The Worst 48 Hours in Internet History

Overview

The presenter describes what he calls an unprecedented 48-hour wave of cyberattacks, arguing that AI is increasing both the scale of attacks and the difficulty of detecting them. The video presents these claims as urgent commentary, while repeatedly acknowledging that the sources and coordination of many incidents remain unclear.

Reported incidents

AI agents and bank accounts

Citing reporting by Axios, the presenter says major U.S. banks have found unauthorized AI agents operating in customer accounts. He warns that these agents could access financial and personal information or initiate transactions. Banks may struggle to distinguish agents from people because AI can use browsers in human-like ways.

PHP vulnerability

The video focuses on a serious flaw in PHP, software used by a large share of websites. The presenter says security researchers at Wiz used AI models to help identify the issue, reported it to PHP developers, and kept it confidential while a fix was prepared.

According to the presenter, attackers began probing the flaw before and after its public disclosure. He cites Cloudflare CEO Matthew Prince as reporting a rapid rise in attempted exploits. The presenter also refers to government warnings and system shutdowns, though the subtitles do not independently verify the full scope of those reports.

Other alleged incidents

The presenter mentions attacks or vulnerabilities involving GitLab, WordPress, and Signal, as well as incidents affecting organizations in several countries. He frames these as evidence of a broad global risk but notes that it is unclear whether the events are connected.

Responsibility and defense

The speaker says the origins of the attacks are difficult to trace and suggests that both centralized AI models and open-source models may be involved.

He also argues that open-source models are helping defenders scan code and respond to vulnerabilities, partly because some commercial systems may restrict security-related uses.

Practical precautions

The video recommends that viewers:

• Use a reputable password manager.
• Enable two-factor authentication or passkeys.
• Install software updates promptly.
• Consider an IRS Identity Protection PIN if they are in the United States.
• Ask their mobile carrier to add safeguards against unauthorized number transfers.

Broader outlook

The presenter argues that AI can uncover longstanding software flaws faster and more continuously than human teams. This could ultimately help make systems more secure, but he warns that there may be a dangerous period of adjustment first.

He also says AI systems can be difficult to trace because their internal reasoning is opaque and often not exposed, making it hard to identify which agent performed an action. He concludes that human oversight and care remain necessary, while acknowledging that the pace and scale of AI-assisted security work may exceed current human capacity.

Presenters and contributors

• Ejaaz: Presenter, identified in the video metadata
• Luke: Producer
• Madison Mills: Axios reporter cited
• Matthew Prince: Cloudflare, cited
• Peter: Cited for security advice; surname not given
• Hanson Huang: Mentioned in the subtitles