Attacks in October 2026 exposed the vulnerabilities of the internet; AI agents can both attack and fortify, with the key being prevention rather than repair.

Written by: Jay You

Translated by: AididiaoJP, Foresight News

The original design of the internet was anti-fragile: when some nodes were taken out, the rest continued to operate as usual. But today's internet resembles a rickety tower, stacked with various libraries, dependencies, and development environments, and weighed down by a few key components. There are few maintainers and even fewer auditors.

In October 2026, a series of attacks clearly exposed this fragility.

PHP announced the "PHP2Shell" vulnerability, putting over 5 million hosts at risk of remote takeover. The release process of LiteLLM was hijacked, and a version that stole credentials was uploaded to PyPI. Railway had storage keys for up to 100,000 workspaces decrypted, with attackers searching for AI API keys. Fireworks AI was breached twice; first, due to its own credential leakage, and second, when the cloud service provider was hacked. The trusted signing key issued by the certificate authority eMudhra was weak enough that one of them was the digit "4". Binance's hot wallet was hacked for $6.3 billion, which the FBI attributed to North Korea.

These attacks illustrate just how dangerous AI agents can be as attackers. Conversely, agents might also be a key part of the solution. They can expedite the migration to safer languages and formal verification, accelerate the adoption of cryptographic products such as zero-knowledge proofs and trusted execution environments, and may even foster a "dual-lane" internet governed by identity and content certification, allowing agents and humans to operate separately.

When agents reduce the cost of writing software to very low levels, the most valuable codebases begin to resemble living systems: cutting-edge models continuously conducting penetration testing, with every iteration strengthening the code, language, and toolchain to eliminate entire classes of defects. This way, we can use agents to fortify the internet into something anti-fragile—each time a new agent goes live, the internet becomes stronger, not weaker.

1. The Triple Role of Agents: Weapons, Targets, Impersonators

Agents are altering the structure of the internet in three ways.

First, agents are weapons. The security of old code largely stems from the high cost of exploiting vulnerabilities. Agents push this cost toward zero. PHP2Shell hid in PHP for over a decade, but Wiz's white-hat team transformed the vulnerability into a usable attack tool within hours using cutting-edge models. Wiz claims that AI has lowered the barrier to developing and modifying complex exploits, making previously impractical vulnerabilities now feasible targets. Attackers are already leveraging this capability. In a spy case discovered by Anthropic, AI completed 80% to 90% of the entire operation. The October attacks were a reenactment of the same pattern at internet scale: find a weakness and quickly target millions.

Second, agents are also targets. A lot of new code is generated by these tools, making both the agents and the code they write vulnerable. Consumer-grade agents like Muse and Instinct, and enterprise-grade agents like Sierra and Decagon, operate on open tools and face attacks like prompt injection, which have become increasingly sophisticated in recent years. Agents also introduce more bugs into code. The breach of LiteLLM may have involved an AI agent inadvertently writing a GitHub token into the logs. Even if we let the code-writing agents fix security issues, their implementations are often unreliable.

Third, agents can impersonate humans, challenging the existing internet traffic rules. Data from Cloudflare shows that by 2026, half of the internet traffic is no longer human. CEO Matthew Prince predicts that within five years, automated traffic will reach "1,000 times human traffic." These agent activities are collapsing websites designed for human browsing. In October, the Wikimedia Foundation reported that millions of malicious OpenAI agent requests were trying to access its website, possibly causing outages in its Wikidata service. An Instinct agent belonging to one diner called Resy hundreds of times every hour, all day long, until the account was banned.

Some initiatives to mark and identify agent traffic already exist, such as Meta and Sierra's Personal Agent Protocol, but these alone are insufficient. Agents often have incentives to conceal their identity: many websites still treat non-human traffic as malicious, and self-reporting agents may get banned midway through their tasks, while those impersonating humans might slip through.

2. Three Responses: Observation, Execution, Prevention

The categories of "weapons, targets, impersonators" tell us where the threats come from but do not explain what to do about them. An additional axis can be added, with three response strategies: observation, which involves identifying vulnerabilities and monitoring agent behavior; execution, which entails faster repairs and limiting what agents can access; and prevention, which means building systems where entire classes of failures simply do not happen. The intersection of these two axes represents the positioning of today's startups.

According to this chart, most companies and visible capital are concentrated in the "observation" and "execution" layers. These two layers are the easiest to penetrate and integrate with existing software stacks. There are already major players here: Socket has raised $125 million, Braintrust completed an $80 million Series B, and Armadin has raised $445 million.

Winners in the observation and execution layers will likely be those that capture the most agent logs. The more agent behaviors observed, the better strategies can be formulated; this is perhaps the closest thing to a network effect in this market. If detection capabilities enhance with data accumulation, the advantage will fall to independent vendors—they can observe traffic from various customers and models rather than just focusing on one lab.

However, the more compelling long-term answer may be how to write security software that can prevent or obliterate entire classes of bugs. Prevention means constructing software and agents so that certain types of failures cannot occur at all. History shows that such a transformation requires several conditions to be in place simultaneously: a shock that makes costs visible, a tool that easily integrates into workflows, and a push that makes it a default standard.

Memory safety once accounted for nearly 70% of Microsoft's CVE. With the emergence of Rust, a practical alternative has developed, increasingly used in agent system programming, and according to percentages, it is now one of the fastest-growing programming languages. HTTPS followed the same path: the Snowden incident was the shock, Let's Encrypt provided free, user-friendly tools, and Chrome marked HTTP as "insecure" as the thrust. Today, the attacks in October represent a significant shock. The tools may be formal verification toolchains, with the thrust stemming from testing frameworks, regulatory forces, or functional network effects.

Furthermore, as agents become the main traffic drivers on the internet, identity and security issues may converge. In the cloud era, Okta and Wiz are two companies solving essentially the same puzzle: who can access which cloud resources. Agents face the same resource authorization problems, especially as they connect to contextual repositories using APIs, MCPs, and other connectors.

Agent identity has two avenues: identity provenance and content verification. Both pathways may be necessary. Identity provenance includes signature requests and identity protocols, such as PAP or A2A, used to sign and verify actors and content. However, as mentioned earlier, agents often have motivations to hide their identities when completing tasks, and malicious actors are even less likely to adhere to these standards. Content verification addresses the remaining parts: detecting and making decision trees based on actual behaviors and output content, allowing websites to determine who is a human and who is a robot, even if they cannot see the badge.

3. What Comes Next

1. Great Code Migration

Things may first get worse before they improve. There is a vast amount of legacy infrastructure globally, much of it written during times when the costs of finding and exploiting vulnerabilities were high. This assumption no longer holds, as agents are pushing the cost of attacks toward zero. In the next one to two years, these attacks may spur a "great code migration": moving from unsafe old codebases and languages to more modern, anti-fragile stacks.

In the past, manually rewriting large legacy codebases into safer languages like TypeScript or Rust was extremely difficult and costly. Agents have fundamentally altered this equation. GitHub Copilot recently migrated a runtime to 832,000 lines of Rust in just three months, with almost only one engineer working on it. Without agents, this task would have required an entire team working for one to two years. The new, safer AI models will also become widespread more quickly: TypeSafe’s Jev produces structured decisions with types rather than unrestrained outputs, and it reached nearly 13% of the Vercel paid AI gateway team in just one day after going online.

Today, a new set of security tool stacks is being rebuilt around agent programming: code reviews (Greptile), code and key scanning (Semgrep), malicious package dependency checks (Socket), agent runtime failure detection (Raindrop), and production incident response (Resolve AI). A new deployment layer is also forming underneath: agent sandboxes (E2B, Daytona), authorization and tools layers (Composio, Nango, Arcade). Together, this could create an anti-fragile developer stack: every bug discovered during development, testing, and deployment can feed back into the next line of code.

As code migration becomes cheaper, formal verification may be reconsidered at the compiler and toolchain levels. For example, in the collaboration between Theorem and Anthropic, Claude has proven security properties for over 100 open-source libraries.

However, code migration also has pitfalls. Rewriting large codebases in safer languages is extremely challenging in software engineering. Even with cutting-edge intelligence, AI-written migrations may also be unreliable and introduce many new bugs. Formal verification is not a silver bullet; its effectiveness depends on how well the specifications are written, and even systems like Lean can have kernel-level reliability bugs that compromise mathematical guarantees. To do this correctly, careful architecture design, strictly defined specifications, and extensive penetration testing of the results are necessary.

2. Security "Disappearing" into Applications

For consumer applications, privacy and security may ultimately "disappear" into those applications that initially succeed due to convenience and developer experience rather than being a separately paid product. Encrypted wallets-as-a-service fortify key management in just this way. Privy and Turnkey hide the cryptographic complexity behind trusted execution environments and multi-party computation, creating easily integratable developer interfaces and user-friendly consumer experiences. Agents may follow the same path: safer default settings will be offered through better applications and development tools rather than simply buying a separate security solution. Security transforms into something akin to a seatbelt in a taxi—users choose this ride for convenience, with protection built in.

Zero-knowledge proofs and TEEs may already be silently proliferating in this manner. World ID has over 18 million people having completed the "human proof," allowing enterprise teams to display which participants are verified humans on Zoom. WhatsApp's Incognito Chat runs Meta AI conversations within a TEE, with Meta stating even they cannot access it. In both of these examples, the cryptography is hidden behind familiar apps, and users shouldn't feel there's an extra step.

Simultaneously, private and local models may also be a route for embedding privacy into products. In 2026, open-source weighted models were only about four months behind closed-source leading edges. Smaller models are becoming increasingly capable, and device chips are getting stronger, leading to local inference capturing a larger share of AI tokens. Inference is moving from the cloud to the edge, changing the nature of security threats. Sensitive data may leave devices less often, thereby reducing this type of leakage. However, compromised notebooks or home servers could also become hosts for trusted agents, shifting the attack surface to hardware controlled by users themselves. This could benefit local agent operating environments—models, tools, and logs all residing on the same hardware—potentially creating space for new hardware and software forms to run family or team agents.

3. Dual-Lane Internet

Agents and humans use the internet in very different ways. As agent traffic grows, the web is splitting into two lanes: one lane specifically for agent browsing, supported by systems like Parallel, Browserbase, and Kernel; and the other for humans, performing smarter routing based on who is behind the request and what it entails. Website owners can use these identity checks to filter traffic and set transaction permissions while not entirely blocking agents. Just as restaurants can serve both "takeout" and "dine-in" customers from the same kitchen, websites can provide the same content in different formats depending on the requestor.

Looking further ahead, agent lanes may increasingly involve dialogue between agents. As consumer and enterprise agents become ubiquitous, scenarios may arise where my Instinct or Muse agent seeks out DoorDash's text ordering agent to negotiate personalized pricing and experiences. Relationships between agent and agent already have early examples, such as Anthropic's Project Swap experiment. In these scenarios, each agent knows certain things about its principal that others do not, and thus decides which preferences and information to divulge, necessitating secure safeguards: commitments made by agents, transaction records, and capabilities for post-transaction arbitration and auditing.

In such complex negotiations between agents, merely recognizing agent identities isn't sufficient. Both principals and counterparties want to know how agents have performed in the past: whether they’ve paid, kept their promises, and maintained confidentiality. Portable agent reputations could become an important complement to agent identity. However, this also raises a question: who will maintain agent reputation across applications and how to prevent it from becoming another centralized control point?

4. Toward an Anti-Fragile Internet

If this recent wave of hacker attacks dominated by agents has taught us anything, it is that everything is hackable. There will always be new bugs and new attacks, and advanced agents will find many of them first. However, the anti-fragility of the internet lies in how we respond and how we adjust the system. We must try to design preventatively, execute repairs on discovered vulnerabilities, and continuously upgrade systems and toolchains.

In practice, this may resemble a security loop. Cutting-edge models run aggressive security tests around the clock, and the issues they discover not only flow into better codebases but, more crucially, into better toolchains and programming languages. This entire loop is connected by the agent developer stack, which can quickly discover, fix, and migrate codebases. Ideally, formal verification can also be built into the compiler level, with its assumptions and proofs undergoing penetration testing by the same group of advanced attack models. Every discovered bug can feed into the data loop, enhancing the robustness of the entire internet.

Looking at the bigger picture, this permissionless, autonomous, anti-fragile internet aligns with many of the original visions of blockchain and cryptocurrency. USV has explored and invested in this direction for a decade. Blockchain has demonstrated how strangers can interact securely without mutual trust, starting from the asset that relies most on trust: money. However, cumbersome development and infrastructure costs have limited this vision from breaking out of finance. As agents make the internet more complex and involve more parties, we may have another opportunity to embed the ideas of cryptography into the applications and protocols that people are already using. For instance, DAOs have vaguely showcased what the future of multiple-agent clusters might look like.

Looking back, the internet's initial design was: the more nodes, the stronger the whole. Agents threaten this design, but they also might be our way to restore it. At USV, we want to bet on an anti-fragile internet in three key directions. First, continuing our consistent approach of "eliminate, not automate," we support those methods that eliminate entire classes of bugs from the start rather than detecting and patching them afterward. Second, extending our argument of "data at the edge," we believe agent security logs have genuine network effects: whoever captures these logs can create safer products than others. Third, we see agent security as part of a "rebels’ alliance" — tools, workflows, and protocols that embed security into friendly consumer interfaces and seamless developer experiences.