The takedowns started quietly, the way infrastructure failures usually do. A handful of sites went dark, then a few hundred, then enough that status pages and social feeds filled with the same confused question: is it down for everyone or just me? The culprit, according to reports circulating around the incident, was not a distributed denial-of-service attack or a ransomware crew. It was a vulnerability discovered by an AI system, one serious enough that operators chose to pull services offline rather than risk exploitation. Early coverage described the flaw as affecting something on the order of seventy percent of the internet, a figure that sounds like hyperbole until you remember how much of the web rests on a surprisingly small stack of shared libraries, protocols, and open-source dependencies.
That number deserves scrutiny. “Seventy percent of the internet” is the kind of phrase that spreads faster than the technical details behind it, and the details are usually messier. What such claims typically mean is that a widely deployed component, or a common configuration pattern, is implicated across a huge share of sites. It rarely means every site is equally exposed. Still, the reaction itself is telling. Operators did not wait for a fully verified exploit or a patch they trusted. They made a judgment call under uncertainty, and that call rippled outward to users, businesses, and anyone whose work depends on a particular portal staying online.
The more interesting story is how the flaw was found. Automated vulnerability scanning is not new; fuzzers and static analysis tools have been chewing through code for years. What has changed is the capability of AI systems to reason across large codebases, spot subtle patterns, and generate plausible attack paths that human reviewers might miss or take months to connect. Security researchers have increasingly described large language models as a way to scale formal verification and code auditing, and this appears to be a real-world demonstration of that shift. The uncomfortable corollary is that the same capability is available to people who want to find flaws for less noble reasons. If an AI can spot a dangerous bug, so can someone else’s AI.
That symmetry is what makes incidents like this a turning point rather than a scare. For years, the security industry has operated on a quiet asymmetry: defenders had to be right every time, attackers only once. Automated discovery tools threaten to collapse that asymmetry in both directions at once. Defenders get faster at finding their own weaknesses. Attackers get faster too. The net effect depends less on the technology than on who adopts it first and how quickly patches move through the long tail of systems nobody thinks about until they break.
There is also a governance problem that the takedowns exposed. When an AI flags a critical flaw, who decides whether to disclose it, and when? The responsible disclosure norms that grew up around human researchers assume a certain pace and a certain chain of custody. A machine that can surface thousands of potential issues in days strains those norms. Vendors need time to patch. Operators need guidance. Users need to know whether they should change a password, avoid a service, or simply wait. None of that coordination happens automatically, and the vacuum gets filled by rumor and worst-case headlines.
Then there is the economics. Big platforms can afford to spin up incident response teams and absorb downtime. A regional bank, a hospital portal, a municipal service, or a small e-commerce shop cannot. If AI-driven discovery becomes routine, it will widen the gap between organizations with mature security operations and everyone else. The state-level efforts to protect workers and small institutions from AI disruption are a recognition of this, even if policy tends to lag the technical reality by years.
The honest read is that this is neither the apocalypse nor a footnote. It is a preview. AI is going to make software vulnerabilities more visible, faster, and more numerous. The organizations that treat that as a reason to invest in patching discipline, dependency hygiene, and clear incident communication will come out ahead. The ones hoping the problem stays theoretical will keep getting surprised by a status page that suddenly turns red.