Since late last year, a small but growing chorus of cybersecurity experts has been warning that AI models were pushing the internet toward a sort of cataclysm. Hospitals, banks, utilities, basically anything and everything connected to the web could be hacked.
Over the past month or so, those scenarios have come alive in almost spectacular fashion: Last month, AI was used to find major security flaws in software used by 70 percent of websites, prompting governments to take down their websites as a precaution. A week later, attackers targeted the world’s largest cryptocurrency exchange, Binance, in part by hijacking the company’s internal AI tools, and ultimately drained billions of dollars. This fall alone, AI has been used to hack hundreds of financial institutions in Latin America, not to mention data centers, banks, and government entities around the world. AI has also changed the economics of hacking, such that targeting individual people and small organizations is becoming cheap and easy enough to be worthwhile. And there’s a broader rise in cyberattacks that, though not directly tied to AI, likely leveraged the technology in some way. Last week, for instance, the FBI issued a warning about hacks targeting industrial refrigeration systems following attacks on grocery stores in France, Belgium, Ireland, Sweden, Israel, and other countries.
[Read: Perhaps connecting fridges to the internet was a bad idea]
Governments and Silicon Valley entrepreneurs, who have been tracking this most closely, are steeling themselves against what promises to be an extended period of cybersecurity vulnerability—and they advise that you do the same. Defense Secretary Pete Hegseth recently said that every U.S. military base should be able to continue operating even in the case of a cyberattack disrupting the power grid. Japan has declared a state of emergency in cyberspace. South Korea’s National Intelligence Service has reportedly ordered thousands of organizations to conduct emergency cybersecurity audits. The United Kingdom is telling citizens to have several days of water and food prepared in the event of a number of potential disasters, including a cyberattack. Everybody is starting to sound, just a little bit, like a doomsday prepper, and not without reason.
So how do you keep your accounts, your family, and your finances all safe? For everyday users of the internet, there are low-lift steps you can take to avoid being a sitting duck in this new reality. The most important and easiest thing is to get your digital affairs in order. Use different passwords, ideally long and randomly generated, for all of your accounts and store them in a password manager. Enable two-factor authentication everywhere you can—that is, opt in to receiving a confirmation code on your phone or, ideally, inside a dedicated app to add a layer of security to sensitive accounts. In addition, frequently update laptops, smartphones, internet routers, and various applications. Otherwise, unpatched security flaws mean that clicking on a malicious link can allow a hacker to steal cookies and login information from your browser and bypass even two-factor authentication methods. Are these extra steps annoying? Yes. But are they more annoying than having hackers dip into your life savings and post bitcoin advertisements from your X account? No, they are not.
Additionally, be extra wary of social engineering. Phishing scams have gotten really, really good: Fake customer-service websites now regularly turn up in search results and direct you to AI voice agents, ready to steal your private information. You may receive personalized texts that look like they’re from your boss, a real-estate agent, an IRS official—you name it. The first step in the historic hack on Binance reportedly started with an employee clicking on a malicious advertisement. So, be on guard and inspect links before clicking. That can be as simple as hovering your cursor over a hyperlink in your email to view the full website address to see if anything looks suspicious (misspellings, extra words and characters). If a representative of your bank, power company, or another service provider calls you, double-check by calling them back on the official company number.
If you start taking these basic steps to prepare for AI-powered cyberattacks, you might start wondering just how far you can go. In Silicon Valley, an industry flush with money and people who tend to envision all kinds of apocalyptic scenarios, many tend to go to extremes. The influential investor Peter Thiel, who has recently given lectures about the “Antichrist,” has a sprawling property in a remote part of New Zealand on which he once planned to build a bunker-like cottage before a local council rejected the proposal. In 2016, Sam Altman told The New Yorker that he has “guns, gold, potassium iodide, antibiotics, batteries, water, gas masks from the Israeli Defense Force, and a big patch of land in Big Sur I can fly to.” These are edge cases, but they can be instructive in their own ways.
Others in Silicon Valley are undertaking less grandiose physical preparations. Jeffrey Ladish, the executive director of the AI-safety group Palisade Research, told me that he’s cautious about relying on the cloud to store his data. “It might be worth having a hard drive or some Blu-ray discs” with, say, photos and important documents. He also suggests stocking up at least a few days of food and clean water, as well as flashlights and some cash. “These could be useful whether it’s a pandemic, whether it’s a tornado, whether hacking takes down the power grid or takes down the banks,” he told me. Our conversation reminded him to check his supplies. “I should actually check on my fresh water,” he said.
Edouard Harris, the chief technology officer of the AI-safety company Gladstone AI, recommended downloading “parts of the internet that you care about the most”—for me, that might mean saving the many Atlantic articles I’ve written that only exist online. If you’re the type who partakes in cryptocurrency, that could mean moving it to a “cold crypto wallet,” or an offline hard drive. On top of that, Harris told me, “my bank password, my core email-account password, things like that are just not saved in digital format. They’re just written down on paper.” He is worried about an AI-powered hack taking down crucial infrastructure, which could, for instance, limit his ability to get power or water. That’s not a far-fetched concern: This summer, cyberattacks disrupted water utilities across the country and shut down a British power plant. Attacks on refrigeration systems could disrupt food or pharmaceutical supply chains, leaving people without groceries or essential medication.
In an extreme scenario that Harris described to me, nearly any device connected to the internet would come under attack, including your car. Harris built a website called Endgame Ready that offers a doomsday-prep kit. There are a number of similar guides circulating in the AI industry with names such as “Doomsday Pack” and a “Survival LLM” that can offer survival advice even, if you download the latter, in the absence of internet service.
Jeffrey Schlegelmilch, an associate professor and faculty director of the National Center for Disaster Preparedness at the Columbia Climate School, likened cybersecurity attacks to any other kind of disaster. “If you don’t have power, what does it matter if it was caused by an earthquake or caused by a cyberattack?” he asked me. In this view, the basic preparations suggested by Ladish and others are sensible: The typical gear recommended in the event of an earthquake or tornado—a few days’s worth of food and water, a flashlight, and a battery-powered radio—still apply. (The National Center for Disaster Preparedness has an interactive guide for making such a kit.) The most important thing, Schlegelmilch said, is to befriend—and plan alongside—your neighbors, as connectedness is “one of the strongest predictors of how communities do in the aftermath of a disaster.”
Harris has gone further still, acknowledging to me that he’s “unusual in how much effort I’ve put into this.” He has functionally disconnected his vehicle from the internet and uses 55-gallon drums to store water. For those with time and resources, he recommends storing electronics and hard drives in hardened, metal suitcases that block out radio frequencies, and buying both a wood stove and a 3-D printer to produce any parts you might need. He also recommends pooling resources with friends or family to purchase a “bugout property,” on which to take refuge, and set it up to run off-grid.
Some of this is easy to gawk at, and many of us have more pressing everyday concerns, such as the stubbornly high cost of gas and groceries and high interest rates. But it’s prudent to be careful, and governments around the world are advising just that. You don’t need to have a remote cottage, to downgrade your car, or even to save up for a solar panel to prepare. Even if cyberattacks don’t disrupt widespread infrastructure, the most practical steps are the easiest to take: Review your digital hygiene, pick up some durable pantry goods on a grocery run, have a flashlight and spare batteries in the closet. Whether you’re dealing with an AI-powered hack from Iran or just your run-of-the-mill brownout, you’ll be happy you have them.