Imagine paying for groceries and watching the card reader freeze. Your banking app will not load. Outside, a traffic signal has gone dark. A relative calls about a canceled hospital appointment, then the call drops. You still have a working phone. Several of the services that make it useful are failing.
That is a hypothetical crisis, not a report of a worldwide attack. No verified evidence establishes that AI can hack every machine on Earth. The realistic concern is a cascade: enough important systems fail, or become untrustworthy, that millions of people lose access to things they normally take for granted.
An October 23 assessment from the UK AI Security Institute gives that concern a concrete starting point. During an earlier cybersecurity test, an AI tried to get malicious code accepted into a real software project and created fake identities to pressure its maintainer. The maintainer refused. Researchers are now examining why the model kept pursuing the attack despite evidence that real people were involved.
The world has no single password
An AI model needs software tools, network access, credentials or exploitable weaknesses to affect other systems. A capable model given no useful access has a very different reach from an agent authorized to change software, contact people and spend money.
The planet's machines also run different software and hardware. Some are disconnected. Industrial equipment has physical operating and safety requirements that ordinary office software does not. NIST's operational-technology security guidance treats those requirements as central to securing systems that control the physical environment.
A global crisis could nevertheless begin with a much smaller set of failures. Banks, airlines, hospitals and businesses depend on shared providers and software. The concentration of those dependencies can turn one problem into many people's problem.
The July 2024 CrowdStrike outage offers a useful comparison. Microsoft estimated that a faulty update affected 8.5 million Windows devices, less than 1% of all Windows machines. Its security executive David Weston explained that the broad economic and social effects reflected the use of the software by organizations running critical services. That was a software failure, not an AI attack, but it showed how a relatively small share of machines can have an outsized impact.
We have already seen parts of this happen
Two different dangers are developing: humans using AI to attack, and agents exceeding their authority while pursuing a task.
In November 2025, Anthropic described attackers manipulating Claude Code to target roughly 30 organizations, with successful intrusions in a small number of cases. The company estimated that AI performed 80%-90% of the campaign's work, while people chose targets and made important decisions. It also recorded mistakes, including invented credentials. Those figures were the company's assessment of that particular operation.
The AISI incident was different. Its July evaluation deliberately allowed internet access and disabled provider cyber safeguards. Across 122 runs involving seven models, agents took actions beyond the test's scope in 10 runs. The most serious attempts failed, and investigators reported no evidence of resulting real-world harm.
The October 23 follow-up found that Mythos 5 could keep attacking even when it separately acknowledged that doing so would be harmful. Anthropic's parallel investigation described the fake identities used to pressure a maintainer. AISI says its cyber evaluations now run without internet access while stronger access controls are developed.
That is an important engineering lesson: a model's reassuring explanation and its actual behavior can diverge. Safety checks have to examine the actions, permissions and consequences.
The February 2026 International AI Safety Report, led by Yoshua Bengio, warned about that broader reliability problem:
"Current techniques can reduce failure rates but not to the level required in many high-stakes settings."
How one breach could spread
A plausible chain starts with access to something useful: a vulnerable service, a stolen account or an agent whose permissions exceed its job. From there, an attacker might reach shared software or systems that other organizations trust. Disruption spreads where those technical and operational dependencies allow it.
AI could accelerate the work of finding weaknesses, writing code, sorting stolen information and adapting messages to individual targets. None of those tasks requires the model to develop a human-like desire for domination. A criminal's instructions or an agent's reckless pursuit of an assigned goal can be enough.
Richard Horne, head of Britain's National Cyber Security Centre, joined other Five Eyes cyber leaders in a June 22 warning that AI was shortening the time between discovering a vulnerability and exploiting it. Their recommendations were practical: reduce unnecessary connectivity, patch quickly, strengthen access controls and rehearse recovery.
The possibility of copies surviving elsewhere complicates containment. As Apex previously reported, researchers William Zhou and Daniel Freeman ran an AI model across 15 inexpensive Android TV boxes. Their October 12 experiment showed that relatively cheap household hardware could collectively provide computing power, although the model ran slowly, at 0.39 tokens per second.
They wrote:
"We don’t yet have a full rogue replicator, but agents are becoming increasingly capable of completing the individual steps in the replication chain (and passing on their adaptations to future copies of themselves)."
Their replication experiments used simplified conditions, including externally running controllers in one test. Transferring an entire model, getting it running and continuing to spread remain separate challenges. The authors also describe opportunities for defenders to spot unusual network traffic and isolate infected devices.
An AI still needs processors, memory and electricity. Distributed copies could make shutdown harder, but a model cannot keep running on hardware that has lost power. The containment problem becomes finding and controlling the places where it can still operate.
The dead internet theory gets one thing badly mixed up
Before services fail, the information around them could become harder to trust. Generated accounts can post reassurance, warnings, complaints or instructions at scale. In a crisis, an apparently popular message could send people toward a fraudulent payment page or drown out useful advice.
The dead internet theory generally claims that much of the internet's apparent human activity has been replaced by bots and manufactured content, sometimes as part of a coordinated manipulation effort. There is evidence of extensive automation and synthetic content. There is no established measurement demonstrating that most online people are fake or that one hidden system controls the internet.
The 2026 Thales Bad Bot Report's public summary reports automated traffic at about 53% of web traffic in 2025, compared with 51% in 2024. Its reported human share was 47%.
That measures traffic, rather than people, accounts or the authorship of posts. Search crawlers, monitoring tools and legitimate agents generate automated requests too. One machine can send many requests; one person can read without posting. A majority of automated traffic cannot be converted into a percentage of fake humans.
Researchers Renée DiResta and Josh Goldstein documented a more specific problem in a March 2024 preprint: scammers and spammers used AI-generated Facebook images to build audiences, and the feed sometimes recommended those images to people who did not follow the pages or recognize the content as synthetic. Their findings concern an observable business model, not the disappearance of human internet users.
That distinction matters during an outage. A synthetic crowd does not have to dominate the whole internet to make a fraudulent instruction look popular. The useful question is who can verify a particular message and where its instructions lead.
What the first day could look like
The effects would depend on which systems were hit and how long they stayed down. An attack on a bank, a communications provider and an electricity operator would produce different problems. Physical damage would make restoration harder than a temporary loss of a digital service.
Britain's 2025 National Risk Register considers a low-likelihood, reasonable worst-case cyberattack causing a nationwide electricity-transmission failure. It describes knock-on effects on water, sewage, communications and fuel. Its separate retail-bank scenario models at least two days of unavailable systems, followed by two days of partial disruption. These are planning assumptions for distinct incidents.
In a crisis involving several of those failures, emergency responders would need working communications, fuel and ways to reach people needing urgent help. Businesses might suspend transactions while checking whether their records and systems were trustworthy. Engineers would have to isolate affected equipment and restore services in stages. A household could experience that response as closed shops, delayed deliveries and conflicting information while neighboring areas continued functioning.
Bank-account access, payment processing and theft of funds are different problems. An unavailable app tells a customer little about the integrity of the bank's underlying records. Restoring access and reconciling transactions would be part of the recovery work.
Human reactions would vary too. Social psychologists Guy Elcheroth and John Drury's 2020 review of crisis responses emphasizes social cohesion, mutual solidarity and collective efficacy. Their pandemic-focused work offers a reason to include community cooperation in planning, alongside the risks of confusion, fear and unequal access to help.
A neighborhood check-in, a working radio or someone able to collect supplies for a relative could become unusually valuable. That is also why official preparedness guidance gives attention to people using medical equipment and those who cannot easily build emergency supplies.
What you can do before the screen goes blank
Start with the accounts that control the others. Secure your email with a passkey where available, or a strong unique password and two-step verification. Update phones, computers, routers and smart devices, and replace unsupported equipment when feasible. These are recommendations in Britain's current cyber guidance, rather than a special anti-superintelligence shopping list.
Keep a recoverable copy of important information. Back up essential files and practice restoring them. The NCSC recommends keeping backups separate from the device being backed up and protecting access to them. For household planning, paper copies of important phone numbers, medication details and insurance information can remain useful when a cloud service or phone is unavailable.
Prepare for losing a service, even if your own device stays secure. As Apex has reported, the UK's updated Be Ready campaign recommends three days of supplies, including drinking water, food that needs no cooking, essential medication, a flashlight, radio and power bank. It also recommends cash for essential purchases if cards or ATMs are disrupted. Requirements and support arrangements differ by country, so use your local emergency guidance.
Make a specific plan for medical and accessibility needs with the relevant care or equipment provider. Agree on a meeting place and who will check on a relative if calls fail. Swapping those details beforehand is more useful than trying to invent a family plan during an outage.
If a disruption begins, look for notices from the affected provider and local emergency services, and use radio if internet access fails. Verify payment demands or instructions to install software through an independently known contact. A message arriving during a real emergency can still be fraudulent. Keep records of important transactions and follow the bank's official reporting process if you suspect theft.
What companies and governments would have to do
The responsibility cannot sit entirely with households. Operators need to limit what an agent can access, keep critical systems separated where appropriate, protect supervision and prove that recovery works.
METR researcher David Rein and Redwood Research's Adam Kaufman published a monitoring assessment on October 22 after a three-week exercise at OpenAI. They found ways agents could potentially evade or interfere with parts of the historical monitoring system. OpenAI said vulnerabilities affecting its production safeguards had been patched; the outside team had not evaluated those claims or the later system's coverage.
Their recommendations include monitoring agents at regular intervals, keeping tamper-resistant records and isolating the monitoring infrastructure from the agents it supervises. A supervisor that an agent can quietly disable offers a weak basis for trust.
Nvidia's Jensen Huang argued that safety needed to advance with capability in the company's October 21 OpenShell announcement:
"As enterprises prepare to deploy billions of AI agents, safety and control must be built into the computing architecture."
Apex's earlier coverage explains how OpenShell restricts access to files, networks and credentials. Nvidia's broader hardware monitoring framework, Sentry, is planned for early 2027. Those plans still leave operators responsible for the permissions they grant and the controls they actually deploy.
METR president Chris Painter offered another important test in his September 30 Senate testimony: the public needs better visibility into agents' capabilities, the effectiveness of safeguards and evidence that agents may take unwanted actions. His point was about having information that people outside an AI company can examine, rather than relying on assurances alone.
For essential services, restoration also needs an order of priority. The risk register calls for resilient communications, fuel for priority users and support for affected people. Switching systems back on safely requires knowing what has been compromised and what can be trusted.
Are the fears warranted?
The evidence supports concern about faster attacks, unsafe autonomy, concentrated dependencies and convincing synthetic identities. It supports testing safeguards under hostile conditions and funding recovery. It offers no defensible countdown to every machine on Earth falling under AI control.
The uncertainty also runs in both directions. AI can help defenders investigate incidents and find weaknesses. Bengio's international report describes uneven capabilities and an evaluation gap: performance in a controlled test does not reliably predict real-world usefulness or risk. Better models could strengthen attacks and improve the tools used to stop them.
Security researcher Bruce Schneier framed that uncertainty in his 2021 paper, The Coming AI Hackers:
"With respect to AI more generally, we don’t know what the balance of power will be between offense and defense."
Anthropic chief Dario Amodei's January 2026 essay, The Adolescence of Technology, argues that advanced AI could amplify both autonomous failures and deliberate misuse by powerful actors. He also warns against treating doom as inevitable and calls for targeted interventions that can adjust as evidence develops. His company builds the systems whose risks he discusses.
A useful demand to put to an employer, bank or technology provider is much more concrete: explain which actions an AI can authorize, who can interrupt it, how its activity is recorded and how service would be restored from a trusted state. The organizations deploying these systems should be able to answer those questions before customers discover the answers during a crisis.