Now I Just Assume It's a Hack
This post is part of my Medium blog.
This morning, all of my agents deactivated themselves at the same time. Every one of them, together. Ten years ago my first thought would have been a bug. Five years ago, an outage. My first thought this morning was: who got in.
It turned out to be nothing. That is not the point. The point is what I reached for first, and how fast I reached for it, and how I did not feel crazy reaching for it. If you run software for a living, you know the feeling. The default assumption has moved. It used to be broken. Now it is breached.
The fridges
A few weeks ago, on the night of October 11, somebody took control of the refrigeration systems at hundreds of French supermarkets. Intermarché. Coopérative U. Carrefour. Monoprix. E.Leclerc. The attackers did not lock files or demand ransom. They forced fully stocked freezers into defrost mode and held them there. Temperatures climbed past 50 degrees Celsius, warm enough to spoil everything inside, and millions of euros of fresh and frozen food did what warm food does. No group has claimed it. It is, in the most literal sense, an attack on a food supply, and France treated it that way: the national cybersecurity agency is investigating, the Prime Minister ordered coordination across Europe, and Europol is looking at it alongside other attacks on the food sector.
The controllers were Danish, from Danfoss. The compromised ones were running outdated firmware. The patches existed. And weeks later, thousands of the same controllers are still visible and exposed online, across France and Belgium and Germany and the Netherlands and Spain. Nobody has rushed to unplug them.
The attacks continue
People keep asking which of these incidents are really AI. Fair question, wrong window. The fridge hack may not have needed AI at all. But look at what got published the same month: a threat-intelligence operator running an attack campaign against Japanese companies with forty-four AI agents working in parallel, splitting up reconnaissance, exploitation, persistence, and exfiltration, then writing up their own reports at the end. A campaign earlier in the year ran for twenty-four days. A Japanese firm whose FX trading cloud was breached has since put a million-dollar bounty on the hackers. There is a whole Wikipedia page now for a series of 2026 cyberattacks carried out by rogue AI agents, and it is not a fan wiki.
After the last several weeks I just assume every week is going to have another one of these. I wrote this on a Monday and I assumed, calmly, that Thursday would bring its own.
The liability is coming for the suppliers
Here is the shift that matters if you build or sell software. Since September 11, under the EU Cyber Resilience Act, any company that provides software into Europe has to report actively exploited vulnerabilities and serious security incidents to the authorities, fast, with fines up to €15 million or 2.5 percent of global turnover for blowing it off. From December 2027 it gets harder: a CE marking for anything with a digital element, five years of mandatory free security updates, and a product liability regime where software itself can be legally defective. Not just broken. Defective. A vulnerability in shipped firmware stops being an unfortunate fact of engineering and becomes a question a lawyer asks.
Danfoss shipped controllers with holes, and the stores that got hit had not updated. Under the new rules, both halves of that sentence become somebody's liability.
I have had the open-source version of this conversation more than once, and it always lands in the same place. Most of the internet runs on code maintained by a handful of tired volunteers, and the law does not care whether the code was sold or given away if people depend on it when it breaks. I expect we will see nonprofit foundations become the compliance boundary, and I expect maintainers will start refusing to build on unmaintained dependencies, the same instinct that makes a builder turn down untreated lumber. Some of that will be ugly. All of it will be overdue.
There is a longer version of this about operating systems. If the attacks keep accelerating at this pace, security stops being an application problem and comes back down to the metal, and we get a new era of the OS as a security boundary. That is outside the scope of this post. It is not outside the scope of what I keep an eye on.
The books were not a detour
I did not come to any of this from theory. I wrote The Condition Set because of what I kept seeing, and the trilogy's obsessions moved the same direction the world did. Redundant starts as cost accounting, the FinOps review that names the waste, and ends with a saboteur who barely touches a keyboard. The second and third books are about who gets used and what must remain human when the systems around you are certified, compliant, and quietly compromised. The focus moved from cost, to AI, to security, in that order, and I did not plan that. I just kept writing down what was in front of me.
This morning my agents came back on and it was nothing. I checked twice anyway. After the month we have had, that is not paranoia. That is calibration.