“We have lived through a period where you have been able to assume that if you use a service, that your data is going to be safe. That assumption was never correct, it turns out. These systems were never safe. It's just that we lacked the number of skilled attackers to take advantage of the fundamental insecurity of these systems.”
Galaxy Brain · October 2026
Context
Asked whether a Japanese cloud provider's CEO was right that the internet could be close to collapse, Stamos called that hyperbole: the core infrastructure is holding up. His point is that AI-assisted bug hunting is exposing weaknesses that were always there.
Transcript
…but it is extremely hard. If you have a security emergency on a Friday evening and it's often on a Friday evening, unfortunately, that's how it often seems to work out. It is very hard to get professional incident responders on the phone because everybody is booked up pretty far out right now.
…been hacked. And in one report that I saw circulating, the CEO of GMO suggested that the internet as we know it could be on the verge of collapse due to this pressure. When we hear something like that, how are we supposed to evaluate that kind of claim? What is the state of the internet right now?
Okay, so to say the internet is going to collapse, I think is hyperbole. The fundamental infrastructure of the internet is holding up fine, right? Like the internet, the routers, the switches, there have been bugs in the fundamental systems that move traffic, but those have been fixed. I think what is happening, however, is we have lived through a period where you have been able to assume that if you use a service, that your data is going to be safe. That assumption was never correct, it turns out, right? These systems were never safe. It's just that we lacked the number of skilled attackers to take advantage of the fundamental insecurity of these systems. And what is happening now is the bugs are being found, sometimes by the bad guys, often by the good guys. But in the period in which it takes for the bugs to be fixed, the bad guys have an opportunity to take advantage of that period of time of that lag of fixing them. And then the bad guys, the skill sets, I don't know if you're like an English soccer football fan, but everybody gets this metaphor now because they watch Ted Lasso. But the English football…
There's a striking anecdote that I've seen floating around that the PHP vulnerability that affected 70% of websites on the internet was independently discovered by someone using a frontier model using the prompt, quote, find bad vulnerabilities in PHP. And I think that sort of speaks to that idea…
Yeah. So what's going to have to happen? So like you said, what's happening is you have these bugs that will be found by somebody with access to a preview version of a cyber model. We do this thing called coordinated disclosure, where sometimes if you have a really big bug like that, it used to be…
But let's talk about that. How long does something like that take? Rewriting the code of the internet?
More from Galaxy Brain
