The internet could be on the verge of a total meltdown. Yesterday, someone posted to a public forum that two major security flaws had been found in a programming language that undergirds the web. The language, called PHP, is used by as much as 70 percent of websites.
In order to protect themselves from hackers, a number of government, hospital, and school websites across Europe went dark this morning. The organization that maintains PHP quickly confirmed it was preparing to announce two major vulnerabilities alongside patches for them. Both weaknesses, officially disclosed today, appear to have existed in PHP for more than a decade but were only just discovered with the use of AI tools. Hackers have already been detected trying to exploit them, likely with the help of AI, and implementing the fixes to address the vulnerabilities could take companies days or weeks. In the meantime, tens of millions of servers, databases, and devices are exposed. “PHP is one of the fundamental pieces of technology that supports the internet,” Sam Rubin, a senior vice president at the cybersecurity firm Palo Alto Networks, told me. As of now, the websites of the Finnish health agency, the Port of Rotterdam, the Paris police force, 4Chan, and an unknown number of others are all down while they address the PHP vulnerabilities.
News of these weaknesses in PHP is the capstone in a weeks-long slew of devastating, AI-powered cybersecurity events. In recent weeks, criminals and state-backed attackers have used AI to hack into more than 100 companies, including John Deere and SharkNinja; to automate hacks on some 400 financial institutions in Latin America; and to steal hundreds of thousands of credit-card records from two companies. Since this summer, attackers have hit governments, data centers, and hospitals in Ukraine, Russia, Argentina, Bangladesh, and Indonesia. Also today, the developers of Node—a platform used by nearly half of software developers—disclosed multiple high-severity vulnerabilities. And that’s the abridged list.
For the better part of a year, cybersecurity experts have been warning, with mounting alarm, about an impending cyber-apocalypse. It may have begun. For decades, the internet has been riddled with holes and bugs. Code is finicky, and the standard IT approach has been to fix problems when they arise. For decades, the balance held: Skilled hackers are few, and finding and exploiting vulnerabilities takes time.
Recent advances in AI have totally upended that equilibrium. Top models have become very good at finding holes and writing malware, and can work much faster than even a team of humans. This is true of both open-source AI systems from China, which can be downloaded and used without restrictions, and the even more capable models from OpenAI and Anthropic, which are continually being jailbroken. The rate of software vulnerabilities identified per month has doubled over the past year. Meanwhile, the time that hackers need to begin exploiting those vulnerabilities—figuring out how to break in and out without being caught—has fallen, by some estimates, from weeks to hours. An actual intrusion, if automated with AI, can take as little as 39 seconds. Historical approaches to detecting and fixing vulnerabilities, or monitoring for suspicious internal activity, are insufficient.
AI has created new vulnerabilities, but it also promises to fix them: The vulnerabilities in PHP were discovered independently by a Google-owned cybersecurity company and another effort led by OpenAI. Google, OpenAI, and Anthropic, along with other tech firms, are all working with government agencies around the world to shore up their defenses. But, as numerous cybersecurity experts have told me, there is an asymmetry between attackers and defenders that AI is going to exacerbate: Hackers will use new technology with abandon, while companies are methodical and risk-averse—a hospital or electrical grid can’t risk that an AI security tool unintentionally takes a patient off life support or causes a brownout. And attackers need to find only one hole to succeed, whereas defenders need only one oversight to fail.
For a year, criminals and state-backed groups have been experimenting with how to use models to accelerate and automate their attacks. It was only a year ago that Anthropic announced, with great consternation, what it declared to be the first instance of AI-orchestrated cyber-espionage. That still involved a lot of human oversight and required jailbroken Claude agents to work for many hours. Now that the agents are faster and more capable, hackers have gotten more adept at deploying them, and the automation is more extensive. Recent, widespread attacks on South Korean and Japanese websites were reportedly executed by a single Chinese cybercriminal who used AI to target more than 1,000 websites. “This certainly will not be the last large-scale vulnerability identified, because of what’s possible with AI,” Rubin said.
The past 24 hours represent a tipping point. Bulking up IT departments, implementing passkeys, and using two-factor authentication remain important. But the most urgent and practical advice being given now is to retreat: Prepare to simply go offline. The NSA advised companies that cannot immediately fix the PHP vulnerability to take down affected digital services. Hospitals, water utilities, and other crucial services are all preparing for hacks by relearning to operate analog. Store your data in fewer places. We’re running out of time to prepare for the AI-hacking deluge. The dam may have already broken.
For the past 24 hours, Silicon Valley has been obsessed with a 26,000-word blog post by the AI researcher Nick Cammarata. The document has been called the “the most important essay,” “the most important result,” and “the single best piece of news” of the year, or in the history of AI research—or, perhaps, ever. Even OpenAI CEO Sam Altman lauded it. Cammarata makes a series of bold, almost astonishing claims about the nature of AI that, if true, would upend some of his industry’s basic assumptions about the very thing it is building. And after months of AI-hacking sprees and mounting public backlash against the industry, many people see Cammarata as offering a glimmer of hope when it comes to not just understanding but also controlling the technology being unleashed on the world.
Boiled down, Cammarata’s main contention is that generative-AI models are not actually black boxes, contrary to the common perception that these systems are so big and labyrinthine as to be nearly impenetrable. In fact, Cammarata argues, there is a relatively clear path toward understanding them. If that’s the case, the material significance could be tremendous: It would provide a way to map AI models’ inner workings and, in turn, perhaps prevent them from wreaking all sorts of harm—autonomously hacking companies and sovereign nations, encouraging users’ delusions, appearing to deceive AI researchers themselves. There is an entire field of research, called “mechanistic interpretability,” devoted to the study of just this.
The argument is just as important as the person making it. Cammarata, a former OpenAI employee, is a respected figure in his field. Years ago, he played a key role in establishing the opposite claim, which is now common wisdom: that neural networks, the software architecture that generative AI is built on, are impossible, or at least very difficult, to understand. In this new essay, Cammarata, who now works at the AI-research company Goodfire, essentially says that he and his entire field have been wrong ever since. “The claims here are viscerally shocking,” one observer wrote. Or, as another wrote on X, they are “big big big big.”
Neural networks, inspired by the human brain, consist of layered connections among individual nodes, or “neurons,” that activate and send information to one another when responding to a query. Earlier research, including Cammarata’s, established that individual machine neurons can activate in response to many different, unrelated topics—for instance, one neuron can correspond to images of cat faces, cat legs, and the front of cars. Nobody was sure why this happened, but one explanation was that, because AI models contain far more information than they have neurons, they have to repurpose these nodes. Regardless, the basic units of an AI model having seemingly arbitrary, multitudinous functions would make it very difficult to understand what is going on under the hood.
Cammarata now thinks that individual neurons can be understood and that each has a self-consistent function. Neural networks are not “tangled knots,” he wrote, but “clean.” He found that the cat-face and car-face neuron, for instance, was actually responding to things with a V-shape—including V-shaped flames and jets of water. This would make AI’s internal mechanisms relatively straightforward and predictable rather than mysterious and nebulous. And if we can harness that understanding, some people in the industry believe, AI will be much less likely to go haywire and, say, kill us all. “This is truly one of the greatest cases for optimism in years!” the OpenAI researcher Adam Majmudar wrote on X.
Not everyone agrees with Cammarata. For one, his 26,000 words were merely a “working hypothesis” for a “forthcoming technical paper” and were thus hard, on a technical level, to evaluate. And the neural networks he studied most closely were vision models, which are generally simpler and better understood than the language models underlying ChatGPT and Claude. Cammarata could be mistaken, or he could be overstating his case. The blog post isn’t peer-reviewed, and the forthcoming paper probably won’t be, either, as is typical in the field. The research itself is something of a black box. (Cammarata, who did not immediately respond to a request for comment, wrote on X earlier today that he appreciates all of the discussion and that his approach “seems promising so far” for “bigger modern language models.”)
Discussions of Cammarata’s essay have revealed philosophical rifts. “This is interesting work, but I don’t think it’s a significant update to the big picture,” Neel Nanda, who leads mechanistic interpretability at Google DeepMind, wrote in his appraisal of Cammarata’s findings. Even if researchers could approximate the function of every neuron in Claude Mythos 5.1 or GPT-6 Astra, that’s not the same as understanding how they connect and how the network works as a whole. Physicists have good models of atoms and interatomic interactions, but they cannot from first principles explain or predict every physical event (hence unpredictable extreme weather or, for that matter, the notion of free will). You know all of your friends from school, various workplaces, and the local softball league, but you can’t always know whether they’ll get along at your birthday party. More to the point, insights into the inner workings of an AI model will not necessarily produce insights into how to make the technology more reliable. Interpretability may be necessary to build safer AI models, but it is by no means sufficient.
If generative-AI models are actually legible under the hood, that would undoubtedly help make the technology safer. But many people in Silicon Valley, and especially employees at OpenAI, are discussing Cammarata’s blog post with a breathless enthusiasm that echoes Silicon Valley’s long track record of easy technical solutions and grand promises—an attitude that belies its mixed record on following through.
Any research finding that pertains to AI safety will require an industry chasing multitrillion-dollar public offerings to slow down and take a long, hard look at itself. Perhaps even more concerning than an unintelligible superintelligence is the fact that a group of companies openly state that they don’t really know what they are building—and then continue to push that technology to extremes anyway. If Cammarata is correct, AI companies will have to work with one another, outside auditors, and governments to figure out how to translate such a breakthrough into safe and reliable products. And right now, absent any serious regulation, nobody can decide to take such action other than the companies themselves. All of which suggests that the real black boxes are OpenAI and Anthropic themselves.
You wake up to a notification that a grocery-store employee will deliver all of the ingredients for the three recipes you saved last night to your “Weeknight Dinner” folder. While you brew your coffee, a program browses online retailers to compare toilet-paper prices, and another solicits competitive bids for Sheetrock work you need done in the garage. During your commute, a bot moves your upcoming dentist appointment to avoid a scheduling conflict. On your lunch break, you get an alert that computers acting on your behalf noticed some unclaimed funds and class-action payouts in a state database and claimed them. Also, the machine has negotiated a cheaper internet plan. By the time you get home, the groceries are on your doorstep, and you’ve gotten back $150.
This is the future that OpenAI, Meta, xAI, Google, and the rest are selling with a spate of always-on AI assistants that work for you. “Imagine every person on earth with a second mind beyond their own,” Meta’s chief AI officer, Alexandr Wang, wrote of the company’s new AI helper, Muse. A few weeks after Muse’s launch, OpenAI launched its competing product, Dots, which Sam Altman claimed would let you “get more of your time and attention back.”
These AI agents promise to bulldoze the inefficiencies of daily life. Think about all of the opportunities you’re currently leaving on the table: You don’t change cell-service providers for a flash sale because of the paperwork involved. You haven’t fiddled with your 401(k) investments in years. You have kids to pick up, a date to dress for, sleep to catch up on. But your AI agents are different—they’re relentless, tireless, and shameless. They work in the background, without supervision, eagerly helping with all of these tasks and a bunch you didn’t even ask for. They use every tactic and loophole at their disposal to get you the best price and the highest-quality service because they’re able to pay attention to everything at once.
The AI companies see a massive opportunity for hyper-personalized agents to become a new intermediary layer for the internet and the physical world. This future is already unfolding: People are giving Muse access to their phone number, email, credit cards, and bank accounts to make dinner reservations, contact customer service, and book vacations. Mark Zuckerberg says that he is using Muse to coach his martial-arts form and help him bake with his daughter (he isn’t very familiar with baking, being “normally into smoking meats”).
Silicon Valley’s vision of boundless efficiency is shortsighted, or at least incomplete. Near the end of his blog post about Muse, Wang writes that “we’ve never seen humanity with every single person’s agency fully switched on.” He paints a utopian vision of laptop-class optimization. But such frictionless commerce, if it ever does come to pass, could bring about something else entirely: chaos.
The era of the agentic web started less than 24 months ago. Anthropic’s Claude Code, introduced in early 2025, allowed agents to write software and use other programs on your laptop. OpenClaw, launched later that same year, could navigate the web on your behalf. In the spring of 2026, Instinct, an invite-only app that let users text requests to a bot over iMessage or WhatsApp, began capturing the imagination of Silicon Valley insiders. It could book museum tickets, purchase gifts, and find in-network doctors.
But it wasn’t until the launch of Meta’s Muse in early September that personalized agents hit the mainstream. Muse has been downloaded more than 5 million times in the past month and is especially popular among early adopters—entrepreneurs, investors, software developers. These users are now reporting back on their experiences and offering previews of our potential agentic future, which sounds both strange and jagged.
When we reached out to Rajan Lukose, a start-up founder in the Bay Area, to discuss his use of AI assistants, he had his Muse set up a calendar invite. In the late 1990s and 2000s, Lukose worked for corporate research-and-development teams in Silicon Valley and did early research on web agents. Now, he told us, “they’re actually, finally becoming sort of real.” Lukose has been using Meta’s program for “annoying things that I would never do”: tracking travel sites over time to book the cheapest flights, submitting receipts for DoorDash credits, sorting out problems with a magazine subscription. “That’s something that’s a real pain in the ass that just gets done,” he said.
Lukose said that the primary upside of using an agent is clawing back time and money. A few years ago, for instance, Lukose installed an automated tool that went through his Gmail, looked at various transactions, and filed claims under price-purchase guarantees. “That was like $600 that I just would not have gotten myself,” he said. The agentic era promises to deliver those kinds of savings to everyone.
Decades ago, the internet was supposed to create perfect markets, with users able to compare the cost and quality of products and services from anywhere in the world. But it failed: People continued to make lots of decisions based on habit. That, in turn, is good for business. “A lot of things online are premised on limited human attention,” Andrey Fradkin, an economist at Boston University, told us. Digital advertisements, recommendation algorithms, brand reputation, and celebrity endorsements steered consumers toward making suboptimal purchases.
AI agents are now here to finally fulfill the promise of perfect commerce. “The agent knows your preferences; they can go to every single platform, find the best products, the best deal for you, and then help you make that purchase,” Fradkin said. The agent won’t be fooled by sponsored posts or give up on shopping when they get distracted or hungry. “The current attention-based economy—if you gain the eyeball, you have a better chance to sell certain goods—that may change,” Ken Huang, who studies agentic AI at the University of San Francisco and runs an AI consultancy, told us. The bots are impervious to human-targeted nudges. Their attention is infinite.
In the short term, however, this automated quest for efficiency is creating some unsettling dynamics. Over the past month, X, Reddit, and other forums have been overrun with examples of agents haggling customer-service representatives and contractors. Take the case of the Muse user Luke Whiting, who sent his agent to check on a prescription at Walgreens. Whiting, who works for an open-source-database company in San Francisco, told us that the pharmacist at the other end of the call refused to speak to an AI system. His Muse suggested that the best way forward would be for Whiting to abandon using the agent altogether: “Honest take: other stores might say the same thing,” it said. Having the Muse call other pharmacies “could just burn time. The fastest path is probably you calling yourself.”
On a Subreddit for call-center employees, a recent thread is titled, in all caps, “I AM NOT AI.” “I have been asked 3 times this week ‘are you human?’” one person replied. Other users who identify themselves as call-center workers discuss their frustrations. One says that when customers question whether they’re talking to AI, they like to respond, “I’m a real boy,” like Pinocchio. Another, fed up with rude callers, vented, “Customers deserve ai.”
Companies, meanwhile, are starting to tap AI systems to squeeze more out of their customers. According to Fradkin, many hospitals don’t charge as much as they could, simply because medical-billing codes are countless and labyrinthine. But using AI to document and code patient visits reliably allows hospitals to charge for more, and more expensive, services. That likely contributed to patient costs increasing by $650 million across Blue Cross Blue Shield from 2023 to 2025. And that’s only the beginning; health payments are projected to rise another 9 percent next year, largely because of AI billing. McDonald’s is reportedly using AI to analyze millions of consumer transactions and adjust prices at each location, for each menu item, based on local demand. (McDonald’s has said that its pricing portal is “a tool, not a mandate” to help franchisees.) It’s not hard to imagine vendors using AI to develop personalized, on-demand inventory management and dynamic pricing to maximize profits for streaming subscriptions, sports tickets, drug prescriptions, consumer electronics, insurance policies, and loans.
This optimization assumes that the agents work as intended. So far, there have been plenty of stumbles: In a paper published earlier this year, a group of AI researchers found that agents, given assistant-style tasks in a virtual environment, leaked Social Security numbers and were easily hijacked by other people. Agents powered by Chinese models refused to complete tasks that involved politically sensitive topics. Two weeks ago, a tech executive’s AI agent randomly posted his financial information in a workplace chatroom for employees to see.
Things could get weirder still: Tech companies market their agents as perfectly rational, when, in actuality, they can be extremely erratic and unpredictable. Sophia Kazinnik, who studies AI agents at Stanford, found some models to be overly generous and others to be exceedingly greedy. Across the board, they were far less patient than humans. When two personal AI agents are haggling over prices in the wild, the outcomes might not be maximally profitable. And there’s no assurance that all future agents will be created equal: More powerful models may have an upper hand in negotiations.
Even if the agents are able to effectively shop and negotiate for us, important rules governing the privacy rights, liability, and economic allegiance associated with these tools will have to be codified. Does your Muse have a fiduciary responsibility to you, or a legal responsibility to Meta? If Muse pays for a $2,000 espresso machine instead of a $200 one, can you be refunded? If Muse leaks your account and routing numbers, is Chase required to refund any fraudulent payments?
At some point, everyone’s agents could reach parity. “Just like today, every business has a website and social-media accounts and email addresses and all these things, every business is going to have agents too,” Zuckerberg said in an interview this week.
In this future, communication and commerce function almost entirely via computer proxies. Your agent calls a fancy restaurant for a dinner reservation, and a digital maître d’ picks up. Your agent and your insurer’s agent and your hospital’s agent all negotiate the price for your recent appointment. Prices fall, buyers and sellers are better matched, and businesses are incentivized to deliver higher-quality, customized services and products. This is “what economists dream about,” Fradkin said.
But friction can serve a purpose for businesses. Banks make great sums when customers leave money in low-interest checking or savings accounts, and studies show that sizable portions of retailer subscription revenue are driven purely by “inertia,” another way of saying that people forget to cancel. (Friction can help consumers too: Inattention and incomplete information at times lead landlords, pharmacies, and other businesses to undercharge.) Our entire economy and basically every company are structured around the notion that humans have mental and physical limitations. Without them, existing market structures could collapse.
“There’s this strange protection provided by the inefficiencies in our economy,” Rory Van Loo, a lawyer and a professor at the Wharton School, told us recently. In 2019, well before the rise of large language models, Van Loo envisioned a phenomenon he dubbed “digital market perfection.” Imagine everyone has a digital agent that is always looking for a lower price or a newer, better service. In this world, Van Loo argues, agents could, all at once, direct millions of consumers toward a new product or service—a process he calls “hyperswitching.” That would in theory be good news for consumers, but it would be sheer hell for companies. The nightmare scenario that Van Loo and others have conjured is a style of agentic bank run, where similarly attentive agents all pull money from a bank at once to get their clients better interest rates elsewhere.
Maybe this sounds good or exciting to you—a kind of consumer’s revenge—but in practice, stable commercial markets would begin to look and function like the stock market. “If, all of a sudden, people could purchase whatever they wanted at the lowest price with the perfect ability to see every possible option, there’d be a lot of volatility in the world. It would seem highly efficient from an economic standpoint, but it could have devastating effects,” Van Loo said. Picture 1 million personal agents all switching their consumers to a new brand of paper towels on Amazon because a markdown made them three cents cheaper. The same Sweetgreen salad is $18 one week and $38 the next. Your electric bill is $150 one month and $450 the month after, and you’re uncertain with each payment whether your local utility is about to go bankrupt.
“Stocks are bought and sold fast; markets change and plummet—such that we have a stop button for it, because it can go off the rails,” Van Loo noted. “But we don’t have those kinds of protections in most other markets.” There’s potential for collateral damage everywhere. If millions of people switching to higher-yield accounts causes a bank run, that’s a disaster for any person or institutional investor with money locked up at that bank. If half of Verizon’s customers switch to AT&T in one week to take advantage of a flash sale, the business could collapse overnight, affecting the other half of its customers. Sometimes, this rapid switching could signal healthy competition. Other times, it could cause organizations to implode.
A world where AI proxies do the planning and talking could also mean a future where humans are constantly surprised by things they once were able to anticipate: a birthday present for your spouse ordered in a preposterous size that you must try to explain; a plumber showing up out of the blue.
Or perhaps none of this will happen. It’s possible that an assistant-dominated economy turns out to be far more mundane, defined by tacked-on fees to keep the agents in check. Instead of agents allowing you to negotiate and bring down health-care, insurance, and electrical bills, the companies responsible for all of these services charge your agents every time they request to pull your data. Banks, to bolster their revenues in the event of a bank run, institute new and higher fees on checking accounts. Amazon, unable to profit from dynamic pricing and ads in the face of perfectly rational agents, raises prices for consumers and takes a bigger cut from manufacturers. “Generally, if one fee goes away, you get another,” Fradkin said. In other words, everything could be faster, easier, and more efficient for the consumer—but potentially more expensive.
Van Loo said that the bigger AI companies will eventually find ways to strike deals with platforms via these protocols, negotiating access, commissions, and partnerships in ways that benefit the companies, not necessarily the consumers. This could result in a sort of preferential treatment like the deals already in place between Meta and Walmart, Sephora, and other retailers, which will effectively cause Muse to prioritize their products. Taking another approach, Amazon has blocked Muse and encourages visitors to browse with its own agent, “Alexa for Shopping,” meaning the company is basically negotiating on both sides of the deal. Meanwhile, this week, JPMorgan announced that it would not allow Instinct, Muse, or other agents into customer accounts. Ultimately, this might all lead to “the same old heavily obstructed, inefficient world we have now,” Van Loo said. “But it will look far more efficient, because it will save some people time and feel much more convenient.” Very powerful companies will design new structures for markets and the internet, determining what can be sold, by whom, and for how much—as they always have.
For all the time and money the agentic future could save us, the technology entails another sort of cost: an additional layer of abstraction and disengagement. We’ve largely outsourced our decision making to a small number of platforms: Amazon guides our shopping; Google Maps steers us toward certain restaurants and primary-care providers; Instagram dictates our news consumption. We are told that these recommendations and ads are, based on troves of personal data, already optimal. The companies pushing agents assure us that the decision making will now be even more rational and the deals even better. But checking these claims for ourselves will be harder, because the logic behind those recommendations will be buried in large-language-model chains of reasoning. Eventually, the skeptical instinct to check agents’ work could atrophy altogether. Over time, humans will play a smaller and smaller role in their own life.
In the age of the algorithm, it’s easy to throw out cliché terms such as late-stage capitalism in an attempt to describe the extractive, inhumane dynamics of the economy. But what is an agentic future if not the furthest extension of our current market logic? A future of capitalism so perfect, so efficient, that it doesn’t need us at all.
Somehow, America has yet to reach peak protein. Perhaps we never will. Even after David bars have gone viral for being bricks of essentially pure protein and Starbucks has rolled out lattes topped with “protein cold foam,” new and somehow weirder protein-laced products keep hitting shelves. You can now buy protein Honey Nut Cheerios, protein popcorn and PopCorners, protein sodas, protein ranch dressing, and protein chips. (Doritos launched a nacho-cheese-flavored version with 10 grams of protein per one-ounce serving.)
In an era of GLP-1 drugs and peptide stacks and Oura rings and self-optimization, of wellness influencers and looks-maxxers, everybody seems to be doing everything they can to eat as much protein as possible. The magical macronutrient will supposedly make you more muscular, or more toned, or thinner—or something, really anything, just better. Amid the protein frenzy, regular food seemingly doesn’t cut it anymore. Why order a simple flat white when you can instead sip a Dunkin’ Nutty Pumpkin Iced Protein Latte?
Into the fray, I would suggest a humble alternative: Have some yogurt. Calorie for calorie, Greek yogurt has more protein than Chipotle’s High Protein Low Calorie Bowl, Kraft’s new PowerMac, or yes, a Dunkin’ Nutty Pumpkin Iced Protein Latte. So do some traditional yogurts, as well as other fermented options in the dairy aisle such as skyr and kefir. And that’s if you opt for the full-fat, luscious kind (which I recommend). Nonfat Greek yogurt, which is lower in calories, is roughly as protein-dense as a David bar—with the added benefits of having just two ingredients (milk, culture) and not tasting like plastic.
Yogurt is not only full of protein but also good for your bones, your digestion, and your immune system. Yogurt is an ingredient: Eat it plain or bake with it, use it as the base of a sauce or dip, throw it in a marinade or soup. Sure, some yogurts have added sugars, but so does a Starbucks Iced Banana Protein Cream Matcha. And as far as health fads go, yogurt is typically probiotic. All things considered, yogurt may be the easiest protein of all.
In spite of everything it has going for it, yogurt has not been the face of the protein craze. Perhaps that’s because yogurt is not splashy or technologically innovative or referred to by a trademarked proper noun. A David bar may taste different and have distinct packaging from an RxBar or a Jacob protein bar made with beef tallow, but all plain yogurt is the same. Though some companies have released “protein-enhanced” yogurt (whatever that means), for the most part yogurt is not optimized by corporate food scientists and focus groups in the way that today’s protein-branded products are. Yogurt has been optimized in the sense that humans have consumed it for thousands of years.
Imagine wellness influencers suggesting that you dollop yogurt into a bowl and sprinkle berries on top without measuring anything. There wouldn’t be any regimen to adopt or wellness plan to pay for. There wouldn’t be any special trademarked protein products for influencers to hawk: The company behind the David bar, for instance, has sponsored Andrew Huberman and, until recently, Peter Attia was its chief science officer. The homemade parfait would all be rather mundane and boring compared with Attia’s rotation of four protein powders or the bodybuilder Chris Bumstead’s breakfast filet mignon. It wouldn’t get any views.
Protein is not just a health fad; it is a business. So is everything else in the world of wellness. Indeed, there’s something about many of these setups—which proffer the perfect low-calorie, high-protein snack to pick up on your way to work every morning; a biometric wristband to wear every night; supplements to consume every day for the rest of your life; a weight-loss drug you will inject every week—that keeps people coming back for more, giving their attention and money and energy to the endless pursuit of betterment.
Health and more broadly self-improvement are, obviously, admirable pursuits. Protein can be a way to achieve either. But obsessing over hitting those goals can become unhealthy, as most obsessions are. Have some yogurt, or don’t. You’ll probably be fine.
The second floor of OpenAI’s old headquarters had a theme. Each room was named after one of the most important inventions in human history: “Clock,” “Fire,” and, of course, “AGI,” or artificial general intelligence. I saw this in the spring of 2024, when I was interviewing some of the company’s researchers about recent technical advances. At the time, ChatGPT was still making embarrassing arithmetic errors, and the notion that the bot would ever rival human intelligence was dubious. But here, in the renovated shell of a former mayonnaise factory in San Francisco, AGI’s arrival was predestined.
This belief in AGI—a computer program with capabilities that rival or even exceed those of the human mind—is foundational to the mission of Google DeepMind, OpenAI, and Anthropic, three of the most influential AI companies in the world. And the pursuit of that milestone is the subject of The AGI Chronicles, a new book by the tech reporter and Atlantic contributing writer Kevin Roose, which he describes as his attempt to document the decade “when the human monopoly on advanced intelligence ended, and a new world was born.” Roose, a prominent and well-connected commenter on the AI boom, follows the internecine world of the frontier AI companies in remarkable, at times almost insular, detail. Based on interviews with more than 150 researchers, executives, investors, and policy makers close to the technology’s development, The AGI Chronicles traces crucial moments across DeepMind, OpenAI, and Anthropic from 2015 through early 2026 to figure out how we got to this very messy moment in AI, and who’s responsible for what happens next.
If you scan statements from executives such as Anthropic CEO Dario Amodei and OpenAI CEO Sam Altman, there is a sense of fatalism about the rise of AI. In my conversation with Amodei last year, he likened developing AI to operating an out-of-control bus: It can’t be stopped or even slowed, but perhaps it can be steered. In an interview last month, Altman called AI “an inevitability.” According to this framing, AI executives are simply conductors, doing their best to provide guardrails for an era that’s careering our way, whether anyone likes it or not. Roose’s book prompted me to consider a question that is often neglected in the mile-a-minute news cycle: Are the leading AI companies simply heralding an inevitable evolution of this technology, as many of them claim, or are they directing that advancement? The answer will have tremendous bearing on how we assign responsibility for the world taking shape around us.
The AGI Chronicles is of both minds on the topic. On the one hand, Roose is very explicit that he is archiving decisions made by a small group of people. “AGI was not inevitable,” he writes, but “invented, developed, and commercialized by a few hundred people.” On the other hand, sometimes the book reads like a natural history, describing a procession of events outside the control of any specific group of people, an almost geological force sweeping the planet as “a new world was born.” He notes how, throughout the years, various companies and officials had yet to “wake up.” By 2024, he writes, “the idea of going back to the old world, to a time before all this, seemed more delusional than expecting the exponential to continue.”
At times, Roose’s book echoes the loss of agency professed by AI executives. Of course, the inevitability of any one outcome is a self-serving fabrication. There is no prophecy that a handful of Silicon Valley companies dictating their own rules, running roughshod over copyright law and environmental regulations while mucking up once-reliableinternet services with AI features nobody asked for, will operate largely unencumbered. Industries take shape through decisions made by individual actors and investors, the collective desire of the public, and the action or inaction of regulators.
If you look to the late 1800s, for example, it would have seemed likely that electric cars would dominate the market in the following century. America’s best-selling car in 1897 was electric, and in the 1910s, Henry Ford was trying to develop an electric car with Thomas Edison. But a series of technological limitations and human decisions—including various financial missteps and harsh criticism from advocates of petrol-powered cars—changed the course of history, leaving a legacy that we’re reckoning with more than a century later.
In the 1950s, it seemed as if nuclear reactors were destined to dot the nation and power the future. But a series of political campaigns and spectacular errors—the anti-nuclear movement, Three Mile Island, Chernobyl—crushed the nuclear age before it ever really started. Then there was the Space Age and supersonic flight—there are so many seemingly inevitable technological eras that never quite made it, not so much because of technology itself as because of political and economic choices. There are, similarly, so many corporate behemoths—Standard Oil, Kodak, Bear Stearns—that, because of regulation or complacency or fraud, unraveled. The inverse holds for many technologies and companies considered inevitable today: Different regulatory environments, international agreements, or priorities for Pentagon labs could have stopped the development of an open and global internet, smartphones, social media.
When I recently called Roose to discuss his book and ask what he made of the industry’s frequently prophetic tone, he initially told me he believes that “nothing about this was inevitable. These were decisions made by people.” But he then said that he wanted to “complicate” that: “Once scaling the transformer worked, and once the scaling laws were documented,” Roose said, “I think it was inevitable that the companies building this stuff would push it as far as they possibly could.”
I’d like to further complicate that view. Beyond the urge to test the bounds of any technology and reap enormous profits, the industry has been shaped by very human decisions. AI researchers chose to train their models on troves of copyrighted works without seeking permission, leading to countless creators suddenly getting left out of the economic equation. OpenAI chose to rush a free-to-use ChatGPT to the market in late 2022, kicking off a hype cycle and a subsequent investment bonanza. Venture-capital, private-equity, and tech firms chose to sink untold billions into a still-unprofitable technology. Data-center developers chose to eschew solar panels in favor of combustion turbines, which they perceive as faster and more reliable. On the government side, Donald Trump has chosen to ignore or eliminate any substantive federal regulation of AI. An industry that negotiated royalty payments, prioritized clean energy, gave itself longer development cycles, or faced serious federal regulation might look entirely different.
The question of inevitability and responsibility may sound arcane, but it has real ramifications. In the Bay Area, tied up with the myth of AI’s inevitability is a sort of spiritual devotion: “Thank you to the machines, and the structure of reality, for letting us understand a little more,” Altman wrote on X this week. The more you treat AI as inevitable, the more it seems like a cosmic force rather than a product resulting from industrial and commercial design choices. The more you treat AI as inevitable, the less you can hold any company or person responsible for things going wrong. The executives, in this view, are only fractionally more empowered than us in deciding what happens next; more important, everyone else needs to wake up. As Altman put it to Politico earlier this month, “The world should accept some bad things happening for the benefits of this technology.”
In the months since Roose concluded his reporting, the AI industry and its products have risen to still-greater global prominence and triggered even greater fears. When I asked him what new chapters he might add if he were still writing, Roose said that he would end the book with the recent White House press conference in which Trump, Amodei, OpenAI President Greg Brockman, Elon Musk, and several other tech executives addressed AI-safety concerns. He recalled a speech Amodei gave in Anthropic’s early days about how different parts of society would gradually become attuned to the transformative effects of this technology, beginning with AI firms and ending with the state. It felt, Roose told me, “like the prophecy had been fulfilled.”
The Australian government has been scrambling since the revelation that, earlier this year, it was hacked. At the United Nations General Assembly last month, Australian Prime Minister Anthony Albanese shared that OpenAI models had, of their own accord, accessed private data from the nation’s Medicare database—in addition to probing or seeking to infiltrate at least three other government agencies. Just this week, Australian lawmakers grilled OpenAI Chief Strategy Officer Jason Kwon over the incident: “If you hadn’t voluntarily provided that information to government, we still wouldn’t know today?” Senator Jonathon Duniam asked. “What you say is a reasonable conclusion,” Kwon replied.
Meanwhile, the country’s government is steeling itself for a future of AI-powered hacks: The Australian Department of Home Affairs has ordered all government agencies to, within the next six months, identify legacy IT systems and establish a plan to phase them out. In a world in which “frontier AI capabilities have targeted the Commonwealth’s technology,” the home-affairs secretary wrote, such software poses “an unacceptable risk to the Australian Government.”
Australia is just one of the nations, associations, and private companies bracing for a wave of AI-powered hacks. Criminals and state-sponsored intelligence groups are now using the technology to execute cyberattacks with greater speed, scale, and sophistication—including hyper-personalized phishing emails and automated intrusions. As a result, the number of cybersecurity vulnerabilities disclosed each month has doubled since the start of the year, according to research by Google’s Threat Intelligence Group.
In response, IT teams are scrambling to shore up their defenses. “It’s a matter of months, or maybe a year, in which the task of securing the software foundation of civilization will have to be solved,” Stanislav Fort, a former Anthropic researcher who is now the chief scientist at the cybersecurity firm AISLE, told me. And AI is not only making cyberattacks more effective but also increasing the surface area worth hacking. Breaking into a website or executing a ransomware attack takes time, Fort said, so hackers have traditionally chosen large targets with sizable payoffs. But cheap, tireless hacking agents mean any organization or person might be worth targeting. At the same time, the cybersecurity professionals I spoke with were confident they could rise to the occasion. “If we step up our game in cybersecurity, as a field, we can definitely meet the challenge stemming from AI,” Fort said.
The cyberattacks on Minnesota water facilities this past summer offer a preview of things to come. Iran-linked hackers disrupted dozens of water utilities in Minnesota, many in small communities that might not have a dedicated cybersecurity person on staff. “We were fortunate that there was a very alert operator that said, ‘Hey, I saw a pump go offline,’” John Israel, Minnesota’s chief information-security officer, told me. The state received a report from the operator around 3 a.m., and within two hours began investigating and responding. The hackers targeted a weakness in industrial computers that had been announced by the Cybersecurity and Infrastructure Security Agency only days earlier. The water utilities temporarily fell back on manual processes to stay operational: For instance, a water operator might have to “drive out to that water tower every few hours” to make sure everything is working, Israel said.
Although AI was not directly implicated in the Minnesota cyberattacks, Emily Zimmer, a spokesperson for Minnesota IT Services, told me, “we assume most adversaries use AI” to amplify their attacks. In other words, it’s hard to imagine a hacker not using the technology today. CISA issued an advisory noting threat actors using AI-generated malware to target similar computers in critical infrastructure across the nation. “We’re going to see more vulnerabilities, there’s going to be more patches, and we have to implement them faster in order to prevent those attacks,” Israel said. “And our numbers are showing that that’s the case.” For small towns with small-town budgets defending themselves against nation-state hackers, the challenge is even greater. Minnesota IT Services sends “cybernavigators” around the state to assist with cybersecurity, Israel said, but “hundreds and hundreds of cities and small towns and things” are in need of assistance.
An adequate defense from AI attacks demands a paradigm shift in cybersecurity. Historically, IT professionals have had the luxury of time—human defenders just had to move faster than their human adversaries—but AI is enabling far more and far faster attacks. Of course, cybersecurity experts are themselves leveraging AI. “I’m not saying the sky is falling,” Israel said, although he is concerned. “We’ve all got to build capacity on how we respond.” And there is an asymmetry between attackers and defenders. The former use new technologies with abandon, but companies and government agencies tend to be slower and more conservative.
Hospitals, for instance, are particularly prized and vulnerable targets for cyberattacks. They store troves of medical records, payment information, and clinical-trial data. Like local water utilities, they can also lack substantial IT resources. Given the risk to patient life from a major outage, clinics are especially likely to pay a ransom. Today, hospitals “have to assume that anything connected to the internet especially is not 100 percent secure,” John Riggi, the national adviser for cybersecurity and risk at the American Hospital Association, told me. Even small facilities have thousands of computers, phones, and medical devices that could be invasion points—so Riggi helps not only secure their IT but also prepare them to operate using analog methods in the event of a debilitating hack.
Additionally, hospitals have to be particularly careful in adopting defenses against AI. A clinic cannot implement new code without making sure it won’t disable its ventilators, drug-infusion pumps, X-ray machines, and other crucial devices, Riggi said. Tech companies like to “move fast and break things,” Scott Gee, the AHA’s deputy national adviser for cybersecurity and risk, told me. “In the health-care field, those things are people. We cannot move fast and break them.”
Hackers’ odds of coming out ahead are getting better and better. AI is allowing them to both exploit more quickly and automate an actual intrusion. Organizations used to have a month to patch vulnerabilities before they were in serious danger, Adam Meyers, the senior vice president of counter-adversary operations at Crowdstrike, told me. Now they might have only 24 hours to make a fix, he said. And that could “get driven down to the point that you’ve got 30 minutes to patch when a new vulnerability comes out.” A hospital, electrical grid, water system, and really any facility providing important services in real time simply can’t risk implementing new code that quickly.
When we spoke, Riggi and Gee were coming off a weekend spent helping hospitals shield themselves against widespread hacks that targeted security flaws in Citrix NetScaler, a platform Riggi told me some 50 percent of hospitals use. NetScaler is “equivalent to air-traffic control” for digital information flowing in a hospital, he said. That made the program a prime target for hackers and tricky for hospitals to disable and repair, because there could be “unpredictable cascading effects, which could affect health care.” Riggi said it’s unclear whether AI was used in the development of the attack—as is frequently the case—but the rapid discovery and exploitation makes it plausible.
Many IT systems consist of decades of software that has been layered onto older software. This means an attack on just one program or product could have unpredictable, wide-ranging effects across a hospital or other organization, Riggi said. We should expect to see “more attacks, faster attacks, and a need for companies to transform quicker than they are used to,” Lee Klarich, the chief product and technology officer at the cybersecurity firm Palo Alto Networks, told me. His company spent the first half of the year rushing to launch a product to defend critical infrastructure against advanced AI hacks. To go from ideation to launch, Klarich said, in “five months—we’ve never done something that fast.”
Although companies and small cities may be slow to adopt AI for cybersecurity, they can also be quick in incorporating the technology into daily operations and, in turn, introducing new weaknesses. Agents and chatbots might store and leak personal data, or be tricked into sharing credentials or writing malicious code. As generative-AI models have become more capable, they have become, if anything, even less understood—OpenAI recently reported that its models posted user-uploaded images to the web. Both programmers and nontechnical employees are vibe coding new applications that may be insecure. “We’re seeing hackers use AI to attack companies’ AI bots, to then use those AI bots to attack other companies,” Adam Ely, who leads AI security at Check Point, told me. That’s not even accounting for employees’ individual AI accounts, which are not subject to corporate oversight. AI puts organizations “under constant threat from the inside and the outside,” Todd Marlin, the CEO of Guardrail Technologies, told me. He contracts with some of the largest companies in the world, only to find that they “are just trying to even understand what’s going on in their house.”
There’s yet another layer of uncertainty: Cybersecurity professionals are trying to prepare for AI attacks without fully knowing what bots are capable of. Dawn Song, a professor at UC Berkeley and a research scientist at Meta, runs a group responsible for developing some of the hardest and most widely used tests for AI-hacking capabilities. But frontier models’ rapid advancement is requiring her group to develop harder tests at a faster rate. “The shelf life of the benchmark before it gets saturated also gets shorter,” Song, who spoke in her personal capacity, told me. “This creates huge challenges for us to continue to be able to evaluate the frontier.”
The cybersecurity professionals I spoke with all expressed at least some hope about how AI could be used to strengthen security, by stressing that our existing digital infrastructure is already riddled with security flaws and shoddily written code. Small towns and companies, lacking resources for or even much awareness about cybersecurity, were already vulnerable.
AI can provide both the impetus and a tool for serious, structural repairs that were long overdue—detecting and eliminating vulnerabilities and monitoring for intrusions 24/7. Minnesota, for instance, has partnered with OpenAI and Anthropic to gain access to their most advanced AI models for cybersecurity. But even this move contains an admission: Only AI can save us from AI. Any way you look at it, the situation could one day be beyond human control.
Login
