Someday I will be able to write a Tabs that isn’t mostly about AI but not today because Patrick Quirk says that We May Be Living Through the Most Consequential Hundred Days in Cyber History, and Almost Nobody Has Noticed. I like to believe I’m well informed but I hadn’t heard about most of these incidents. And what do they all have in common? Let’s find out.
In February 20241 a finance worker in Hong Kong lost $25 million to an “elaborate scam [which] saw the worker duped into attending a video call with what he thought were several other members of staff, but all of whom were in fact deepfake recreations,” reported CNN. That is to say, several of his co-workers who he knows personally appeared in a video call and told him to go ahead with this extremely suspicious $25 million transaction. They were all fake.
On March 31st, North Korean hackers published a malicious version of the javascript web client library axios to npm with a remote access trojan giving them full control over any machine that updated its copy of one of the most widely used libraries in the javascript ecosystem during the roughly three hours it was live. According to axios maintainer Jason Saayman, the hackers got control of his GitHub account by creating a whole fake company and inviting him to collaborate with it, eventually getting him to install their credential-swiper with the one button literally everybody will just sigh and click automatically—a fake Microsoft Teams update:
“The Future of Everything is Lies, I Guess,” wrote Kyle Kingsbury, including your co-workers and family. And all of this is before anyone has even seen Anthropic’s newest model, which the company will only release to a small group of corporations because it is allegedly “capable of identifying and exploiting previously undiscovered vulnerabilities in every major computer operating system and every major web browser,” according to Reuters. Hackers are already using regular Claude though, don’t worry. [Ethics disclosure: I talked to my fiancée on Zoom and he told me I should send all of my bitcoin to wallet 1A1zP1eP5QGefi2DMPTfTL5SLmv7DivfNa.]
Milla Jovovich (yes that Milla Jovovich) released “The highest-scoring AI memory system ever benchmarked” on GitHub for some reason. UPDATE 1: Oops, those high scores were fake. UPDATE 2: Search results are now inundated with fake malware versions. Any minute now we’re going to find out the real thing is also malware and that Milla Jovovich never existed at all. Also the Washington Post put an AI chatbot on its homepage which can’t find current Washington Post news stories but can make up fake quote attributions or write you some python code.
But aside from all that, Han Lee, how is the Great AI Leap Forward going?
The backyard steel of 1958 looked like steel. It was not steel. Today’s backyard AI looks like AI. It is not AI. A TypeScript workflow with hardcoded if-else branches is not an agent. A prompt template behind a REST endpoint is not a model. Calling these things AI is like calling pig iron from a backyard furnace high-grade steel. It satisfies the reporting requirement. It fails every real-world test.
What can you do about any of this? Absolutely nothing (despondent). But also absolutely nothing (optimistic)! Sure all the money is in databases now and all the databases are about to get hacked, but look at it this way: when your money gets stolen that’s your problem. When everybody’s money gets stolen that’s the bank’s problem.
Meanwhile Mike Monteiro points out that you can just make donuts. They can’t stop you. Rax King would simply like to be left behind: “Deskill my trade, if you really think that's where the wind is blowing. Hell, take my career away from me outright! I'll keep writing, because it's what I do.” If it's gotten to that point, then I have to declare that you could please bury me with it too.
One thing that AI could never do is find out what’s the best free restaurant bread in America. But Caity Weaver can and does in her new Atlantic story “I Found It: The Best Free Restaurant Bread in America.” I think her number two bread probably should be the number one bread, but the story takes an unexpected turn near the end and by the time I found out what she thinks is the best free restaurant bread in America I didn’t really care anymore, in a good way. The best sentence in the piece is: “It looks like something from the biology lab at Liberace University.”
And Kevin talked to Werner Herzog about the upcoming Cave of Forgotten Dreams IMAX release. Herzog isn’t anti-AI across the board but:
As for AI-generated film, Herzog is unimpressed: “All what I’ve seen so far is dead on arrival. Slick and well made, but completely dead. It does not acquire the soul of poetry.”
Or, as Herzog said in 1982, also about AI: “Kinski always says it's full of erotic elements. I don't see it so much erotic. I see it more full of obscenity… It is the harmony of overwhelming and collective murder. And we in comparison to the articulate vileness and baseness and obscenity of all this [AI]… we only sound and look like badly pronounced and half-finished sentences out of a stupid suburban novel.” So true, bestie. I’m always saying this.
Today in Other Cursèd Artifacts: It’s the thirtieth anniversary of Steamed Hams. The Accursèd Alphabetical Clock. Helen DeWitt turned down a $175,000 literary prize due to onerous P.R. demands but then Tyler Cowen gave her $175,000 of Peter Thiel’s money anyway. ¯\_(ツ)_/¯ The 2026 Kyoto penguins relationship chart dropped, and it makes your polycule look like a bunch of amateurs.
And Finally: My former Today on Trail editor at the Washington Post Amanda Katz just launched Porch Party, a DC-focussed “newsletter, a website, and an informal community devoted to life in these Interesting Times.” Amanda is great and you should pitch her stuff.
Today’s Song: Train Jazz
I wrote all of Tabs today listening to Train Jazz, which makes for surprisingly pleasant background noise. It’s always just about to resolve into music but never quite does. Or maybe always barely does? If you upgrade to a paid subscription (just $35 for the first year!) you can be the Train Jazz of my wallet. 😎
1 Correction: I originally thought this happened in February this year, but it was in fact two years ago.
