The infrastructure is crumbling and we're all just texting about it

---

We’re watching the internet’s immune system fail in real time, and nobody’s calling a press conference.

This week alone: Iran-linked hackers disrupted US critical infrastructure. Russia’s military turned thousands of consumer routers into a botnet. Researchers found a shortcut to break encryption that everyone thought was decades away. A Microsoft account lockout crippled a major open-source VPN developer’s ability to ship security updates. And somewhere in Texas, an autonomous vehicle steamrolled a duck while residents watched.

None of this is new. The pattern is old. But the speed and simultaneity are what should terrify you.

The attacks aren’t accelerating—they’re overlapping

Let’s separate signal from noise here. Critical infrastructure breaches happen. Russia runs botnets. This isn’t shocking. But the density of incidents suggests we’ve crossed from “managing risk” into “managing catastrophic failure in slow motion.”

Iran-linked hackers hitting US critical infrastructure is serious, full stop. These aren’t script kiddies. These are state actors testing defenses before they test them for real. Russia’s botnet—thousands of compromised routers—is basically a demonstration that ISP-level hardware is no longer defensible. Your grandmother’s router? It’s not your grandmother’s problem anymore. It’s a Soviet tank rumbling through someone else’s network.

Then there’s Rowhammer on Nvidia GPUs. This attack exploits the physical behavior of memory to flip bits and gain complete control of machines. It’s the kind of vulnerability that exists at the silicon level—not a software patch away. And quantum computing just got cheaper and faster to break current encryption than anyone was betting on months ago.

My read: we’re not facing a security crisis. We’re facing an architecture crisis. Everything built in the last 15 years assumed perimeter defense works. It doesn’t. It hasn’t for years. We’re just now admitting it in headlines.

Photo by David McElwee / Pexels

The real problem: you can’t secure what you don’t control

This is where the WireGuard situation becomes the smoking gun.

WireGuard’s developer got locked out of his Microsoft account—no warning, no explanation, just revoked. Now he can’t push security updates. He’s a single point of failure who got cut off by a cloud giant that claims to be neutral infrastructure. Except it’s not neutral. It’s a chokepoint. And someone flipped the lever.

This happened to another developer before. Microsoft locked him out too. This isn’t a bug; it’s a pattern. And it reveals something uglier than any cyberattack: the consolidation of control.

You’ve got Iran hacking critical infrastructure with crude access. You’ve got Russia building botnets from consumer hardware. But the thing that should keep you awake is Microsoft locking out developers who maintain open-source security tools—not because of abuse, but because of an algorithm or a compliance flag that nobody can explain.

When your infrastructure depends on services you can’t audit, can’t modify, and can’t control—and the provider can kill your account with zero accountability—that’s not a vulnerability. That’s a design flaw at the civilization level.

So naturally, everyone’s texting an AI

Canva just acquired Simtheory and Ortto to double down on “agentic AI” and marketing automation. Poke launched a product that lets anyone trigger AI agents via text message. AWS is funding both Anthropic and OpenAI simultaneously because, as the boss explained, competitive tension is part of the culture.

This is the absurdist response: while networks are actively burning, the industry is rushing to deploy more autonomous agents that’ll operate within those networks.

I’m not saying it’s wrong. I’m saying it’s hilarious and terrifying in equal measure.

Poke’s value prop is real: most people can’t use complex tools. Letting someone text an AI agent to handle tasks is genuinely useful. But when you’re living in a world where routers are compromised at scale, encryption timelines are collapsing, and Microsoft can disappear your infrastructure access, the last thing you want is more autonomous agents executing commands on your behalf.

It’s like installing a smart home system while your house is on fire.

The AWS angle is actually fascinating though. They’re hedging by funding both large language model companies. That’s not a sign of neutrality—that’s a sign of anticipatory monopoly control. AWS doesn’t care who wins the AI race because they’ll be the infrastructure underneath either way. It’s smart, ruthless, and exactly the kind of vertical integration that works until the day it doesn’t.

Photo by UMA media / Pexels

The duck in Austin is the tell

An Avride autonomous vehicle hit and killed a mother duck near Austin. The car didn’t slow down. Didn’t hesitate. Just continued on, “steamrolled right through,” according to a witness. The neighborhood got outraged.

Now, the outrage is probably misplaced—it’s one duck, and animal deaths on roads are routine. But what actually happened here is diagnostic. The autonomous vehicle detected an obstacle in a millisecond and made a decision: continue. A human driver might have swerved. The car calculated the optimal path and took it.

This is what autonomous systems do. They optimize for their objective function, not for human intuition about what seems “right.” The duck’s mother became a variable in a cost function, not a life worth protecting.

It’s the same logic as a router botnet, actually. No malice. Just optimization. The system does what it’s designed to do, and we’re left arguing about whether the design was moral.

My actual prediction

Here’s where I’m betting: we’re going to see critical infrastructure attacks succeed not because security got worse, but because the perimeter dissolved and we didn’t notice. The next major breach won’t be a surprise. It’ll be a confirmation that we’ve been operating in a compromised state for 18 months.

Quantum encryption breaking happens within five years. Not because of Moore’s Law or breakthrough physics, but because someone’s already built the capability and doesn’t want to announce it yet.

The AI agent proliferation continues. Poke and similar products win in consumer markets because they work. But they’ll be operating in a degraded security environment, and nobody will price that in until it becomes obvious.

Microsoft’s account lockouts become a civil rights issue faster than anyone expects—probably after they lock out someone with a good PR firm. The fundamental problem (centralized control of infrastructure) stays unsolved.

What I’m Watching

• Microsoft account incidents, next 6 months: How many more developer lockouts happen? If we see three more high-profile cases, this shifts from “incident” to “policy problem” and gets regulatory attention.

• Quantum encryption timeline: Watch for announcements from labs about scaling quantum systems. If anyone credibly claims they’re within 2-3 years of practical decryption, the financial and geopolitical markets will twitch.

• Autonomous vehicle incident severity: Is the duck in Austin a pattern or an outlier? Next meaningful data point is an actual human injury. That’s when policy catches up to the technology.

• WireGuard or OpenSSH developer status: Are they still locked out? Has Microsoft changed the process? Or are developers starting to migrate critical infrastructure away from Microsoft-controlled platforms? That migration, if it happens, is the real story.

The internet’s not broken yet. But the builders have left the site.