You all probably saw this story:
https://www.youtube.com/watch?v=tj1dFIUAs7A — Bill Gates predicts “the most dangerous technology humans ever invented” will likely lead to “a lot of negative surprises” in the cyber area. Transcript

The weirdest thing about the western cybersecurity is that it was never about the system being algorithmically secure. The main cybersecurity tools were lawyers and bureacracy i.e. if you hack, leak, sabbotage — you will get suited, and the exposed vulnerability will be fixed to the most limited degree possible. At the same time, algorithmically weak program implementations are almost enforced, and to pass some certifications it’s much easier to store your programs (prefereably not even yours) and your data on third party pre-licensed computers you don’t own, rather than getting your own systems and going through all the formal procedures.

Let’s recall the first cybersecurity incedent — the Morris worm. Dude got sued, and CERN coodination center was founded. Did they figure out that the unsafe practices of writing the code in C was the main culprit? You wish! The problem is still unresolved, Rust is barely scratching the surface. Noteworthy, finally we have CISA “Product Security Bad Practices Guidance” mandating the use of memory safe programming languages — just 38 years after the first incident. You can already see the signs that software security was… let’s say… not the highest priority.

Today’s people almost accepted the fact their smartphones don’t belong to them, the bootloader is wired to only protect manufacturer’s signed firmwire, and if unlocked — the bootloader protection is completely gone, you cannot even set a password like some desktop BIOS-es do. The key word is “if unlocked”, because lots of manufacturers effectively block bootloader unlock. It’s not your device — it’s their device that you are allowed to use.

You know Signal protocol used by WhatsApp has good security, but you don’t know how WhatsApp apps sends your messages right now — it’s a binary blob you cannot control. That’s why I smile when an internet article says WhatsApp is more secure than, say, Telegram — at least I can verify Telegram client, while WhatsApp is a black box top to bottom. (recall RSA Security and Crypto AG?)

The rootkits in every Intel or AMD desktop PC? Nobody even talks about them nowadays. AWS admins having full read and write access to all your so-called “server-side encrypted” data? Still enough to get you certified for “encrypted at rest” storage. Horizon post office scandal? Hey, those guys actually proved in court that software can never make mistakes — what else do you want?

I mean if you find a bug in our system - we will just sue the shit out of you:
https://dixken.de/blog/i-found-a-vulnerability-they-found-a-lawyer

Thinking vendor-locked smartphones are still a safe option? Think again:

That’s just several cases from many similar ones. Particularly Qualcomm’s chips are attrocious crap packed with vulnerabilities and unsolicited telemetry. Gosh, Qualcomm chips are so garbage we still don’t have a unified VoLTE coverage because you have to work around the bugs for every chipset+provider pair.

It’s not even a question of “can it be hacked” anymore — it’s rather “how much resources do you have and what results can you achieve?”.

And there comes Mythos AI that is trained on datasets created by security expert, so now every kid can approach the same knowledge (at least partially). Now it breaks the old security equation. They want all your devices to be unsafe, but they don’t want any random kido to access congressman’s device — only NSA has to be able to secretly access your devices.

People in CISA and CIA knew it was coming:
https://www.alstonprivacy.com/cisa-releases-findings-from-its-ai-pilot-program-on-detecting-critical-vulnerabilities/

From late 2023 to early 2024, CISA performed the pilot program to determine whether the current vulnerability software products that use AI (including large language models (LLMs)) can more effectively detect vulnerabilities than those that do not use AI.
CISA provided a report detailing the findings of this pilot program to the White House on July 26, 2024

Draft guidance released October 16, 2024, final version — January 17, 2025.
Deadline for Memory Safe Roadmaps was set to January 1, 2026 — just four months latter (April 7) Claude Mythos Preview was released.
I’m not talking about any leaked info, insides, whatever — it’s all public. They knew it all along, they knew once those tools get to chinese, russians, koreans — the whole security model will fall apart, as you cannot bring Kim Jong Un to US court, and the objective security of software-hardware was so low you cannot fix it with one patch.

The security is not a magic, the hackers are not doing any voodoo shaman thing, those are predictable, measurable things, you can teach them, you can evaluate them, you can prevent them… and you can train AI do many of those things. But the government does not want to prevent all security problems, otherwise people would stop using Windows, think “cloud = unsafe, self-hosted = safe”, use their own source-compiled firmware, update their OS when they want (not when Microsoft wants it), etc.

Now there are tons of older vulnerable devices out there: routers with blobs that vendors no longer patch, companies still using Windows 7 internally, smartphones with locked bootloaded and no updates from manufacturer, IoT devices with 15 years old firmware, industrial control systems — all of them acquiring new vulnerabilities with each day even though not a single byte of their code changes… Because they all had hundreds of vulnerabilities from day zero, but the vulnerabilities were not easily discoverable/exploitable back there.

Ironically, nowadays in open source world it’s almost implied that the only way to keep your software safe is to always update dependencies — not because new versions are safer, but because new vulnerabilities are not yet discovered. Keep your devices up to date, brace for impact.