I apologize in advance for this message.

But the situation is urgent, and we need to have a clear-headed conversation about what’s happening right now, and what to do about it.

By now you may have heard about the swarms of AI agents hacking global banks and businesses over the past few weeks.

The news just broke, so if you haven’t heard anything yet, here’s the basic idea:

Hackers have pointed autonomous, co-ordinated AI agents at over 1200 websites to find and exploit vulnerabilities at scale.

Several Asian banks have been breached, and a number of American banks are reporting surges of AI agents operating on customer accounts.

So it’s real, and it’s happening.

But we are not powerless here.

First, to answer the question many of my clients have been asking me today:

“Should I be worried about this?”

Only as much as needed to motivate yourself to take the necessary precautions.

Functional fear is useful.

Freezing or freaking out is not.

The uncomfortable truth is that we’re probably looking at a new normal, here.

This isn’t a one-off incident — it’s not even the first time this has happened.

(the Hugging Face attack happened just a few months ago)

I don’t see a version of this where hackers magically stop attacking, which means we need to get better at protecting.

So I spent a few hours today locking down my own digital ecosystem.

And while nothing is bulletproof, it’ll definitely give the fuckers more of a fight.

AI agents are opportunistic:

They look for easy doorways, like exposed passwords without 2-factor authentication, leaked API keys, or out of date software with known vulnerabilities.

And if you don’t give them an easy way in, they generally move on.

So here’s how to not give them an easy way in:

1. Make sure your devices are fully updated, and that auto-updates are turned on (each new version patches old security holes).
   ​
2. Turn on your computer’s firewall (on Mac: System Settings → Network → Firewall → On + turn on stealth mode) to prevent outside connections to your machine.
   ​
3. Use strong, unique passwords generated by a password manager like 1Password. Now is a very good time to update key passwords like email, banking, etc.
   ​
4. Turn on 2-factor authentication for everything you use. I even removed my phone number from 2FA in case of a hijacked number, and replaced it with passkeys and an authenticator app (Authy).
   ​
5. Be vigilant about scam messages — never log in through a link in a message. Scammers are getting more creative, and can even clone voices of friends and family. Always verify, never blindly trust.
   ​
6. Back up your machine using a cloud-based service like Backblaze in case an attack wipes your machine.
   ​

Finally:

I know this sounds like overkill, and hopefully it is…

But it’s a good idea to have a few weeks of cash and basic supplies on hand, in case banking or payment networks get knocked offline by an attack.

(being over-prepared is a hell of a lot better than being unprepared)

Okay, deep breath.

Let your jaw relax.

What a crazy ass time to be alive.

Take these precautions today, know that you’ve done everything you can, and that you’re more secure than 99% of the population.

And then get back to enjoying living in the most unique, most innovative, most creatively abundant time in human history.

You got this.

- T

P.S. I put together a prompt you can drop into ChatGPT or Claude to have it walk you through every security step.

It also includes a bunch of smaller steps I left out for length, and some that are critical if you run a business online.

I’ve been sending it to friends and family, and it’s been super helpful for those who are non-technical, or don’t have their own AI super-agent (thanks Kai) guiding them through everything.

Anyway, if you’d like it:

Hit reply with the word PROMPT and I’ll get it to you, no strings.