I had gone to Hugging Face for something else entirely. I ended up spending the evening reading the report of the first cyber-intrusion carried out, from start to finish, by an autonomous artificial intelligence. This is the story of that intrusion – but to tell it properly you first have to know what the platform that was hit actually is, how “open” AI models changed the landscape, what autonomous agents are, and why the alignment problem, which seemed like a thing for philosophers, has just become a matter for the incident-response handbook. If you're in a hurry, you can skip straight to the anatomy of the intrusion. But if there's one thing I'd ask you to read to the end, it's the twist: because five days after this case was published, the author of the attack confessed – and it's not who any of us would have bet on.
A few days ago Anthropic released Claude Fable 5 and its older sibling Mythos 5. Frontier, agentic models, able to reason for hours over enormous codebases, to use tools autonomously, to behave almost like a senior software engineer. Fable 5 came out on Tuesday 9 June; by Friday the 12th, after about 72 hours of life, it was already gone. For a few hours – actually, for a few days – it was available to everyone. Then came the silence.
Leo XIV's encyclical Magnifica Humanitas came out on 15 May, and within a week I had already read more or less every possible word of praise. The Catholics of the left (read: catto-communists) celebrated it for its explicit anti-capitalism; the critics of technology (read: techno-sceptics) for its warning against Big Tech; the mainstream press for the pop citations – Tolkien, Beethoven, Schindler's List; even a few self-declared atheists, scattered across social media, tipped their hats at the lucidity with which a Pope names the concentration of computational power in the hands of a few. At the presentation, in the Synod Hall, Chris Olah sat among the speakers – co-founder of Anthropic and head of research on AI interpretability. This is not a detail: it is the signature on a document that wants to be taken seriously even by those who actually build the models. Of praise, in short, I have read enough. I, however, want to do the opposite exercise.
There is an envelope, somewhere in England, bearing the handwriting of a Finnish musician. Inside is a proposal that, told in the abstract, sounds like the joke of a drunk poet: a symphonic metal band asks one of the planet's best-known evolutionary biologists to lend his voice to a twenty-four-minute song about the origin of life.
To understand how two worlds this far apart – the guitar and the ribosome, the double bass drum and the DNA – ended up in the same track, you have to start from a biographical detail almost nobody knows. Tuomas Holopainen, the man who has always written Nightwish's music, studied biology before becoming a full-time musician.
Saturday, 16 May 2026. Tens of thousands of people march through central London behind Tommy Robinson under the banner Unite the Kingdom. British flags mix with Israeli ones and with the flags of the Iranian monarchists of the Pahlavi movement. Wooden crosses are carried on shoulders as a sign of “militant Christianity”. On the heads of middle-aged men, between the flags, the MEGA caps – the English variant of Trump's MAGA – and on a leaflet handed out in the crowd it reads, word for word, “a future for white people”. On the stage Katie Hopkins, a reality TV alumna turned anti-Muslim polemicist, alternates with Sharon Osbourne, Ozzy's widow.
A few months ago I spun up a new VPS on Linode, London datacentre. Nothing special – Debian, Nginx, a Let's Encrypt certificate, a domain I was going to use for my daily notes and my homelab experiments. No link posted anywhere, no entries in my feeds, no backlinks from the sites I run. Just a freshly assigned IP, from a subnet that a week earlier had belonged to someone else.
There are architectures you see and architectures you don't. ARM is the most extreme case of the second category: it runs in the phone in our pocket, in the home router, in the eighty-euro board that serves as a home server for millions of tinkerers, in the datacentres of Amazon and Google. It is everywhere, and almost nobody knows what it is. It took me years too to bring it into focus, and the occasion was a Raspberry Pi 3 that I had decided to turn into a Nextcloud – the first brick of what would become, in the years to come, my small homelab – many years ago. It was a line in /boot/config that made me notice the thing: the Pi's processor, a Broadcom BCM2837, used the same architecture as the Android phones I had hacked for years. ARM. Same instruction set, same underlying logic, same family.
It was an ordinary Friday evening. The parcel had arrived with the courier that morning, but I only opened it after dinner, with that silent ceremony I perform every time new hardware shows up – as if opening a box too quickly were a form of disrespect toward the object. Inside was a HUNSN 4K. Small, almost ridiculously small. A mini PC in a form factor that fit in the palm of a hand. I put it on the table, looked at it. Looked at it again. And then an uncomfortable thought occurred to me. I had ordered it from a Chinese reseller, paid with a credit card, through a completely traceable payment infrastructure, from one of the most centralised and surveilled commercial ecosystems in existence. To build a homelab that would let me escape centralised and surveilled ecosystems.
Do you remember Flash games? The ones that ran in the browser before Adobe decided to kill everything in 2020? I do. There were sites – Miniclip, Newgrounds – that were a kind of uncurated digital playground, pages with black backgrounds and popups everywhere, where you could spend hours without really understanding what you were doing. You complain about brainrot? Maybe you don't remember the nineties web and that girl with the wart singing the polka... Anyway, it was one of those unremarkable afternoons. I don't remember the exact site – one of those places with incomprehensible URLs like “geocities.com/~someone/games” and graphics that hurt your eyes. I stumbled onto something strange. The Adobe Flash logo hadn't even finished loading, there were no instructions, no “Play” button. Just a grid of black and white cells changing, generation after generation, apparently at random.
Tuesday morning, 9 AM. After a routine patching session, a long-standing ZFS storage system running Solaris 11 suddenly stops talking to its Windows 10 clients. The culprit is the usual, maddening SMB dialect dance: Windows pushes for SMB 3 on security grounds, while Solaris's native service struggles through the negotiation. Two days of banging my head against the wall – hard – and then the discovery: OpenCSW. A community that maintains updated packages for Solaris where the vendor long since threw in the towel. Updated libraries, sorted dependencies, problem solved. There are volunteers out there patching critical systems better than the official vendor ever did. Worth knowing.