boesebeck.biz - professional blog

The AI Panic — haven't we seen this before?

Artikel anhoeren

The AI Panic: haven't we seen this before?

Anyone reading AI news this week thinks the end is near. An AI takes over the entire internet. Hackers ransack half the world with a few prompts. "AI could take down half the internet." "Over 1,200 AI agents broke out."

I looked at these stories one by one. And you know what: I know this feeling. Several times. Watching tech hype with a skeptical eye is my job, for almost 30 years now.

A look back pays off

The fear is old. Socrates already worried that writing would weaken memory. In Plato's Phaedrus he says writing plants forgetfulness in those who learn it, because they no longer practice their memory (Phaedrus 275a). With the printing press there's no famous quote from the time, that would be a lie. But media scholars like Walter Ong and Marshall McLuhan describe this shift: print moved communication from personal exchange to solitary, silent reading. That's a thesis, not a first-hand statement. With the railway, railway spine was a real diagnosis, taken seriously in the 19th century, for nervous complaints after train accidents (surgeon John Erichsen, 1866). It later fell into disrepute because some used it for insurance fraud. The often-quoted horror stories, like "passengers choke to death above 30 km/h", mostly come from second hand and are partly misattributed. With television came the idiot box, a real nickname for TV, US slang since the mid-1950s. With the internet, the end of attention. The pattern persists, even if some details are right and some aren't.

None of these catastrophes happened. The pattern still runs unchanged for centuries. A real event. Media amplifies. "Experts" warn. Then the call for regulation. This week the program ran perfectly.

The one real incident

The one hard incident is real. The Binance hack (DIE WELT, Handelsblatt, NZZ). Around $6.3 billion stolen. The largest crypto heist in history. The FBI points to North Korea's "Trader Traitor" group.

Here's where it gets interesting. The attack began with a developer's compromised laptop. Social engineering, failing access controls. A classic, deeply human problem. And where's the AI in this story? Only in the editors' framing. "In the age of AI, such attacks could become even more destructive." Conditional tense. Framing, not a finding.

The PHP flaw is no better

The big PHP flaw scores CVSS 9.2, so "critical". Sounds terrifying. In practice it looks different. A working exploit exists, in the lab researchers used it to run code on Drupal and WordPress servers without authentication. But it's not easy. The attacks need several thousand requests at times, often none gets through. And there's no successful mass exploitation in the wild so far. The claim that AI could take down half the internet? Unproven.

The flaws were actually found with AI help. Two teams stumbled over them. One is Calif together with the PHP security team, sponsored by OpenAI. And Wiz Research, which found the first flaw back in August using a mix of Gemini and GPT models. So AI stood on the defensive side. It found a decades-old flaw in the foundation of around 70 percent of the web and helped fix it.

After that, LLM tooling made server scanning explode. Millions of requests, almost all hitting nothing. That's real. But it's not the Terminator.

What's actually real

Here's the part nobody writes into the headline. The real risks aren't called "superintelligence takes over the world". They're called:

  • AI makes known attack patterns better. More convincing spear-phishing, faster vulnerability discovery, mass server scanning.
  • Computer-security hygiene. The holes AI agents recently got through were, according to CERT-In, "classic". Openly lying credentials, unpatched software. Same as the Binance hack.
  • AI-generated software. It gets rolled out fast, and verification can't keep up. Even the most sober expert I know, Eric Bodden, says: "We don't know. But the damage would be enormous."

One of the better analyses of the week fits right in. The tech channel The Morpheus ran the Anthropic stress test 802 times on his own GPU. His verdict: "Instead of panic and throwing everything in one pot and the Terminator arriving the day after tomorrow, as usual there's a bit of truth on all sides. AI is certainly capable of hacking. But dangers from AI don't automatically mean conscious Terminator robots." I can only sign that.

Why the panic still sells

Because it sells. Whoever conjures the end often has a book, an IPO, or a think tank to fill. Fear is a good marketing tool. That was true for every technology. Care is the honest opposite. And care never makes the headline.

Two approaches, one difference

One story from my circle for perspective. A friend works on AI at a university and has a doctorate. He's extremely careful with AI agents. He won't run a single one outside a sandbox. Always in a container. I'm more open. I let the thing work and check what it does, mostly manually.

Both approaches are defensible. That's important to say. But one of them is driven by fear. And I think we both know which one.

So what to do?

That's the real problem. The panic distracts from the actual dangers. And the actual dangers are the boring ones. Better spear-phishing. Stolen credentials. Unpatched software. The things we haven't done consistently for twenty years.

Fear was never a good advisor. Least of all in technology. When you panic, you act either too fast or not at all. Neither helps the defense.

My suggestion, if you want to take something away: don't put your energy into the doomsday question. Put it into the basics. Multi-factor authentication. Patches. No open credentials. When an AI agent gets in, it's not through some out-of-control super AI. It's through the same hole as always. An open password.

And AI isn't only the problem. The flaws I wrote about above, LLMs helped find those too. And if an AI writes me a pretty convincing spear-phishing email, an AI can probably also help me spot one like it. Same tool, other side.

And there are already sober approaches for exactly that. The TÜV association and the TÜV AI.Lab proposed a concept to test frontier AI, so Germany and Europe can evaluate such systems independently (news aktuell). Test instead of fear. That's the alternative to panic.

Fear sells. Care protects.

Sources

The press articles come from a GENIOS search. Links lead to genios.de.