An opinion essay published on September 12, 2026 at Marcus on AI by Gary Marcus, Nathan Hamiel and Zack Korman. It responds the same day to "We Must Pace the Frontier", and specifically to that essay's estimate that within 6–12 months an agent swarm comparable to the one in the OpenAI–Hugging Face incident "could be capable of taking over the entire internet with a persistent botnet." It is the first published substantive objection to that forecast.
Marcus is Professor Emeritus at New York University and founder of Geometric Intelligence. Hamiel is Senior Director of Research at Kudelski Security and the AI, machine learning and data science track lead at Black Hat. Korman is chief executive and co-founder of Embroidery, an agent monitoring and detection platform. The two guest co-authors are security practitioners, and the technical objections are theirs; the essay carries no data of its own and is a position to attribute rather than evidence.
What the essay is arguing against
The authors' first move is to separate the claim as reported from the claim as written. The essay opens by quoting an Axios post of 10:41 a.m. ET on September 12, 2026 — "Dario Amodei warned in an essay that swarms of rogue AI agents could take over the internet in as little as six months from now" — and immediately qualifies it: "Or at least Axios thinks he thinks so," and "But in fairness also not exactly what Dario said." The "six months" the title asks about is the news framing's compression of the essay's 6–12 month range. The authors call the six-month element "silly" but offer no counter-forecast of their own.
They also object that the claim is unfalsifiable as stated: "Taking over how? To do what?"
Four objections
Feasibility. The authors argue the internet's architecture makes the claim close to nonsensical. They grant that Cloudflare, Google and Amazon Web Services have outsized effect, so that many applications fail together when those fail, but hold that simultaneous compromise is highly unlikely and that the internet would continue, impaired, even then. They note that all three are far better defended than the average site, and cite what they describe as a UK AI Security Institute report on Anthropic's Mythos, rendered as the model being able to "autonomously compromise [only] small, weakly defended vulnerable systems." The bracketed qualifier is the authors' interpolation, and the essay neither links the report nor says which Mythos release it assessed. The report is AISI's April 13, 2026 evaluation of Claude Mythos Preview (Our evaluation of Claude Mythos Preview's cyber capabilities (UK AISI, April 2026)), whose published sentence reads that the model is "at least capable of autonomously attacking small, weakly defended and vulnerable enterprise systems where access to a network has been gained." The essay's rendering diverges in four ways that run in the same direction: compromise replaces attacking; enterprise is dropped, widening the subject from corporate networks to systems generally; the network-access precondition is dropped, though it is the condition under which the result was obtained; and the interpolated [only] converts AISI's floor into a ceiling. AISI separately states it "cannot say for sure" whether the model could attack well-defended systems, because its ranges lack active defenders and alerting penalties — an absence of evidence rather than the finding of limitation the essay draws on.
Motive. "Why would anyone do this?" If the internet were fully down, the authors observe, it would be down for the attackers too.
Economics and coordination. Attackers have budgets and goals. The authors put the cost of an operation on this scale at many millions of dollars, ask who pays for it, and doubt that stolen victim resources reach the required scale. They add that how the attacking agents would coordinate at that point "seems kind of absurd when you look at the details," and conclude that Amodei "has not really thought this through."
They press the point through the botnet analogy the essay uses. Conventional botnets are assembled from compromised machines on other people's networks and are used for denial of service, spam and phishing; a botnet of frontier-model agents raises the question of where the models run. If each agent requires its own frontier model, the authors write, it is unclear how that occurs "without extreme negligence on the part of the labs themselves."
Responsibility. The essay's sharpest objection is not about capability. Since, as the authors put it, no one has frontier AI but Anthropic and OpenAI, Amodei's warning amounts to "maybe we will REALLY mess up" — and if that happened, "we really ought to shut them down for sheer negligence." Developers "should be able to guard against their own software being abused in this way, or they shouldn't make it available."
What the essay grants
Roughly a third of the text concedes the underlying concern, and the concession is part of the argument rather than a courtesy.
The authors write that Amodei's warning "should serve as a reminder that, for decades, many companies have been getting away without putting an appropriate amount of emphasis on cybersecurity." Google, AWS and Cloudflare are hardened; many sites are not, leaving "quite a bit of low-hanging fruit." Their prediction is that many individual sites will be attacked even though the internet itself is very unlikely to crumble.
They also hold that the economic barrier is a present condition rather than a permanent one. An operation of the kind described would currently be "insanely expensive" and probably cloud-only, which they treat as a defensive asset: cloud and model providers should have monitoring sufficient to catch an attack at that scale, "especially post the Hugging Face incident," and a data center that can be identified can in the last resort be shut down. But "as models get optimized and local hardware improves, more and more devious things will be feasible without going out to giant data centers."
The closing sentence is a policy position rather than a dismissal: the argument is "more reason to restrict any AI that cannot be closely monitored, and more reason to ask why we are allowing all these hard-to-control agents out onto the internet in the first place."
Provenance and limits
Self-published on Marcus's Substack; captured complete September 14, 2026. The decentralization argument leans on a 2019 Gizmodo survey of expert opinion, whose quoted material appears in the essay only as screenshots and is therefore not recoverable from the page. The byline reads "Zack Korman" while the author biography reads "Zach"; the byline spelling is used. Confidence is medium: the essay's own content is established, but its load-bearing empirical citation — the AISI finding on Mythos — is quoted in altered form, and the alterations are documented against the primary text at Our evaluation of Claude Mythos Preview's cyber capabilities (UK AISI, April 2026).
Relationships
- contradicts: We Must Pace the Frontier (Amodei, September 2026) — disputes the 6–12 month internet-takeover estimate, though the authors first dispute the news rendering of it and grant the underlying concern about poorly defended sites
- related: Gary Marcus — lead author
- related: Autonomous cyber-agents
- related: Agentic AI
- contradicts: Our evaluation of Claude Mythos Preview's cyber capabilities (UK AISI, April 2026) — the essay's quotation of this report converts its stated capability floor into a ceiling
- related: UK AI Safety Institute (AI Security Institute) — source of the capability finding the essay quotes second-hand
- related: Anthropic
- related: OpenAI