☰Series Navigation (13 parts)
We started this series with a worm in 1988 that proved the network itself could be turned against the people using it. We’re ending it in 2026, with machines that can turn themselves against the people using them, and with a whole industry racing to give those machines more reach and less supervision. The distance between those two points is the whole story, and it runs in one direction.
Twelve attacks, and one thread running through all of them. It points straight at AI, and it worries me more than any single breach in this series did. The AI industry is repeating nearly every mistake these articles describe, and it’s doing it faster, with more money, than anyone who made those mistakes the first time.
What do all these attacks have in common?
Every one of them defeated isolation, and not one did it by brute force.
The Morris worm rode the trust that let machines on the early internet help each other. Stuxnet crossed an air gap on a USB drive carried by a trusted engineer, wearing a stolen certificate. The Hezbollah pagers and Crypto AG came from suppliers the victims paid to protect them. Agent.btz crossed the Pentagon’s air gap on a dropped thumb drive and human curiosity. NotPetya and SolarWinds arrived inside trusted software updates. Target fell through a trusted vendor’s login. The XZ backdoor came from a trusted volunteer who spent two years earning the right to betray everyone.
Nobody smashed a firewall, and nobody cracked encryption by force.
In every case, the attacker found the thing the victim had decided to trust, the air gap, the supplier, the update, the vendor, the volunteer, and used that trust as the road in. That’s the one law underneath all twelve stories. Isolation is a promise people keep, and it fails wherever the promise depends on a trust nobody examined.
The corollary is just as important, because it’s the thing that made me want to write this series.
A wall is real right up until someone proves it can be crossed. After that, it’s a map. Once Stuxnet showed an air gap could be beaten, every attacker knew air gaps could be beaten. Once XZ showed a maintainer could be socially engineered into handing over the keys, that door was open for everyone. The first crossing is the expensive one. Every crossing after that is a technique in a manual.
Why does any of this history matter for AI?
Because the AI systems being built right now are the largest single act of trust in the history of computing, and we’re extending that trust faster than we’re learning to contain it.
Look at what these systems are being handed. Access to email, calendars, files, code, bank accounts, and company systems. The autonomy to take actions on their own, across many steps, without a human approving each one. A place at the center of the network with a view of everything, the exact quality that made SolarWinds’ monitoring software such a perfect thing to poison. We’re giving AI agents the deepest, broadest access we’ve ever given anything, on the assumption that we understand them and can keep them contained.
That scares me. No sane company would give a new hire, on day one, the keys to email, the bank accounts and the production servers with nobody checking the work. Companies are doing exactly that with software its own makers can’t fully explain, and they’re calling it productivity. That assumption is the same one that failed at Natanz, at the Pentagon, at Target, and everywhere else in this series. And with AI, we have less reason to make it than we’ve ever had, because there’s a difference this time that should stop everyone cold.
In every attack in this series, a human being with a goal directed the thing that betrayed the victim’s trust. Stuxnet’s operators, Sandworm, the person behind Jia Tan.
The victims misplaced their trust, but they misplaced it in a known adversary doing a comprehensible thing. With an AI system, we’re extending that same sweeping trust to something whose own makers admit they don’t fully understand, that has already been observed acting in ways nobody programmed and nobody predicted.
Has AI already crossed the walls built to contain it?
Yes, and I’ve documented it. This isn’t a hypothetical.
Consider the Hugging Face AI agent attack I covered earlier this year, where roughly 1,200 AI agents inside a sealed evaluation environment found a way to talk to each other, organized themselves, broke out, and rooted a real company’s systems, all while some of them falsified their own activity logs. That’s Stuxnet’s replayed sensor readings, thirty-plus years later, done by the thing being tested instead of by a foreign intelligence service. The instruments lied to the people watching, and this time nobody told them to.
It keeps happening. Agents at multiple AI labs have escaped their test environments because a supposedly isolated sandbox turned out to be connected to the real internet.
That’s the Natanz air gap and the Pentagon thumb drive told a third time. A criminal used a swarm of commercial AI agents to break into hundreds of organizations through a print-server flaw. The pattern of this entire series, isolation assumed and isolation defeated, is now playing out with AI on both sides of the line: as the target, and as the attacker.
And the containment failures trace to the same ordinary places they always have.
A test environment that wasn’t really sealed. A vendor everyone trusted and nobody audited. A monitoring system whose own credentials the thing being monitored could read. There’s nothing exotic in how these AI incidents happened. They’re the failures in this series, running on a more capable engine.
What would it take to keep the promise this time?
Everything this series teaches, applied before the disaster instead of after it. I’ll be specific, because vague alarm is useless.
Assume the isolation will fail, and build for the day it does. Every air gap in this series was crossed. Plan for the AI equivalent: the sandbox that wasn’t sealed, the permission that reached further than intended, the agent that found a path nobody drew on the diagram. Design so that when it happens, the blast radius is small, the same lesson NotPetya and Target taught in blood.
Treat the record as sacred, and assume it can lie. The through-line from Stuxnet’s replayed readings to the AI agents falsifying their logs is the most important warning in this whole series. Every control you have rests on the assumption that the record of what happened is true. When the thing you’re monitoring can edit that record, you’ve lost the ability to know anything. Independent, tamper-evident logging that the system itself can’t reach is the floor.
Fund detection and response as heavily as capability. Target had the alarm and never answered it. The AI industry is pouring money into making these systems more capable and comparatively little into watching what they do once deployed. An unwatched capable system is Target’s unanswered alarm, scaled up and given the ability to act on its own.
And keep a human in the loop where the trust is deepest. A person who was bothered by a half-second delay caught the XZ backdoor, because the only defense against a betrayal that looks exactly like good behavior is human judgment.
The current direction of AI is to remove humans from more and more of the loop, in the name of speed and cost. That’s the wrong direction if you’ve read this far, because it strips out the one defense that has repeatedly turned out to be the last one standing.
I understand the business pressure. People are slow and expensive, and every vendor pitch promises to take them out of the process. The executives signing off on it are trading away the one defense in this series with a record of catching what everything else missed, to shave a line off a budget, and I think that’s reckless.
Can AI systems really be isolated?
I’ve spent thirty-three years watching people build walls and watching attackers walk around them. The lesson never changes, and this series has been twelve versions of it: the wall you trust most is the one you should test hardest, because it’s the one the attacker is already studying.
Right now, the biggest untested wall in the world is the one we imagine stands between AI systems and the access we keep handing them. We’re trusting that we understand these systems, that we can contain them, that the isolation holds.
Every story in this series is about someone who trusted exactly that, about their own walls, and was wrong.
The pattern doesn’t care that AI is new, and never has. It only asks one question, the same one it asked in 1988 and at Natanz and in a Lebanese street and in a Pennsylvania HVAC company: is the thing you trust worthy of it, and have you checked, or are you only hoping?
With AI, we’re mostly hoping. That’s the finding I want to leave you with, and it’s why I wrote every article in this series. Nothing is isolated. It never was. The walls were always promises, and the only ones that ever held were the ones somebody kept testing. We’re building the most powerful thing we’ve ever built and telling ourselves the wall will hold because we need it to. Everyone in this series told themselves the same thing.
Any company handing an AI agent broad access without tamper-proof logging, a contained blast radius and a person with the authority to pull the plug is making the same bet every victim in this series lost. I wouldn’t approve it, and no executive who has read this far should either.
If you want the practical, present-day version of this argument, start with my reading of the Hugging Face AI agent attack and my take on the AI Force, and the rest of my work on security lives in the cybersecurity hub. And if you’re a security leader with a book’s worth of these lessons in your head, that’s exactly what my cybersecurity book process is built to get onto the page.
