: “There’s certain things that don’t make sense to be on the internet in the first place.”
So no, don’t turn off the internet. The friend with the canned goods remains, on the evidence, slightly early rather than wrong. But the week’s actual takeaway is less doomsday-prepper and more household-budget: the off switch exists. It works on individual devices too.