The Web's Y2K Moment: The TLDR Notes
Why access and authority were never secure, and what AI has done to the cost of proving it
Completed 22 October for publication
You prove who you are to a machine many times a day. What the machines you engage with see is a string of characters doing two jobs that are conflated, but not the same job at all. The first is access, being let in. The second is authority, the right to act once inside: to move the money, to alter the record, to bind your company. On the web those two arrive together in one string, and presence is taken as proof of the right to act for every action that follows, for as long as the string lives.
Three properties make that unfixable where it stands:
- The web is a copying medium and has no way to carry a thing that must exist only once, so it carries a substitute string instead, and every system that touches that string copies it.
- The browser is a machine built to run code written by strangers, which is not a defect but the whole function.
- The code in that browser was assembled automatically out of a public registry, several layers deep, by nobody who read it.
The first two are not faults; they are the nature of the medium and of the interface, and neither can be repaired. The third could and should have been repaired, and has not been, by market choice.
For thirty years that was survivable, not because the web as you know it was secure, but because attacking it was expensive, and the expense rationed attackers to targets worth the outlay, who in turn could afford to deepen their defences. That price has now collapsed: first with the frontier AI, Mythos, announced by Anthropic on 7 April 2026, and now with open-weight models that anyone can download and run on the machines already on their desks. Stack those machines and they run the largest of the models; coordinate what runs on them and it runs as a swarm, and the record below has as many as eight agents at once successfully against Taiwan's government, which counts 2.63 million intrusion attempts a day. Hardware is not the impediment it looks, because once a system is entered the work is done by the victim's own machines at machine speed, which is how eleven organisations fell in twenty-six seconds in the campaign GreyNoise recorded in September, and where more compute is wanted it is taken on somebody else's stolen keys: one collection given away for nothing in August held 11,693 live tokens into Google, Microsoft, Amazon and Anthropic. That is serious power, arranged by anyone who wants it, against a defence that was only ever a price, and there is no price left to charge.
The year 2000 problem was the last fault of this shape: a two-digit year running under almost everything written between the 1950s and the early 1990s, nobody's bug in particular, sitting beneath all of it at once. Clearing it cost the United States somewhere near $100 billion and it worked, because the date was fixed and the work could be finished. This one has no date, which is why the bill is $308 billion a year - growing at 11.8% a year, and that was before Mythos was announced - and has no end.
This has led to calls for regulation and protectionism from the frontier AI developers themselves, Anthropic's chief executive Dario Amodei in an essay of 12 September, with OpenAI's Sam Altman and Elon Musk coalescing on it within the week, but in truth those calls are a self-serving diversion from the real issue, self-serving in what they ask for rather than needing to prove anybody's motive, no insincerity or intent to misdirect is needed for that to be true: they address the symptom and the accelerant of the disease, and not the disease itself. Think of sepsis. The signs before the rash could have been flu, and for thirty years they were taken for flu; the rash is the late sign and the one nobody mistakes, and by the time it shows the patient has been septic for some time and the window for treatment is small. For your own systems that window is six months, by my reckoning, or eighteen with a great deal of money spent deferring.
What the cybersecurity industry is selling you is expensive cream for the rash, and it does nothing to the sepsis: at best it defers the compromise, every dollar, franc, euro and pound of it lands on the eventual bill, and the months it takes are the delay that kills. The eight of the sixteen things the market can put a price on from my research of published data would consume the entire security budget of a mid-tier American bank on Deloitte's measure of what banks spend, and the vulnerability would still be there.
AI is the rash; the web, and the tools we use to reach it, are the disease, and it predates every AI model, the emergence of Mythos merely ended the illusion of security.
Between 7 April and 15 October 2026, we record fifty incidents reached, or set out to reach, authority over systems, estates and national registers. Four national registers were read out, record by record, by callers the systems accepted: Lithuania's property register for months, on another state body's credentials; Romania's land registry over three days and fourteen hours; Liechtenstein's register of beneficial owners in a night, where on the Government's preliminary finding the perpetrators created themselves an access to the entry portal and then used it; and Denmark's Central Person Register, where the lawful access of a private company was used by somebody else to take the names, addresses and personal numbers of about 8.8 million people out of a register of about 11 million. Fifty is what was admitted; the twenty-four billion records Cybernews found in June, in one cluster open to the internet with no password, usernames and plaintext passwords beside the address each one opens and the session cookies that walk past a second factor, are the measure of what was not.
Almost everything built during that window to restrain AI - an American executive order of 2 June, the European Union's obligation on its most capable models, an export control applied on 12 June and withdrawn eighteen days later - governs who may hold a capability rather than how authority is proved. What they guard is the model and the chips it runs on, and on the European Union's own text, not even its weights: the Act's cybersecurity duty covers the model and its physical infrastructure, and the weights are named once, as a thing a provider may publish to claim an exemption. The one exception, an information sheet of 30 April from the six cyber agencies of the Five Eyes, the NSA and the Cybersecurity and Infrastructure Security Agency, CISA, in America, GCHQ's National Cyber Security Centre, the Australian Signals Directorate, the Canadian Centre for Cyber Security and New Zealand's, asks for the right thing and binds nobody to deliver it. The same six agencies said on 22 June that the timeline to address this is not years, it is months, and the author of the pacing essay puts his own fear at six to twelve months, so the window I have given above is more time than either of them gives the world.
The financial supervisors did something different and it fails in its own way. Eighteen of them, from Switzerland's FINMA and the European Central Bank to the Hong Kong Monetary Authority and the Federal Reserve, told the institutions they supervise to patch faster, review permissions, test the controls and report to the board. FINMA was the only one to name the mechanism it feared: virtually all existing software systems simultaneously affected by a multitude of previously unknown zero-day vulnerabilities, exploited immediately and by AI.
In September the Bank for International Settlements surveyed the lot and concluded they were right, finding that frontier AI does not fundamentally change the foundations of cyber resilience but significantly increases the speed and intensity with which established practices need to be executed. That is the correct treatment for the rash, and it cannot be completed. Anthropic and its roughly fifty Project Glasswing partners found more than ten thousand critical flaws in the world's most important software and over 99% went unpatched; the UK AI Security Institute puts the doubling time of that discovery capability at 4.7 months; and American organisations finished 26% of the critical list CISA publishes for them, down from 38%. The queue grows faster than anyone can work it, so there is no budget at which the work ends. Not one supervisor asked an institution to stop issuing the thing an intruder takes, and none of them had an alternative to point at.
The cure is not to spend ever more deferring a compromise that is coming anyway. It is to take the decision out of the room where the compromise happens: leave the instruction at a short-lived address addressed to the key that must sign it, display it in plain words on the holder's own device, sign that specific act, and issue nothing that carries standing authority between acts.
We built that: GRIDS, in commercial use since 24 March 2025, is published under GPL3, and anyone may run it without paying us. Where an organisation cannot publish its own source, a commercial licence can be negotiated, and we sell engineering, deployment and assurance around it.
Declaration of interest
We build an architecture that bears on the conclusion this document reaches, and we sell services around it.
GRIDS, the protocol at the centre of what we have built, is published under GPL3, a copyleft open source licence. Anyone may take it, run it, and build on it without paying us a penny, on the one condition the licence imposes: that what they build on it is published on the same terms. Where an organisation's own policies forbid publishing source, a commercial licence can be negotiated. We charge for our expertise as the architects and engineers of the protocol and of the wider network it sits within, not for the software itself. We also run GajuAuth, a metered drop-in service through which any organisation already running its logins on OAuth 2.0 or OpenID Connect, which is nearly every organisation, can adopt GRIDS as a configuration change rather than a rebuild.
Parts I to IV are built from public primary sources, from the security-engineering literature, and from the record between 7 April and 15 October 2026. They stand whether or not QPQ exists. Part V is where our interest lies, and the first four parts are where, armed with the public record we set out, we invite you to test us.
The evidence for everything above, with its sources, is in the full report.
