In September, Anthropic CEO Dario Amodei warned that, within six to twelve months, a more capable swarm of AI agents might be able to take over the internet through a persistent botnet: a network of compromised devices an attacker can control. Amodei's essay

That's a warning about a possible future capability. It isn't a date when the internet is guaranteed to stop working.

But there is a reason to pay attention today. In October, security researchers described a real operation where an attacker used an AI coding agent to help build attack tools. The same month, Google explained how it is using AI to help its own engineers find and fix software weaknesses.

So what happens when both sides get better tools? And what can the rest of us do while they race?

I am Alex, welcome to ShortCu8 by Innov8.

Lets Dive Deep 🐰

Start with the account that can open your other accounts: your email. Many password reset links land there. Use a passkey if offered; otherwise, use a unique password and turn on two-factor authentication if available. Check how you'd get back in if you lost your phone. FTC guidance, Google's passkey guide

This story has an awkward detail for the attacker.

Researchers at security firm SOCRadar found an exposed server containing the working files of an operator linked to a ransomware group called n0n. The files gave them a look at the operation's tools, targets and AI coding environment. SOCRadar's October 28 investigation

According to the researchers, the operator used an AI coding agent to write and debug hundreds of attack scripts. Think of a script as a small program that can repeat a task on command.

SOCRadar's conclusion was that a human directed the operation with AI assistance. The researchers did not observe a fully autonomous attack system.

Every intrusion the researchers documented relied on weak or compromised credentials, including logins and exposed access keys.

All that AI, and the way in was still a credential someone could use.

In one case, SOCRadar says the operator used stolen administrator credentials to get into a cloud hosting company and take backups belonging to its customers. A single company's access controls could affect people far beyond its own staff.

This is not the only case where investigators have found AI tools alongside an attack. In a separate October report, CrowdStrike described AI tooling used in activity targeting South Korean financial organisations, where data was stolen. The number of affected organisations was unconfirmed in its report. CrowdStrike's investigation

Neither case tells us every recent breach was caused by an autonomous AI agent. They do show why a person using AI can be a serious concern long before that sci-fi scenario arrives.

Finding a security weakness is only the start. Someone still needs to check whether it affects a real system, work out a fix, test it and get that fix running.

On October 26, Google described an internal program called Project Fortify. Google says its AI tools scan for vulnerabilities, investigate the findings and propose code fixes. Human engineers then review and merge the changes, which are deployed in stages. Google's explanation

That last part matters. A fix sitting in a test environment is not yet protecting the live service you use.

Google's program is an example of defence against software vulnerabilities; the n0n cases above involved compromised credentials. They are different problems. Together, they show why the people defending a service need to watch both its software and the keys that grant access to it.

You already know one way the internet tries to stop bots: the little box asking you to prove you're human.

In February, Cloudflare said its verification widgets and challenge pages were served an average of 2.14 billion times a day in 2023, rising to 5.35 billion a day in 2025. That's a count of checks from one company. It doesn't tell us how many people were blocked, or how many checks involved AI attacks. Cloudflare's figures

The tradeoff is already familiar: services want to keep abusive traffic out without making legitimate visitors jump through endless hoops. The same tension appears with your own accounts. A security check can protect you, but it can also lock you out if you lose your phone.

Those are real design problems. They don't establish that everyone will soon need an identity card to open every website. They do make a good account recovery option worth setting up before you need it.

The n0n cases involved organisations' credentials. Securing your personal email would not fix a company's systems.

But your inbox may hold password reset links for your bank, shopping accounts and social media. If someone takes over the inbox, those links can help them try to take over other accounts. FTC on protecting your email

Open your email provider's security settings on a device you trust, then check these things:

If you receive a breach notice, open the service's app or website yourself to check it. If a password was exposed, change it there and anywhere else you reused it. Then follow the service's guidance for the information that was exposed. FTC breach advice, FTC on suspicious notices

These steps make account takeover harder. They cannot make a company secure its systems or retrieve personal data that has already leaked.

We don't know exactly what an internet shaped by more powerful AI attacks will look like. But password reset links for your other accounts can already arrive in your inbox. That's the account I'd check today.

We read every reply - just reply to this email and let us know how we can improve !

#AD1

A shopper types “running shos” and gets nothing back. Another types “red waterprof trail runners under $150” and hits the same wall. Both knew what they wanted.

Traditional site search relies on exact keyword matching, leaving shoppers stranded at “0 results found” screens.

Gladly understands what shoppers mean, typos and all. Instead of a dead end, they get products that fit what they asked for and a conversation that keeps them shopping.

See how Gladly turns dead-end searches into sales

Turn Dead Ends Into Sales

#AD2

MarketBeat analysts just updated their 10 Best Stocks to Own for Fall 2026 report. The list includes AI growth names, a high-yield dividend payer, a steady portfolio diversifier and companies positioned for continued growth into year-end. Get all 10 stocks and the research behind them for free now.

See the 10 Stocks