This week could go down as the worst in the history of cybersecurity. On Wednesday, news emerged about two major vulnerabilities in PHP, a programming language used by 70 percent of websites, which prompted governments, hospitals, and companies around the world to take digital services offline as a precaution. There have already been millions of attempts to exploit these weaknesses.
But the PHP vulnerabilities were just the most attention-grabbing in a series of alarming revelations. Security flaws in, or successful hacks of, several major software products and platforms—including some used by Netflix, PayPal, Walmart, and other big names—were announced that same day. Yesterday, Quest Diagnostics, which runs lab tests for a third of American adults each year, disclosed that it, too, had been breached. When I asked Sam Rubin, a senior vice president at the cybersecurity firm Palo Alto Networks, about the potential fallout from yet another hack—this one of the cloud platform Railway, which is used by Intuit and MGM Resorts, among others—he paused. “I didn’t see that one,” Rubin said. “It’s been quite a busy week.”
Yet what’s most alarming about the past few days is that by next year, this stretch of incidents—which some security experts are calling “Black October”—may be remembered as normal, or even tame. “It’s going to feel like, over and over and over again, we’re finding more and more bugs in very critical pieces of software,” Matthew Prince, the CEO of the internet infrastructure and security company Cloudflare, told me. “This story, which feels unique and fresh right now—in a few months, it’s going to feel like we get one of these every week.” Prince said he knows of still more vulnerabilities that will be announced in the near future.
For the next year or two, if not longer, the internet is going to feel a bit touch and go, and more dangerous than we’ve come to expect. “It’s going to feel like the sky is falling” for a while, Prince said. There’s a decades-long backlog of bugs in software written without much review or scrutiny—which was more or less fine so long as there was a very small number of skilled hackers. Over the past two decades, companies, governments, and individuals have been lulled into a false sense of security: Most people don’t think twice about punching credit-card numbers into the website of a local restaurant or gift shop, or forking over a home address and phone number in just about any customer survey. But the internet was always a dangerous place. We’re just waking up from a trance.
AI agents can now be deployed as a cheap and near-infinite hacker army. In just the past couple of months, Rubin said, open-source models—which can be downloaded for free and used without restrictions—have become very good at finding vulnerabilities and automating attacks. In turn, the amount of malicious cyber activity has spiked. More websites will be defaced, more personal information will be stolen, and ransomware will proliferate. Rubin told me that the internet is entering a “valley of pain.” When I posed the concern that this is the new normal to Adam Meyers, a senior vice president at the cybersecurity company CrowdStrike, he told me, “I think it’s going to get a lot worse, actually.”
Consider, for instance, another set of vulnerabilities disclosed this week, to the program Node.js. This software, which executes JavaScript code for dynamic webpages, is widely used by Fortune 500 companies, as well as in programs developed with AI. “These are the things the web runs on,” Meyers said. Because of how the platform is used, compromising just one software product that uses Node.js could infect tens of thousands of other organizations, Rubin said, in what is known as a “supply-chain attack.” And the skill threshold for launching cyberattacks has become almost absurdly low: CrowdStrike tied a spate of cyberattacks on South Korean banks late last month to a 26-year-old in China. “After he got access to all the data, he turned around and asked AI, ‘How do I monetize this? Where can I sell this?’” Meyers told me. He “didn’t know what he was doing.” Meyers said CrowdStrike is detecting “a new agentic adversary”—that is, an AI-powered hacking operation—“every two hours.”
Navigating this will require rapid and tremendous coordination from basically every sector. For instance, the vulnerabilities in PHP were discovered months ago by a consortium of AI and cybersecurity firms. Then, “very quietly, for the last several months, we and other industry partners worked to effectively put in place protections,” Prince said—basically, temporary shields until the weaknesses could be fully addressed. But “not everybody uses CloudFlare, and not everybody is quick to patch their software.” Some of the cybersecurity experts I’ve spoken with are optimistic about AI: Eventually, they say, AI will be used to find and address many of the major cybersecurity flaws, and the internet will become much safer overall. But before then, we may be stuck in a terrible limbo. “This is going to last as long as it takes to rewrite and secure the billions of lines of code that have always had these vulnerabilities,” Alex Stamos, the chief information-security officer at the AI company Cognition and a former chief security officer at Facebook, told me.
And even as cybersecurity experts rush to leverage AI to save the internet, the technology is introducing plenty of new problems. All vibe-coded apps, for starters, are very likely to contain security flaws. And at a time when people need to be more vigilant about their digital hygiene, multiple cybersecurity experts brought up the widespread adoption of AI assistants with more than a hint of scorn; as Rubin put it: “Our peers are using Muse and giving it carte blanche to use your credit card.”
The internet is becoming a wilder place, and the path to secure it may require, in essence, a sort of pruning. “You’ll likely see more companies take services off the internet when they don’t need to be there,” depreciating old webpages and forms so they can’t be targeted, Dan Guido, the CEO of the cybersecurity firm Trail of Bits, told me. Individuals might be encouraged to delete unused browser extensions, he added, so that there are “fewer pieces of software that can access your data.” People in general need to be “more discerning of the companies they work with,” Stamos said, and “you’re just not gonna be able to assume every site you use is secure.” That Pokémon trading-card website, fantasy-sports platform, or birding forum you use could be hacked for a password you’ve reused elsewhere, or a credit-card number, or worse. Other advice I heard: Don’t host your own email client instead of Gmail. Don’t host your own file system at home instead of using the cloud. Google and Dropbox have the resources to defend against an onslaught of AI hacks, and you don’t.
If, eventually, we do find and shore up all of the cybersecurity vulnerabilities out there, the result could be a more open web, where anybody can use widely available AI tools to run security checks at any time and you’ll feel safer sharing your personal information again. But another possibility is an even more centralized internet, where only services and websites developed by large software providers are deemed trustworthy and reliable. The internet needs new walls to defend against AI-powered attacks. But in turn, we might also feel walled in.
Three months prior to the launch of ChatGPT, OpenAI published what would prove to be a prescient blog outlining the firm’s approach to ensuring that its AI models would be safe and beneficent. This goal, known as “alignment”—as in, aligning AI with human values—is nebulous, grand, and perhaps the AI industry’s most foundational promise. The notion is right there in OpenAI’s mission statement to ensure AI “benefits all of humanity” and listed as one of Anthropic’s “primary” goals.
Yet even in the summer of 2022, OpenAI was admitting a sort of defeat: “There is currently no known indefinitely scalable solution to the alignment problem,” three of its researchers wrote in that same blog post, adding that developing one “is likely very difficult.”
If the goal of keeping AI beneficial to mankind sounds rather vague, it is. Four years later, the alignment problem remains unsolved, and for that matter, there isn’t consensus about what the problem even is. Meanwhile, AI bots are autonomously hacking sovereign nations. And sending fake murder tips to police hotlines. And creating aliases to launch phishing campaigns. OpenAI and Anthropic still can’t really tell you what an aligned AI model looks like. But anybody can tell you it doesn’t look like this.
The most influential AI executives and investors in the world fundamentally disagree about the nature of the technology and, more pragmatically, how to make their products safe. On one side is Anthropic CEO Dario Amodei, who last month warned that AI advancement could soon “outrun our ability to understand and control these systems.” Amodei’s solution is a slowdown, which would give the industry time to “ensure that our alignment training keeps up” with AI progress. On the other side is Nvidia CEO Jensen Huang, who says misalignment fears are “not grounded on science” but rather “made up” and even “irresponsible.” In his view, AI models are not new and unpredictable beings, but lines of code. And code can be debugged.
If alignment seems like a strange concept for a software product—you don’t imbue a web browser or word processor with moral values—that’s because it was conceived for a strange sort of software. The leading AI companies envisioned building powerful systems that would act in unpredictable ways, which Claude and ChatGPT now are doing, and so ensuring safety was a foundational concern. Alignment is one idea for doing so: If AI models could learn to code and write poetry, maybe they could learn human values too. Anthropic and OpenAI both have lengthy documents—“Claude’s Constitution” and the “Model Spec,” respectively—that outline these values and are used to train their models. But there has been, of course, millennia of disagreement over what constitutes a moral or ethical code. This is a “very complicated, unsolved scientific and philosophical question,” Marius Hobbhahn, the CEO of Apollo Research, an AI-safety firm that has helped audit Anthropic and OpenAI models, told me. Still, some developers have suggested an intuitive, bare minimum: For instance, in 2021 Anthropic researchers wrote that, as a catchall, an AI system should be “helpful, honest, and harmless.”
Training models to be more aligned to those maxims appears to have worked—to an extent. The model underlying ChatGPT, for instance, was initially prone to nonsensical and toxic utterances. But by fine-tuning it with lots of human feedback, OpenAI worked to address these problems. A couple of years later, dozens of people alleged that the bot worsened their own or their loved ones’ mental-health crises, sometimes resulting in suicide. Again, OpenAI worked to address the issues.
There’s now a growing sense, both within AI companies and among their critics, that alignment as it’s been practiced over the past four years is faltering—if it was ever really up to the task. Adam Kalai, a former OpenAI safety researcher who left the company this summer to start the Institute for Responsible Superintelligence, likened alignment to buttressing a structurally unsound dome. Eventually, it will collapse. “You observe misalignment while training a model, and then adjustments are made to align it,” Kalai told me. “But obviously that’s not a way to achieve lasting safety.” Pronouncements from OpenAI and Anthropic that their latest model is the “most-aligned” yet are not scientific guarantees, and may not even provide strong technical assurance of safety.
“Fundamentally, we just do not know how to do alignment,” Hobbhahn said. If somebody “came with a thousand-page document that explained exactly how to do everything, we couldn’t get a model to learn exactly that.” Even in 2022, OpenAI didn’t think humans could figure out a lasting way to align their machines. Instead, the company wrote, it hoped AI itself would come up with a solution so that humans could “off-load almost all of the cognitive labor required for alignment research.” In other words, the best-case scenario involved limited human understanding of what was going on.
There are other reasons that reaching some actual alignment is unrealistic. For instance, the amount of training data dedicated to “moral values” would appear relatively small. Meanwhile, these models have ingested all manner of vile and illegal things from the web, and are then directed to pursue goals by any means necessary. The alignment-focused training cannot provide enough “examples of good behavior,” Thilo Hagendorff, an AI-safety researcher at the University of Stuttgart, in Germany, told me.
Plenty of evidence suggests that the alignment approach to safety has failed, including the hacks of Hugging Face and the Australian government. AI companies figured out how to make one-on-one interactions with a chatbot relatively safe, but many agents interacting for very long periods of time seems to degrade existing guardrails, Hagendorff said. As AI agents have become more capable, they’ve also shown tendencies to cover their tracks and lie about misbehaving, communicate in code that is unintelligible to humans, and try to avoid being shut down by humans. “No lab has solved alignment” enough to keep racing forward, Jakub Pachocki, OpenAI’s chief scientist, wrote in an essay last month. The industry has coalesced around a new, somewhat quixotic phrase: “pacing the frontier.” In other words, slowing down AI development until engineers can get better at alignment, or at least construct new scaffolding to fortify their crumbling dome. (OpenAI did not respond to a request for comment. An Anthropic spokesperson told me that alignment is a key part of the company’s safety work but that, because alignment techniques are not fully robust on their own, Anthropic has additional model safeguards in place.)
Then there’s the anti-alignment camp, led by Nvidia’s Huang, which believes that this effort, marked by treatises on ethics and moral constitutions, verges on absurdity. To Huang, preventing all of these AI incidents is “as simple as engineering.” AI models involve, fundamentally, electrons moving around a data center to multiply numbers. All that OpenAI and Anthropic need to do is go into these systems, “just root-cause the problem,” and fix it. And if AI developers can’t do this themselves, “a bunch of companies with engineers ought to send engineers in,” Huang recently said. Put another way: The global semiconductor supply chain is an unbelievably labyrinthine system that must be managed flawlessly in order to deliver high-end chips. If Nvidia can do that, why can’t OpenAI get its models under control?
Huang, of course, has plenty of incentive to downplay concerns around AI: Nvidia, which has become one of the most influential companies in the world by selling AI chips, could be hobbled by some kind of industry-wide slowdown. But many outside experts concur. “We have this entire set of safeguards that we can use to control these systems,” Sayash Kapoor, an AI researcher at Princeton, told me. Those include limiting what files and programs models can access, as well as monitoring AI actions. The Hugging Face hack, for instance, could be seen as the consequence of very powerful AI models or very incompetent internal security practices at OpenAI. “The sorts of oversight mechanisms that we use in our 10-person group would have been enough to prevent the OpenAI Hugging Face incident,” Kapoor said. None of that involves inscribing neural networks with moral codes.
Whichever vision of AI safety you subscribe to, there is at least one seeming point of agreement among them: The industry is moving too quickly to adequately guarantee its products are safe. Despite everything they say publicly, the two CEOs and their rivals are all continuing to race ahead. Nvidia is the biggest company ever by market capitalization, and Anthropic is seeking the largest public offering ever. Anthropic, OpenAI, and the other top firms now release new models relentlessly. Any slowdown, for any reason, would necessarily affect the bottom line. The most dangerous alignment problem might be not technical or cultural, but economic.
The internet could be on the verge of a total meltdown. Yesterday, someone posted to a public forum that two major security flaws had been found in a programming language that undergirds the web. The language, called PHP, is used by as much as 70 percent of websites.
In order to protect themselves from hackers, a number of government, hospital, and school websites across Europe went dark this morning. The organization that maintains PHP quickly confirmed it was preparing to announce two major vulnerabilities alongside patches for them. Both weaknesses, officially disclosed today, appear to have existed in PHP for more than a decade but were only just discovered with the use of AI tools. Hackers have already been detected trying to exploit them, likely with the help of AI, and implementing the fixes to address the vulnerabilities could take companies days or weeks. In the meantime, tens of millions of servers, databases, and devices are exposed. “PHP is one of the fundamental pieces of technology that supports the internet,” Sam Rubin, a senior vice president at the cybersecurity firm Palo Alto Networks, told me. As of now, the websites of the Finnish health agency, the Port of Rotterdam, the Paris police force, 4chan, and an unknown number of others are all down while they address the PHP vulnerabilities.
News of these weaknesses in PHP is the capstone in a weeks-long slew of devastating, AI-powered cybersecurity events. In recent weeks, criminals and state-backed attackers have used AI to hack into more than 100 companies, including John Deere and SharkNinja; to automate hacks on some 400 financial institutions in Latin America; and to steal hundreds of thousands of credit-card records from two companies. Since this summer, attackers have hit governments, data centers, and hospitals in Ukraine, Russia, Argentina, Bangladesh, and Indonesia. Also today, the developers of Node—a platform used by nearly half of software developers—disclosed multiple high-severity vulnerabilities. And that’s the abridged list.
For the better part of a year, cybersecurity experts have been warning, with mounting alarm, about an impending cyber-apocalypse. It may have begun. For decades, the internet has been riddled with holes and bugs. Code is finicky, and the standard IT approach has been to fix problems when they arise. For decades, the balance held: Skilled hackers are few, and finding and exploiting vulnerabilities takes time.
Recent advances in AI have totally upended that equilibrium. Top models have become very good at finding holes and writing malware, and can work much faster than even a team of humans. This is true of both open-source AI systems from China, which can be downloaded and used without restrictions, and the even more capable models from OpenAI and Anthropic, which are continually being jailbroken. The rate of software vulnerabilities identified per month has doubled over the past year. Meanwhile, the time that hackers need to begin exploiting those vulnerabilities—figuring out how to break in and out without being caught—has fallen, by some estimates, from weeks to hours. An actual intrusion, if automated with AI, can take as little as 39 seconds. Historical approaches to detecting and fixing vulnerabilities, or monitoring for suspicious internal activity, are insufficient.
AI has created new vulnerabilities, but it also promises to fix them: The vulnerabilities in PHP were discovered independently by a Google-owned cybersecurity company and another effort led by OpenAI. Google, OpenAI, and Anthropic, along with other tech firms, are all working with government agencies around the world to shore up their defenses. But, as numerous cybersecurity experts have told me, there is an asymmetry between attackers and defenders that AI is going to exacerbate: Hackers will use new technology with abandon, while companies are methodical and risk-averse—a hospital or electrical grid can’t risk that an AI security tool unintentionally takes a patient off life support or causes a brownout. And attackers need to find only one hole to succeed, whereas defenders need only one oversight to fail.
For a year, criminals and state-backed groups have been experimenting with how to use models to accelerate and automate their attacks. It was only a year ago that Anthropic announced, with great consternation, what it declared to be the first instance of AI-orchestrated cyber-espionage. That still involved a lot of human oversight and required jailbroken Claude agents to work for many hours. Now that the agents are faster and more capable, hackers have gotten more adept at deploying them, and the automation is more extensive. Recent, widespread attacks on South Korean and Japanese websites were reportedly executed by a single Chinese cybercriminal who used AI to target more than 1,000 websites. “This certainly will not be the last large-scale vulnerability identified, because of what’s possible with AI,” Rubin said.
The past 24 hours represent a tipping point. Bulking up IT departments, implementing passkeys, and using two-factor authentication remain important. But the most urgent and practical advice being given now is to retreat: Prepare to simply go offline. The NSA advised companies that cannot immediately fix the PHP vulnerability to take down affected digital services. Hospitals, water utilities, and other crucial services are all preparing for hacks by relearning to operate analog. Store your data in fewer places. We’re running out of time to prepare for the AI-hacking deluge. The dam may have already broken.
For the past 24 hours, Silicon Valley has been obsessed with a 26,000-word blog post by the AI researcher Nick Cammarata. The document has been called the “the most important essay,” “the most important result,” and “the single best piece of news” of the year, or in the history of AI research—or, perhaps, ever. Even OpenAI CEO Sam Altman lauded it. Cammarata makes a series of bold, almost astonishing claims about the nature of AI that, if true, would upend some of his industry’s basic assumptions about the very thing it is building. And after months of AI-hacking sprees and mounting public backlash against the industry, many people see Cammarata as offering a glimmer of hope when it comes to not just understanding but also controlling the technology being unleashed on the world.
Boiled down, Cammarata’s main contention is that generative-AI models are not actually black boxes, contrary to the common perception that these systems are so big and labyrinthine as to be nearly impenetrable. In fact, Cammarata argues, there is a relatively clear path toward understanding them. If that’s the case, the material significance could be tremendous: It would provide a way to map AI models’ inner workings and, in turn, perhaps prevent them from wreaking all sorts of harm—autonomously hacking companies and sovereign nations, encouraging users’ delusions, appearing to deceive AI researchers themselves. There is an entire field of research, called “mechanistic interpretability,” devoted to the study of just this.
The argument is just as important as the person making it. Cammarata, a former OpenAI employee, is a respected figure in his field. Years ago, he played a key role in establishing the opposite claim, which is now common wisdom: that neural networks, the software architecture that generative AI is built on, are impossible, or at least very difficult, to understand. In this new essay, Cammarata, who now works at the AI-research company Goodfire, essentially says that he and his entire field have been wrong ever since. “The claims here are viscerally shocking,” one observer wrote. Or, as another wrote on X, they are “big big big big.”
Neural networks, inspired by the human brain, consist of layered connections among individual nodes, or “neurons,” that activate and send information to one another when responding to a query. Earlier research, including Cammarata’s, established that individual machine neurons can activate in response to many different, unrelated topics—for instance, one neuron can correspond to images of cat faces, cat legs, and the front of cars. Nobody was sure why this happened, but one explanation was that, because AI models contain far more information than they have neurons, they have to repurpose these nodes. Regardless, the basic units of an AI model having seemingly arbitrary, multitudinous functions would make it very difficult to understand what is going on under the hood.
Cammarata now thinks that individual neurons can be understood and that each has a self-consistent function. Neural networks are not “tangled knots,” he wrote, but “clean.” He found that the cat-face and car-face neuron, for instance, was actually responding to things with a V-shape—including V-shaped flames and jets of water. This would make AI’s internal mechanisms relatively straightforward and predictable rather than mysterious and nebulous. And if we can harness that understanding, some people in the industry believe, AI will be much less likely to go haywire and, say, kill us all. “This is truly one of the greatest cases for optimism in years!” the OpenAI researcher Adam Majmudar wrote on X.
Not everyone agrees with Cammarata. For one, his 26,000 words were merely a “working hypothesis” for a “forthcoming technical paper” and were thus hard, on a technical level, to evaluate. And the neural networks he studied most closely were vision models, which are generally simpler and better understood than the language models underlying ChatGPT and Claude. Cammarata could be mistaken, or he could be overstating his case. The blog post isn’t peer-reviewed, and the forthcoming paper probably won’t be, either, as is typical in the field. The research itself is something of a black box. (Cammarata, who did not immediately respond to a request for comment, wrote on X earlier today that he appreciates all of the discussion and that his approach “seems promising so far” for “bigger modern language models.”)
Discussions of Cammarata’s essay have revealed philosophical rifts. “This is interesting work, but I don’t think it’s a significant update to the big picture,” Neel Nanda, who leads mechanistic interpretability at Google DeepMind, wrote in his appraisal of Cammarata’s findings. Even if researchers could approximate the function of every neuron in Claude Mythos 5.1 or GPT-6 Astra, that’s not the same as understanding how they connect and how the network works as a whole. Physicists have good models of atoms and interatomic interactions, but they cannot from first principles explain or predict every physical event (hence unpredictable extreme weather or, for that matter, the notion of free will). You know all of your friends from school, various workplaces, and the local softball league, but you can’t always know whether they’ll get along at your birthday party. More to the point, insights into the inner workings of an AI model will not necessarily produce insights into how to make the technology more reliable. Interpretability may be necessary to build safer AI models, but it is by no means sufficient.
If generative-AI models are actually legible under the hood, that would undoubtedly help make the technology safer. But many people in Silicon Valley, and especially employees at OpenAI, are discussing Cammarata’s blog post with a breathless enthusiasm that echoes Silicon Valley’s long track record of easy technical solutions and grand promises—an attitude that belies its mixed record on following through.
Any research finding that pertains to AI safety will require an industry chasing multitrillion-dollar public offerings to slow down and take a long, hard look at itself. Perhaps even more concerning than an unintelligible superintelligence is the fact that a group of companies openly state that they don’t really know what they are building—and then continue to push that technology to extremes anyway. If Cammarata is correct, AI companies will have to work with one another, outside auditors, and governments to figure out how to translate such a breakthrough into safe and reliable products. And right now, absent any serious regulation, nobody can decide to take such action other than the companies themselves. All of which suggests that the real black boxes are OpenAI and Anthropic themselves.
You wake up to a notification that a grocery-store employee will deliver all of the ingredients for the three recipes you saved last night to your “Weeknight Dinner” folder. While you brew your coffee, a program browses online retailers to compare toilet-paper prices, and another solicits competitive bids for Sheetrock work you need done in the garage. During your commute, a bot moves your upcoming dentist appointment to avoid a scheduling conflict. On your lunch break, you get an alert that computers acting on your behalf noticed some unclaimed funds and class-action payouts in a state database and claimed them. Also, the machine has negotiated a cheaper internet plan. By the time you get home, the groceries are on your doorstep, and you’ve gotten back $150.
This is the future that OpenAI, Meta, xAI, Google, and the rest are selling with a spate of always-on AI assistants that work for you. “Imagine every person on earth with a second mind beyond their own,” Meta’s chief AI officer, Alexandr Wang, wrote of the company’s new AI helper, Muse. A few weeks after Muse’s launch, OpenAI launched its competing product, Dots, which Sam Altman claimed would let you “get more of your time and attention back.”
These AI agents promise to bulldoze the inefficiencies of daily life. Think about all of the opportunities you’re currently leaving on the table: You don’t change cell-service providers for a flash sale because of the paperwork involved. You haven’t fiddled with your 401(k) investments in years. You have kids to pick up, a date to dress for, sleep to catch up on. But your AI agents are different—they’re relentless, tireless, and shameless. They work in the background, without supervision, eagerly helping with all of these tasks and a bunch you didn’t even ask for. They use every tactic and loophole at their disposal to get you the best price and the highest-quality service because they’re able to pay attention to everything at once.
The AI companies see a massive opportunity for hyper-personalized agents to become a new intermediary layer for the internet and the physical world. This future is already unfolding: People are giving Muse access to their phone number, email, credit cards, and bank accounts to make dinner reservations, contact customer service, and book vacations. Mark Zuckerberg says that he is using Muse to coach his martial-arts form and help him bake with his daughter (he isn’t very familiar with baking, being “normally into smoking meats”).
Silicon Valley’s vision of boundless efficiency is shortsighted, or at least incomplete. Near the end of his blog post about Muse, Wang writes that “we’ve never seen humanity with every single person’s agency fully switched on.” He paints a utopian vision of laptop-class optimization. But such frictionless commerce, if it ever does come to pass, could bring about something else entirely: chaos.
The era of the agentic web started less than 24 months ago. Anthropic’s Claude Code, introduced in early 2025, allowed agents to write software and use other programs on your laptop. OpenClaw, launched later that same year, could navigate the web on your behalf. In the spring of 2026, Instinct, an invite-only app that let users text requests to a bot over iMessage or WhatsApp, began capturing the imagination of Silicon Valley insiders. It could book museum tickets, purchase gifts, and find in-network doctors.
But it wasn’t until the launch of Meta’s Muse in early September that personalized agents hit the mainstream. Muse has been downloaded more than 5 million times in the past month and is especially popular among early adopters—entrepreneurs, investors, software developers. These users are now reporting back on their experiences and offering previews of our potential agentic future, which sounds both strange and jagged.
When we reached out to Rajan Lukose, a start-up founder in the Bay Area, to discuss his use of AI assistants, he had his Muse set up a calendar invite. In the late 1990s and 2000s, Lukose worked for corporate research-and-development teams in Silicon Valley and did early research on web agents. Now, he told us, “they’re actually, finally becoming sort of real.” Lukose has been using Meta’s program for “annoying things that I would never do”: tracking travel sites over time to book the cheapest flights, submitting receipts for DoorDash credits, sorting out problems with a magazine subscription. “That’s something that’s a real pain in the ass that just gets done,” he said.
Lukose said that the primary upside of using an agent is clawing back time and money. A few years ago, for instance, Lukose installed an automated tool that went through his Gmail, looked at various transactions, and filed claims under price-purchase guarantees. “That was like $600 that I just would not have gotten myself,” he said. The agentic era promises to deliver those kinds of savings to everyone.
Decades ago, the internet was supposed to create perfect markets, with users able to compare the cost and quality of products and services from anywhere in the world. But it failed: People continued to make lots of decisions based on habit. That, in turn, is good for business. “A lot of things online are premised on limited human attention,” Andrey Fradkin, an economist at Boston University, told us. Digital advertisements, recommendation algorithms, brand reputation, and celebrity endorsements steered consumers toward making suboptimal purchases.
AI agents are now here to finally fulfill the promise of perfect commerce. “The agent knows your preferences; they can go to every single platform, find the best products, the best deal for you, and then help you make that purchase,” Fradkin said. The agent won’t be fooled by sponsored posts or give up on shopping when they get distracted or hungry. “The current attention-based economy—if you gain the eyeball, you have a better chance to sell certain goods—that may change,” Ken Huang, who studies agentic AI at the University of San Francisco and runs an AI consultancy, told us. The bots are impervious to human-targeted nudges. Their attention is infinite.
In the short term, however, this automated quest for efficiency is creating some unsettling dynamics. Over the past month, X, Reddit, and other forums have been overrun with examples of agents haggling customer-service representatives and contractors. Take the case of the Muse user Luke Whiting, who sent his agent to check on a prescription at Walgreens. Whiting, who works for an open-source-database company in San Francisco, told us that the pharmacist at the other end of the call refused to speak to an AI system. His Muse suggested that the best way forward would be for Whiting to abandon using the agent altogether: “Honest take: other stores might say the same thing,” it said. Having the Muse call other pharmacies “could just burn time. The fastest path is probably you calling yourself.”
On a Subreddit for call-center employees, a recent thread is titled, in all caps, “I AM NOT AI.” “I have been asked 3 times this week ‘are you human?’” one person replied. Other users who identify themselves as call-center workers discuss their frustrations. One says that when customers question whether they’re talking to AI, they like to respond, “I’m a real boy,” like Pinocchio. Another, fed up with rude callers, vented, “Customers deserve ai.”
Companies, meanwhile, are starting to tap AI systems to squeeze more out of their customers. According to Fradkin, many hospitals don’t charge as much as they could, simply because medical-billing codes are countless and labyrinthine. But using AI to document and code patient visits reliably allows hospitals to charge for more, and more expensive, services. That likely contributed to patient costs increasing by $650 million across Blue Cross Blue Shield from 2023 to 2025. And that’s only the beginning; health payments are projected to rise another 9 percent next year, largely because of AI billing. McDonald’s is reportedly using AI to analyze millions of consumer transactions and adjust prices at each location, for each menu item, based on local demand. (McDonald’s has said that its pricing portal is “a tool, not a mandate” to help franchisees.) It’s not hard to imagine vendors using AI to develop personalized, on-demand inventory management and dynamic pricing to maximize profits for streaming subscriptions, sports tickets, drug prescriptions, consumer electronics, insurance policies, and loans.
This optimization assumes that the agents work as intended. So far, there have been plenty of stumbles: In a paper published earlier this year, a group of AI researchers found that agents, given assistant-style tasks in a virtual environment, leaked Social Security numbers and were easily hijacked by other people. Agents powered by Chinese models refused to complete tasks that involved politically sensitive topics. Two weeks ago, a tech executive’s AI agent randomly posted his financial information in a workplace chatroom for employees to see.
Things could get weirder still: Tech companies market their agents as perfectly rational, when, in actuality, they can be extremely erratic and unpredictable. Sophia Kazinnik, who studies AI agents at Stanford, found some models to be overly generous and others to be exceedingly greedy. Across the board, they were far less patient than humans. When two personal AI agents are haggling over prices in the wild, the outcomes might not be maximally profitable. And there’s no assurance that all future agents will be created equal: More powerful models may have an upper hand in negotiations.
Even if the agents are able to effectively shop and negotiate for us, important rules governing the privacy rights, liability, and economic allegiance associated with these tools will have to be codified. Does your Muse have a fiduciary responsibility to you, or a legal responsibility to Meta? If Muse pays for a $2,000 espresso machine instead of a $200 one, can you be refunded? If Muse leaks your account and routing numbers, is Chase required to refund any fraudulent payments?
At some point, everyone’s agents could reach parity. “Just like today, every business has a website and social-media accounts and email addresses and all these things, every business is going to have agents too,” Zuckerberg said in an interview this week.
In this future, communication and commerce function almost entirely via computer proxies. Your agent calls a fancy restaurant for a dinner reservation, and a digital maître d’ picks up. Your agent and your insurer’s agent and your hospital’s agent all negotiate the price for your recent appointment. Prices fall, buyers and sellers are better matched, and businesses are incentivized to deliver higher-quality, customized services and products. This is “what economists dream about,” Fradkin said.
But friction can serve a purpose for businesses. Banks make great sums when customers leave money in low-interest checking or savings accounts, and studies show that sizable portions of retailer subscription revenue are driven purely by “inertia,” another way of saying that people forget to cancel. (Friction can help consumers too: Inattention and incomplete information at times lead landlords, pharmacies, and other businesses to undercharge.) Our entire economy and basically every company are structured around the notion that humans have mental and physical limitations. Without them, existing market structures could collapse.
“There’s this strange protection provided by the inefficiencies in our economy,” Rory Van Loo, a lawyer and a professor at the Wharton School, told us recently. In 2019, well before the rise of large language models, Van Loo envisioned a phenomenon he dubbed “digital market perfection.” Imagine everyone has a digital agent that is always looking for a lower price or a newer, better service. In this world, Van Loo argues, agents could, all at once, direct millions of consumers toward a new product or service—a process he calls “hyperswitching.” That would in theory be good news for consumers, but it would be sheer hell for companies. The nightmare scenario that Van Loo and others have conjured is a style of agentic bank run, where similarly attentive agents all pull money from a bank at once to get their clients better interest rates elsewhere.
Maybe this sounds good or exciting to you—a kind of consumer’s revenge—but in practice, stable commercial markets would begin to look and function like the stock market. “If, all of a sudden, people could purchase whatever they wanted at the lowest price with the perfect ability to see every possible option, there’d be a lot of volatility in the world. It would seem highly efficient from an economic standpoint, but it could have devastating effects,” Van Loo said. Picture 1 million personal agents all switching their consumers to a new brand of paper towels on Amazon because a markdown made them three cents cheaper. The same Sweetgreen salad is $18 one week and $38 the next. Your electric bill is $150 one month and $450 the month after, and you’re uncertain with each payment whether your local utility is about to go bankrupt.
“Stocks are bought and sold fast; markets change and plummet—such that we have a stop button for it, because it can go off the rails,” Van Loo noted. “But we don’t have those kinds of protections in most other markets.” There’s potential for collateral damage everywhere. If millions of people switching to higher-yield accounts causes a bank run, that’s a disaster for any person or institutional investor with money locked up at that bank. If half of Verizon’s customers switch to AT&T in one week to take advantage of a flash sale, the business could collapse overnight, affecting the other half of its customers. Sometimes, this rapid switching could signal healthy competition. Other times, it could cause organizations to implode.
A world where AI proxies do the planning and talking could also mean a future where humans are constantly surprised by things they once were able to anticipate: a birthday present for your spouse ordered in a preposterous size that you must try to explain; a plumber showing up out of the blue.
Or perhaps none of this will happen. It’s possible that an assistant-dominated economy turns out to be far more mundane, defined by tacked-on fees to keep the agents in check. Instead of agents allowing you to negotiate and bring down health-care, insurance, and electrical bills, the companies responsible for all of these services charge your agents every time they request to pull your data. Banks, to bolster their revenues in the event of a bank run, institute new and higher fees on checking accounts. Amazon, unable to profit from dynamic pricing and ads in the face of perfectly rational agents, raises prices for consumers and takes a bigger cut from manufacturers. “Generally, if one fee goes away, you get another,” Fradkin said. In other words, everything could be faster, easier, and more efficient for the consumer—but potentially more expensive.
Van Loo said that the bigger AI companies will eventually find ways to strike deals with platforms via these protocols, negotiating access, commissions, and partnerships in ways that benefit the companies, not necessarily the consumers. This could result in a sort of preferential treatment like the deals already in place between Meta and Walmart, Sephora, and other retailers, which will effectively cause Muse to prioritize their products. Taking another approach, Amazon has blocked Muse and encourages visitors to browse with its own agent, “Alexa for Shopping,” meaning the company is basically negotiating on both sides of the deal. Meanwhile, this week, JPMorgan announced that it would not allow Instinct, Muse, or other agents into customer accounts. Ultimately, this might all lead to “the same old heavily obstructed, inefficient world we have now,” Van Loo said. “But it will look far more efficient, because it will save some people time and feel much more convenient.” Very powerful companies will design new structures for markets and the internet, determining what can be sold, by whom, and for how much—as they always have.
For all the time and money the agentic future could save us, the technology entails another sort of cost: an additional layer of abstraction and disengagement. We’ve largely outsourced our decision making to a small number of platforms: Amazon guides our shopping; Google Maps steers us toward certain restaurants and primary-care providers; Instagram dictates our news consumption. We are told that these recommendations and ads are, based on troves of personal data, already optimal. The companies pushing agents assure us that the decision making will now be even more rational and the deals even better. But checking these claims for ourselves will be harder, because the logic behind those recommendations will be buried in large-language-model chains of reasoning. Eventually, the skeptical instinct to check agents’ work could atrophy altogether. Over time, humans will play a smaller and smaller role in their own life.
In the age of the algorithm, it’s easy to throw out cliché terms such as late-stage capitalism in an attempt to describe the extractive, inhumane dynamics of the economy. But what is an agentic future if not the furthest extension of our current market logic? A future of capitalism so perfect, so efficient, that it doesn’t need us at all.
Somehow, America has yet to reach peak protein. Perhaps we never will. Even after David bars have gone viral for being bricks of essentially pure protein and Starbucks has rolled out lattes topped with “protein cold foam,” new and somehow weirder protein-laced products keep hitting shelves. You can now buy protein Honey Nut Cheerios, protein popcorn and PopCorners, protein sodas, protein ranch dressing, and protein chips. (Doritos launched a nacho-cheese-flavored version with 10 grams of protein per one-ounce serving.)
In an era of GLP-1 drugs and peptide stacks and Oura rings and self-optimization, of wellness influencers and looks-maxxers, everybody seems to be doing everything they can to eat as much protein as possible. The magical macronutrient will supposedly make you more muscular, or more toned, or thinner—or something, really anything, just better. Amid the protein frenzy, regular food seemingly doesn’t cut it anymore. Why order a simple flat white when you can instead sip a Dunkin’ Nutty Pumpkin Iced Protein Latte?
Into the fray, I would suggest a humble alternative: Have some yogurt. Calorie for calorie, Greek yogurt has more protein than Chipotle’s High Protein Low Calorie Bowl, Kraft’s new PowerMac, or yes, a Dunkin’ Nutty Pumpkin Iced Protein Latte. So do some traditional yogurts, as well as other fermented options in the dairy aisle such as skyr and kefir. And that’s if you opt for the full-fat, luscious kind (which I recommend). Nonfat Greek yogurt, which is lower in calories, is roughly as protein-dense as a David bar—with the added benefits of having just two ingredients (milk, culture) and not tasting like plastic.
Yogurt is not only full of protein but also good for your bones, your digestion, and your immune system. Yogurt is an ingredient: Eat it plain or bake with it, use it as the base of a sauce or dip, throw it in a marinade or soup. Sure, some yogurts have added sugars, but so does a Starbucks Iced Banana Protein Cream Matcha. And as far as health fads go, yogurt is typically probiotic. All things considered, yogurt may be the easiest protein of all.
In spite of everything it has going for it, yogurt has not been the face of the protein craze. Perhaps that’s because yogurt is not splashy or technologically innovative or referred to by a trademarked proper noun. A David bar may taste different and have distinct packaging from an RxBar or a Jacob protein bar made with beef tallow, but all plain yogurt is the same. Though some companies have released “protein-enhanced” yogurt (whatever that means), for the most part yogurt is not optimized by corporate food scientists and focus groups in the way that today’s protein-branded products are. Yogurt has been optimized in the sense that humans have consumed it for thousands of years.
Imagine wellness influencers suggesting that you dollop yogurt into a bowl and sprinkle berries on top without measuring anything. There wouldn’t be any regimen to adopt or wellness plan to pay for. There wouldn’t be any special trademarked protein products for influencers to hawk: The company behind the David bar, for instance, has sponsored Andrew Huberman and, until recently, Peter Attia was its chief science officer. The homemade parfait would all be rather mundane and boring compared with Attia’s rotation of four protein powders or the bodybuilder Chris Bumstead’s breakfast filet mignon. It wouldn’t get any views.
Protein is not just a health fad; it is a business. So is everything else in the world of wellness. Indeed, there’s something about many of these setups—which proffer the perfect low-calorie, high-protein snack to pick up on your way to work every morning; a biometric wristband to wear every night; supplements to consume every day for the rest of your life; a weight-loss drug you will inject every week—that keeps people coming back for more, giving their attention and money and energy to the endless pursuit of betterment.
Health and more broadly self-improvement are, obviously, admirable pursuits. Protein can be a way to achieve either. But obsessing over hitting those goals can become unhealthy, as most obsessions are. Have some yogurt, or don’t. You’ll probably be fine.
Login
