What happens when AI becomes better at finding software vulnerabilities than the world is at fixing them? Here's my speculative scenario for a very unpleasant week on the internet, and ten things worth preparing before it arrives.
Apparently, intelligent people don't make public predictions about the future.
A sensible policy.
Unfortunately, I have never been particularly good at following sensible policies.
So here's one.
At some point in the next few years, we may experience what I've started calling the First Great Internet Wipe.
Not the literal disappearance of the internet.
No dramatic moment when every router on Earth simultaneously catches fire.
Something more interesting.
And considerably more inconvenient.
A large-scale security crisis in which substantial parts of the digital infrastructure we depend on become unavailable, isolated, restricted, or simply impossible to trust.
Banks.
Cloud services.
Identity systems.
Business applications.
Payment networks.
Software supply chains.
The internet would still exist.
But an uncomfortable number of things we normally do with it might stop working.
For the sake of argument, let's choose a date.
June 2027.
Why June?
No particular reason.
It's a useful imaginary deadline, not a forecast derived from a sophisticated mathematical model.
I don't know whether such an event will happen.
I certainly don't know when.
And there are perfectly reasonable arguments against the scenario.
But I think the underlying risk deserves more attention than it usually receives.
Because artificial intelligence is changing cybersecurity faster than most organisations are changing their defences.
And the consequences may extend considerably beyond stolen passwords and a few unfortunate companies.
The security problem nobody ordered
For decades, software security has operated under an uncomfortable assumption.
Our systems contain vulnerabilities.
We just don't know where all of them are.
Researchers find some.
Attackers find others.
Companies publish patches.
Administrators install them.
Sometimes.
Eventually.
Preferably before somebody has already stolen the customer database.
The system has never been perfect.
But the discovery and exploitation of sophisticated vulnerabilities required substantial expertise and time.
That constraint is changing.
AI models are becoming increasingly capable of inspecting code, identifying weaknesses, reasoning about exploitability and helping developers fix problems.
Excellent news for security teams.
Unfortunately, attackers can benefit from similar capabilities.
And when both sides accelerate, an organisation's ability to respond becomes extraordinarily important.
Google Threat Intelligence reported that monthly vulnerability disclosures roughly doubled between January and August 2026.
The analysis also found increased exploitation of previously disclosed vulnerabilities.
Not every new CVE represents a newly discovered catastrophic weakness, and changes in reporting practices contribute to the totals.
Still, the underlying direction is worth watching.
Meanwhile, Anthropic's Project Glasswing has given selected organisations access to advanced AI-assisted vulnerability research.
In June 2026, Anthropic reported that its partners had identified more than 10,000 high- or critical-severity security flaws.
OpenAI has developed Daybreak, a programme intended to bring advanced cybersecurity capabilities to qualified defenders and security providers.
These are encouraging defensive developments.
But they also tell us something uncomfortable.
The world is discovering how many weaknesses its software contains, and how quickly increasingly capable AI systems can find them.
Finding the weaknesses is only half the problem.
Fixing them across millions of machines, thousands of companies and countless interconnected services is another matter.
What a wipe might actually look like
My imagined Internet Wipe isn't necessarily one enormous attack.
It could be a cascade.
A widely used component is compromised.
Several large providers restrict access while investigating.
Some services disconnect from vulnerable partners.
Authentication systems become unreliable.
Payment processors introduce emergency controls.
Cloud providers isolate affected environments.
Companies temporarily suspend integrations because they no longer trust the systems on the other side.
Ordinary users discover that their money, documents and accounts technically still exist but are difficult to access.
The infrastructure hasn't disappeared.
The relationships between its components have become unreliable.
And that may be enough to cause significant disruption.
Think about how much modern life depends on interconnected services.
Your bank depends on authentication providers.
Your employer depends on cloud infrastructure.
Your online shop depends on payments, logistics, identity and customer-management systems.
Your delivery service depends on mapping, communications and payment processing.
Your favourite app may depend on a dozen other companies you've never heard of.
A problem in one important layer can travel surprisingly far.
Of course, the internet was designed with considerable redundancy, and many systems can isolate failures or continue operating independently.
A genuinely global collapse would be extremely difficult to predict and might be much less likely than a collection of severe regional or sector-specific incidents.
But that doesn't make preparation pointless.
Quite the opposite.
Most of the precautions I'd take for my imaginary worldwide disaster would also help during a perfectly ordinary ransomware incident, bank outage or lost online account.
Which brings me to the practical part.
1. Your crypto wallet shouldn't depend entirely on somebody else's servers
Let's begin with cryptocurrency.
If I were holding a substantial amount of crypto for the long term, I'd think carefully about custody.
Leaving everything on an exchange means relying on that exchange's security, operations, governance and ability to honour withdrawals.
If the exchange becomes unavailable, those dependencies suddenly matter.
Self-custody using a reputable hardware wallet can reduce certain risks by keeping the private keys outside an internet-connected service.
But let's not pretend a hardware wallet is a magical protective amulet.
You become responsible for the recovery phrase.
Lose it without another recovery mechanism, and you may lose access to your assets.
Expose it to somebody else, and your wallet can be emptied.
Approve a malicious transaction, and the hardware wallet may not save you from the consequences.
So the actual recommendation isn't simply buy a device.
It's to understand the custody model, protect recovery information, practise recovery safely and avoid concentrating all your risk in one place.
And remember that access to keys doesn't guarantee immediate access to a functioning blockchain network or exchange during a major disruption.
The objective is resilience.
Not replacing one poorly understood dependency with another.
2. Waiting for the hardware bubble to burst may not be a brilliant strategy
There's a popular belief that once the current AI infrastructure boom slows down, hardware will become wonderfully cheap.
GPUs.
Servers.
Storage.
Everything.
Perhaps.
But I wouldn't build an important plan around that assumption.
Demand for computing equipment isn't driven exclusively by the current generation of AI data centres.
Companies are still discovering which processes they can automate.
Agentic workloads are expanding.
Infrastructure is still being built.
And more capable models may encourage entirely new kinds of applications.
Of course, none of this proves that hardware prices must rise indefinitely.
Technology prices can fall.
Overcapacity can emerge.
Demand can disappoint.
But a major security incident could also temporarily disrupt manufacturing, supply chains, payments and distribution.
Which is hardly the ideal moment to discover that you urgently need a backup computer or storage device.
So if a piece of equipment is genuinely necessary for my work, I wouldn't necessarily postpone buying it in the hope of a spectacular post-bubble discount.
I'd buy what I need.
Maintain sensible spares.
And avoid panic-buying expensive hardware simply because somebody on the internet has predicted Armageddon.
A working external backup drive may provide considerably more practical resilience than another GPU.
Less glamorous.
Much cheaper.
And rather useful.
3. Your data provider matters. But size alone isn't security.
This is where the issue becomes more complicated.
If sophisticated AI systems are discovering serious software weaknesses, then the security capabilities of the organisations holding our data become increasingly important.
I would pay close attention to providers that have mature security teams, rapid patching processes, strong authentication, independent audits and credible incident-response capabilities.
Access to frontier AI security tools may become a significant advantage.
This is one reason programmes such as OpenAI Daybreak and Anthropic Glasswing interest me.
They may help defenders discover vulnerabilities that were previously too difficult or expensive to find.
But I wouldn't conclude that only companies partnered with American or Chinese AI laboratories can be trusted.
A large technology company can suffer a serious breach.
A smaller specialist provider can have excellent security practices.
And the company with the most impressive cybersecurity marketing isn't necessarily the one with the smallest attack surface.
For systems with extensive access to my personal information, especially always-on AI agents, I'd be particularly selective.
An agent that can read messages, access documents, interact with accounts and perform actions has a much larger responsibility than a simple note-taking application.
I would want granular permissions.
Clear data-handling terms.
Revocable access.
Audit logs where available.
And a reasonable explanation of what happens when the system is compromised.
The question isn't simply which AI model powers the product.
It's what the entire service can do with my information.
And whether I can contain the damage when something goes wrong.
4. Understand what your bank actually guarantees
Now let's discuss money.
Suppose a bank becomes inaccessible.
Or suffers a serious security incident.
Or its payment infrastructure stops working for several days.
What happens to your funds?
The answer depends on where you live, the type of account, the cause of the incident and the applicable law.
For example, the Netherlands has a deposit guarantee of up to €100,000 per person, per bank.
That's an important protection.
But it isn't universal insurance against every possible cyberattack.
Deposit guarantees primarily concern the failure of a bank.
Unauthorised transfers are a separate issue governed by payment-services rules, bank procedures and the circumstances of the transaction.
Investment products and cryptocurrencies generally aren't protected by ordinary deposit-guarantee schemes.
So I'd check the actual protections rather than assume that the words insured bank account answer every question.
Which bank holds the funds?
What guarantee scheme applies?
Are multiple brands legally part of the same bank?
What happens if the account becomes temporarily inaccessible?
How are fraudulent transactions disputed?
Where can I reach the bank if the mobile application stops working?
These questions are remarkably boring.
Until the day they become extremely interesting.
And a person with significant assets should probably understand the answers before a crisis.
5. Back up the internet you actually care about
Here's a surprisingly emotional one.
Old blogs.
Forums.
LiveJournal archives.
Comments.
Photographs.
Conversations from fifteen years ago.
Entire communities that existed before today's social platforms took over most of the internet.
A surprising amount of our personal history exists only on services we don't control.
And we often assume it'll remain available indefinitely.
It won't necessarily.
Even without a major cyber disaster, websites disappear.
Platforms change their policies.
Accounts are suspended.
Companies go bankrupt.
Old formats become inaccessible.
So if there's an online archive that matters to you, save it.
Posts.
Comments.
Images.
Dates.
Metadata.
Whatever can be lawfully exported.
An AI assistant may help organise the work, but I'd still verify that the backup is complete and readable.
And I'd keep at least one copy offline.
There's something rather tragic about preserving thousands of photographs in a cloud service and discovering, years later, that the only remaining copy was in an account you can no longer access.
Especially when the photographs are of people or places that no longer exist.
The internet has become our collective attic.
Perhaps we should occasionally take the family albums out of it.
6. Important documents shouldn't exist only behind a login screen
This follows naturally.
Property documents.
Insurance policies.
Tax records.
Contracts.
Medical information.
Identity-document copies where appropriate.
Receipts for major purchases.
Professional archives.
I like cloud storage.
It's convenient.
Searchable.
Available across devices.
And often considerably more reliable than a single laptop.
But cloud only is not the same thing as properly backed up.
For genuinely important documents, I'd keep encrypted local copies as well.
Preferably with another backup separated from the primary computer.
And I'd periodically check that the files can actually be opened.
There's no point celebrating your excellent backup strategy if the archive requires an online authentication service that no longer works.
Some records may also deserve a paper copy.
Not everything.
I'm not proposing turning an apartment into a municipal archive.
But the handful of documents you might urgently need during an outage should be accessible without a complicated chain of digital dependencies.
An offline copy of an important document may be completely unexciting.
Until it becomes the only copy you can open.
7. Keep some cash. Yes, actual physical money.
Here's a recommendation that sounds almost embarrassingly old-fashioned.
Cash.
Banknotes.
The little pieces of paper people used before we decided that every transaction needed three software companies and an internet connection.
Electronic payments are wonderful.
Until the terminals stop working.
Or the network is unavailable.
Or your banking app refuses to authenticate.
In May 2025, the Dutch central bank and other members of the National Forum on the Payment System recommended preparing for a 72-hour disruption of electronic payments.
Their suggested emergency cash amount was approximately €70 per adult and €30 per child, adjusted to expected needs.
That's a real preparedness recommendation.
Not a prediction of my imaginary Internet Wipe.
For a longer disruption, the appropriate reserve would depend on your circumstances, local advice and the practical risks of storing cash.
I wouldn't turn this into an excuse to withdraw my entire savings.
But having enough physical money for essential purchases during a short outage seems perfectly reasonable.
Particularly while travelling.
A digital account balance isn't very useful at the precise moment when nobody can access the payment network.
And sometimes the most technologically sophisticated solution to a technological failure is a twenty-euro note.
8. The scammers will arrive before the repair teams
Now for the truly predictable part.
Suppose there's a large banking or internet disruption.
People are worried.
Nobody knows exactly what's happening.
Customer-support lines are overwhelmed.
Official information is incomplete.
And then somebody calls.
Hello, this is your bank's emergency security department. We need to move your funds to a protected account immediately.
Of course they do.
Or perhaps it's a video call from a relative.
A familiar voice.
A familiar face.
They urgently need money.
And the normal way of contacting them isn't working.
AI-generated voice and video impersonation are already serious fraud concerns.
In a major crisis, confusion would make such attacks particularly dangerous.
I'd establish a simple family verification procedure now.
A private code word can help, although it shouldn't be the only safeguard.
More importantly, verify unusual requests through a separately established communication channel.
Use phone numbers you already know.
Don't trust a number supplied by the person making the request.
And don't transfer money simply because someone sounds exactly like a family member.
The unfortunate reality is that a familiar voice is becoming weaker evidence of identity.
The more convincing the impersonation technology becomes, the more valuable boring verification procedures will be.
And remember: your family should verify you, too.
You may consider yourself the most trustworthy person alive.
A scammer with a convincing synthetic voice may have a slightly different opinion.
9. Keep evidence of payments and major obligations
Here's a less obvious risk.
A sufficiently disruptive incident might create problems not only with making payments, but with confirming what happened before the systems went down.
Did the transfer complete?
Was the invoice paid?
Was the transaction recorded in the merchant's system?
Did the bank send the confirmation?
Did the counterparty receive the money?
In a well-designed financial system, transactions aren't normally held in one fragile database without any audit trail.
Banks and payment providers maintain records, reconciliation procedures and recovery mechanisms.
So I wouldn't assume that a cyberattack simply erases all legal evidence of financial obligations.
But temporary uncertainty is entirely plausible.
And temporary uncertainty can still be expensive.
So I'd preserve statements, transaction confirmations, important invoices and records of major purchases.
Not because a PDF receipt will magically override a bank's ledger.
But because independent evidence can help resolve disputes, identify errors and reconstruct events.
Property documents deserve particular care.
So do records of loans, major asset purchases and significant contractual obligations.
In a crisis, your legal rights may remain perfectly intact.
Exercising them could simply become slower and more complicated.
And there's a large practical difference between having a right and being able to demonstrate it quickly.
10. The internet that comes back may have stricter gates
Now we arrive at the most speculative part.
Suppose the incident is serious enough that multiple organisations lose confidence in their dependencies.
They may isolate affected systems.
Revoke compromised credentials.
Require security checks before restoring integrations.
Demand evidence that vulnerabilities have been fixed.
Rebuild trusted access between important services.
Some of this already happens in ordinary cybersecurity incident response.
But imagine it happening on a much larger scale.
What if, after the first major AI-accelerated security crisis, parts of the digital economy become much more selective about which systems they're willing to connect to?
The future internet might develop more demanding rules for machine identity, software provenance, verified updates and access to critical infrastructure.
I can imagine a world where an organisation isn't permitted to reconnect a compromised service to important partners until it demonstrates that the service has been secured.
Not because some mysterious global authority owns the internet.
But because other organisations refuse to accept the risk.
That would create a new form of economic inequality.
Not simply between companies with AI and companies without it.
Between organisations capable of maintaining demonstrably secure systems and those that can't.
This is where programmes such as Daybreak and Glasswing become interesting.
They represent efforts to give defenders access to increasingly capable AI-assisted security analysis.
But participation is not a universal certificate of safety.
Nor is there evidence of a future rule requiring every internet business to join these programmes.
The more defensible prediction is that continuous security verification may become a much more important condition of doing business.
Especially where software interacts with payments, identity, infrastructure and other high-consequence systems.
For a small organisation, that could become a serious competitive challenge.
And for security professionals, it suggests that the ability to find vulnerabilities matters less if you can't also demonstrate that you've fixed them.
Would a satellite connection save you?
There's one more preparation idea worth discussing.
Satellite internet.
A Starlink terminal, for example, can provide a useful backup when local terrestrial connectivity fails.
That's valuable.
And I understand the appeal of having one ready for an emergency.
But it isn't a magical connection to an independent universe.
The terminal still needs power.
The satellite network still relies on its own infrastructure.
And the online services you're trying to reach must still be functioning.
If your local fibre network fails, satellite access may be an excellent fallback.
If a bank has deliberately suspended its systems because of a serious compromise, satellite connectivity won't make that bank available again.
Redundancy is useful.
But it only helps when the redundant system doesn't share the same point of failure.
A lesson that applies to far more than internet connections.
The real preparation is reducing dependencies
Looking back at this rather cheerful prediction, I notice something.
Most of the recommendations aren't actually about a global internet catastrophe.
They're about ordinary resilience.
Don't concentrate valuable assets in one fragile arrangement.
Understand who holds your data and money.
Maintain offline copies of important information.
Have alternative ways to communicate and pay.
Verify unusual financial requests.
Keep records.
Know how to restore systems.
Reduce unnecessary dependencies.
And make sure that the systems you rely on can fail without taking everything else down with them.
All of these things would be useful even if my June 2027 scenario never happened.
Which is rather convenient.
Because I have absolutely no desire to be right about this.
The best outcome would be a world where AI makes cybersecurity dramatically better.
Where vulnerabilities are found and fixed before attackers can exploit them.
Where defensive automation improves faster than offensive capabilities.
And where increasingly sophisticated systems become more reliable rather than more fragile.
That's a perfectly plausible direction too.
The future isn't required to follow my disaster scenario.
But I think we'd be foolish to assume that an increasingly interconnected digital economy can absorb unlimited changes in offensive capability without experiencing serious disruptions.
Especially when so much depends on software whose weaknesses we are only beginning to understand.
I hope this prediction ages terribly
Perhaps June 2027 will arrive and nothing particularly interesting will happen.
The internet will work.
The banks will work.
Our cloud documents will open.
The payment terminals will beep.
And somebody will find this article and ask why I spent several thousand words worrying about an event that never occurred.
Excellent.
I'd be delighted.
I would much rather have an embarrassing old prediction than discover that I can't access my money, my work or my family photographs because I never bothered to prepare.
And perhaps that's the proper way to think about the First Great Internet Wipe.
Not as a prophecy.
Not as an excuse to panic.
Not as a reason to buy six computers, withdraw all your savings and move into a bunker.
But as a thought experiment.
What happens when the digital infrastructure we consider permanent turns out to be temporarily unavailable?
How much of our life remains accessible?
How many important things depend on one account, one company, one device or one authentication system?
And how quickly could we recover?
Those are useful questions regardless of the answers about June 2027.
I don't know whether the first Great Internet Wipe is coming.
But I'd rather discover that my backups were unnecessary than discover that they were imaginary.
Sources and further reading
This article presents a speculative scenario, not a prediction derived from a quantified risk model. The illustrative June 2027 date is arbitrary. Practical preparedness measures are discussed separately from unverified future scenarios.