The Internet Is No Longer for Humans

Special thanks to Zayne Zheng (@zeyu1337) from Hacktron and Robert Chen (@NotDeGhost) from Ottersec for feedback and review.

Cybersecurity is at an inflection point: people are uncovering critical vulnerabilities at an accelerating pace, October brought a wave of major breaches, and online traffic from AI agents continues to grow. We are forced to acknowledge that the internet’s current security regime, which was built on the assumption that attackers are human, is obsolete in the face of AI.

In this piece, we look at what recent major security breaches revealed and explain how agents break the internet’s human assumptions. We then cover what needs to be rebuilt for an agent-centric web, why that rebuild creates new attack surfaces, and why teams like Hacktron are uniquely positioned to secure those new surfaces.

What October Revealed

The number of known software vulnerabilities is exploding. Each publicly disclosed flaw gets an ID called a CVE, and in September alone, 14,939 new CVEs were published to NIST’s National Vulnerability Database, nearly four times the 2025 monthly average. From January through September, new CVEs rose 106% from a year earlier, after growing 7% to 37% a year since 2019. They are also getting more severe: Critical and High CVEs grew 161% and now make up more than half of new records.

Source: Village, Reported software flaws have doubled. Exploited ones haven’t. (October 15, 2026), using data from NIST’s National Vulnerability Database

Then came October, one of the worst months in cybersecurity history. In the span of about a week, PHP, the programming language that powers WordPress and much of the web, shipped emergency fixes for two critical flaws, GitLab patched a maximum-severity flaw that had gone unnoticed across 12 years of its releases, and OpenAI disclosed a critical flaw in Brotli, a compression library built into Node.js and many other widely used tools. Any of them could have let an attacker run commands on a vulnerable server without a password, then steal data or take over the machine. Had any been exploited at scale, the fallout could have rivaled some of the largest cyberattacks on record.

Brotli also shows how fast AI can turn a disclosure into an attack. Soon after it was announced, security researcher Robert Chen said an AI agent built a working Node.js exploit on its own in about five hours, and it succeeded against 50 of 50 test targets with ASLR, a standard memory protection, turned on.

Source: Robert Chen (@NotDeGhost), X post

A series of other vulnerabilities led to real breaches this past month:

• ConnectWise: Microsoft says Storm-0940, a China state-aligned group, used an open-source AI hacking tool to break into the Microsoft 365 accounts of ConnectWise customers, part of a campaign against hundreds of organizations.
• Cairn: a researcher watched one hacker use another open-source AI tool to break into more than 100 companies.
• California schools: a stolen login exposed records on millions of public school students, including their disability status.
• Japan: the government declared a cybersecurity emergency on October 9 after more than 20 major companies reported attacks that exposed tens of millions of pieces of customer data. Then on October 20, GMO’s Onamae.com cloud desktop service said malware may have been planted on up to 26,739 customer servers.
• Zeabur: attackers stole data on 321,810 accounts from the developer hosting platform, causing the company to shut down.
• LiteLLM: an AI tool with about 23 million weekly downloads briefly shipped a release laced with password-stealing malware.
• Railway: attackers accessed customers’ stored secrets on the developer platform, some of them decrypted, and Railway told every user to rotate their secret keys.

Although frightening, these attacks are not heralding an impending cyber Armageddon yet. They do, however, serve as a warning of just how fragile the internet’s defenses are against increasingly capable AI.

Meet Hacktron

Prototype is a strategic investor in Hacktron, which builds AI agents that act as autonomous pentesters: they hunt for vulnerabilities in software, confirm which ones can actually be exploited, and help fix them.

In September, the Hacktron team published a detailed report on how it hacked into OpenAI’s codebase. The attack started with a flaw in libheif, an image-decoding library reachable through image uploads on OpenAI’s community forum. Chained with a flaw in OpenAI’s single sign-on, it gave the team control of OpenAI employees’ ChatGPT and Codex accounts. To prove access without viewing anything sensitive, the team used an employee’s Codex to open a harmless pull request in OpenAI’s internal code repository. The whole chain, from first finding to proof, took less than 72 hours.

The exploit was the culmination of HEIF Heist, a two-month investigation that traced the same image library through Slack, Meta, GitHub Enterprise, and popular web frameworks such as Next.js. Hacktron has also found flaws in OpenAI’s Atlas and Perplexity’s Comet AI browsers, turned a single click on a malicious issue into code execution through GitHub Copilot’s agent mode, shown how the desktop AI assistant Cluely could be turned into malware, and found CVE-2026-1731, a critical (9.9 out of 10) no-login flaw in widely used remote-support software.

Hacktron stood out to us because the team deeply understands the craft of finding vulnerabilities. As AI models improve, anyone can spend more on compute, so a bigger budget alone is not a lasting edge. The edge is the expertise that guides that spending. Hacktron’s researchers think like attackers. They form strong hypotheses about which parts of the attack surface to probe first, they know which small flaws can be chained into a full compromise, and they hunt for variants of bugs that have already been patched. That expertise points their compute at the places most likely to break, which raises their odds of finding vulnerabilities. If any team can grasp the inflection point cybersecurity now faces and build products to defend against these exploits, we believe it is Hacktron.

Agents Break the Internet’s Human Assumptions

Prototype invests in frontier technologies that amplify individual agency. In our Investment Thesis, we argued that by making intelligence widely accessible, AI expands what individuals can build, automate, and monetize.

But this agency cuts both ways. The same tools that could allow a random teenager in Ohio to ship a company over a weekend could also allow him to pull off sophisticated exploits that once took a team of specialists. Hacktron described the dilemma well in one of its early essays: where insecure systems once scaled with human talent, “the number of insecure systems will soon scale exponentially with the number of GPU cores.”

In other words, the internet is at an inflection point: anyone with the right AI tools can now go after vulnerabilities that were once too difficult or time-consuming to exploit.

Human Friction as a Hidden Security Layer

Most of the internet’s defenses assume a human is on the other side. Passwords assume a person remembers a secret, CAPTCHAs exist to prove you are human, and rate limits assume no one can try a thousand requests a second. These controls worked because they made attacks slow and expensive, not because the code was airtight. Hacktron describes this dynamic well: “Software has long benefited from a kind of security through complexity… This was never a real security boundary, but it protected ordinary companies in practice.”

Now, agents remove that protection in three ways:

• Obscurity no longer protects old code: C and C++libraries that decode images and parse documents were too hard to audit to be worth attacking.Hacktron’s HEIF Heist shows what that hid: one image library sat under so many products that a single malicious picture became a path into very different companies.
• Attacks are getting cheaper: Hacktron reports that HEIF Heist, which reached Slack, Meta, and GitHub, took three researchers about two months and cost less than $3,000 in compute costs. The hacker behind October’s Cairn campaign also broke into more than 100 companies through a similar amount.
• Patches are exploit hints: defenders used to have time between a public fix and the first real attacks. Citing CISA and VulnCheck data, Hacktron says the median time-to-exploit has gone from 1.5 years to -18 hours, because models can read a fix and work backwards to the bug. PHP2Shell is the clearest recent example: Amazon saw exploitation attempts four days before PHP’s fixes shipped.

Put simply, a meaningful share of the internet’s security was never a lock, but a long obstacle course. Humans eventually get tired, but agents do not. Or in Hacktron’s words: “If your defense in depth is to make attackers’ life harder then it doesn’t work anymore.”

Rebuilding the Internet for Agents

If human friction no longer works as a defense, the answer is not more friction. Our friend Jay Yu at USV made the case well this week, calling for an “Antifragile Internet” built for the agentic era, with “more cryptographic verifiability, identity protocols, rule-enforcement, and other security primitives that eliminate bug categories rather than simply patch them.” In other words, we need to completely rethink the internet and rebuild it for agents.

The Agents Are Already Here

AI is already one of the fastest-growing sources of traffic on the web. In its 2026 State of AI Traffic & Cyberthreat Benchmark Report, HUMAN Security found that AI-driven traffic (training crawlers, scrapers, AI agents, and agentic browsers) nearly tripled over 2025, peaking in October at more than 3.5 times its January level. Agents grew fastest of all: traffic from AI agents and agentic browsers rose 7,851% year over year.

Source: HUMAN Security, 2026 State of AI Traffic & Cyberthreat Benchmark Report (Human Defense Platform telemetry, 2025)

That traffic is also highly concentrated. According to HUMAN, OpenAI’s bots (ChatGPT User, OAI-SearchBot, GPTBot, and ChatGPT Agent) account for about 69% of observed AI-driven traffic by volume, Meta-ExternalAgent for another 16%, and Anthropic’s ClaudeBot and Claude-SearchBot for roughly 11%. The dozens of other identified bots make up less than 5% combined. As the report puts it, “access policy decisions about a handful of AI companies have outsized effects on an organization’s overall exposure to AI-driven traffic.”

Those figures describe 2025, and agentic volume is almost certainly higher today. Cloudflare’s view of the broader web shows where that growth is heading: bots already outnumber people.

Source: Cloudflare Radar, Bot vs. Human worldwide (share of HTTP requests to HTML content), October 17–24, 2026

Over the past week, 65.1% of requests for web pages across Cloudflare’s network came from bots, and only 34.9% came from people. One caveat is that Cloudflare defines a “bot” as any automated request, not just an AI agent; though it is an imperfect measure of agents, it still shows that the web’s main audience is already software. As agents take on more shopping, booking, and account management, we expect them to make up a growing share of that bot volume.

Financial institutions are already struggling to keep up. In a Fingerprint survey, 95% of financial leaders said automated traffic had increased over the past year, and Axios reports that major banks are detecting unauthorized AI agents inside customer accounts, with Morgan Stanley, JPMorgan, Bank of America, and Citi now restricting third-party agents.

What Needs to Be Built

Today, agents have no front door of their own. They pretend to be people: they log in with a user’s password, work through dashboards built for human eyes, and try to get past CAPTCHAs, cookie banners, and robot checks. For an agent, most of these are ineffectual defenses; rather, they cause confusion by leaving companies unable to tell a real customer from that customer’s agent.

To reconfigure the internet to accommodate agent-majority traffic while preserving security, we should consider the following measures:

1. A real front door for agents

Stable APIs instead of screens, machine-readable lists of what an agent is allowed to do, and scoped, short-lived credentials instead of a full account login (obviously an agent booking a meeting should be able to read a calendar without also being able to send a wire transfer).

These changes are already starting to occur. Anthropic’s MCP gives agents a standard way to connect to tools and data. Sierra’s draft Personal Agent Protocol, Poppy, lets users approve exactly what an agent can access and requires that “the personal agent identifies itself, so the company always knows when an agent is acting for a customer.”

Logins, checkout, forms, and payments should also be rebuilt as agent-native rails: typed, schema-checked protocols rather than scraped web pages. Hacktron’s research on bypassing web application firewalls (WAFs) shows why. When a WAF parses a request differently from the application behind it, attackers can slip through the gap, and filtering alone struggles to close it. Scraped web pages and bolted-on filters share that weakness while a typed, schema-checked protocol closes it by giving both sides one strict definition of what is valid.

1. Identity that traces back to a person

A person proves their identity once, either with a passkey or a zero-knowledge proof. They then hand an agent a narrow, time-limited set of authorizations, and that agent can delegate smaller sets of authorizations to other agents. Every step leaves a record of provenance: which human, which agent, under what policy, acting on what inputs.

Having a proper flow of provenance and delegation of permissions can help companies determine whether the agent in a customer’s account is authorized or rogue. It also limits how far a single compromise can travel. In Hacktron’s OpenAI research, a flaw on a community forum became access to employee ChatGPT and Codex accounts because of a single sign-on issue. As Hacktron noted, “If any first-party or third-party OpenAI service using the OpenAI SSO was compromised, it would lead to same access.” In a rebuilt identity layer, no single surface should be able to grant access to everything.

1. Engineering that removes whole classes of bugs

Rather than patching bugs one at a time, the goal is to design systems so that entire categories of flaws cannot occur at all. HEIF Heist is the clearest case: one native image library sat under so many products that simply accepting an upload became a path to running code on the server.

Shared parsers like this should be treated as critical infrastructure: written in memory-safe languages, run in a sandbox separate from any process that holds secrets, pinned to known versions, and attacked continuously.

The same goes for known bugs. Hacktron’s variant hunting turned up new critical flaws in OpenAM, Ivanti, and BeyondTrust software alongside bugs that had already been patched, and it believes the internet is full of “incomplete patches, missed siblings, slight variations of known vulns that just never got the human attention.” When one bug ships, its relatives should be hunted automatically.

1. Security for agents themselves

Agents that hold email, browsers, code repositories, and money need sandboxing, defenses against prompt injection, and runtime controls that assume an agent will eventually be tricked and limit the damage. By default, an agent should not be able to reach a raw shell or a private network. AI browsers and coding tools need hard sandboxes rather than “helpful” allowlists, and high-impact actions like moving money or pushing code should always require a human’s approval.

Hacktron’s research on PostHog shows the cost of getting this wrong. A headless browser that PostHog ran with its sandbox switched off became, with a known browser exploit written by an AI model, a path into a production worker with database access. Once inside, the Hacktron team was able to see database credentials, encryption keys, and API secrets stored in plain text, enough to reach PostHog’s production database.

Conclusion: Security's Sisyphean Task

Agents are already the web’s main audience, and rebuilding the internet around them will take years. Every new agent-native front door, identity layer, and agent runtime is new code that someone will attack, and every fix can open a new weakness. None of it can be trusted until it has been battle-tested, and then tested again.

New attack vectors will always emerge, so security is never a finished job. With the gap between a fix and an attack shrinking toward zero, annual penetration tests and noisy scanners cannot keep up. Defenders need continuous, autonomous red-teaming built into the software pipeline itself, proving what is actually exploitable on every code, infrastructure, and dependency change before an adversary finds it.

That is why Hacktron is well suited to a job that never ends. The same offensive skill that finds those bugs is what the rebuild will need to keep testing agent identity systems, rails, and sandboxes as threats continue to evolve. As compute gets cheaper for attackers and defenders alike, the advantage goes to teams that know where to aim it.