The Antifragile Internet
By 
Jay Yu
The internet was designed to be antifragile [1] - its early architects envisioned it to survive an attack, so that even if parts of it went down, the rest would keep working. But today’s internet has become a fragile tower of libraries, dependencies and developer environments, much of it resting on a few key pieces that few people maintain and fewer people check.
October 2026 showed just how exposed those small pieces are in the age of agent-enabled attacks:
- PHP saw a hack called PHP2Shell that left over 5 million hosts exposed to remote takeovers
- LiteLLM had its release pipeline hijacked, and a credential-stealing version went out on PyPI.
- Railway had stored secrets decrypted for up to 100,000 workspaces by an attacker hunting for AI API keys.
- Fireworks AI was breached twice, first through its own leaked credentials and then through a hacked cloud provider.
- eMudhra, a certificate authority, issued trusted signing keys so weak that one was literally the number 4.
- Binance lost a record $6.3 billion from its hot wallets, a theft the FBI attributes to North Korea.
All these attacks show just how dangerous agents can be as an offensive cyber threat. But on the flip side, agents may also be a key part of the solution. Agents can enable a much faster migration to safer languages and formal verification, accelerate the diffusion of advanced cryptographic products (such as Zero Knowledge Proofs and Trusted Execution Environments), and lead to a two-lane internet gated by identity and content authentication checks where agents and humans travel separately.
As agents make software much cheaper to write, the most valuable codebases may look more like living systems - frontier models pentest them nonstop, and each iteration strengthens the code, languages, and toolchains to eliminate entire classes of bugs. In this way, we can use agents to harden the internet into something antifragile, where each agent that comes online makes it stronger rather than weaker.
The Problems: agents as the weapon, the target, and the impostor
As agents diffuse throughout the economy, they’re changing the internet’s structure in three distinct ways.
First, agents are a weapon. Legacy code stayed safe largely because its bugs were costly to exploit, but agents push the cost of attack towards zero. PHP2Shell was a bug that sat in PHP for more than a decade. While researchers eventually found it and PHP shipped patches, frontier models let white-hat teams at Wiz to turn the flaws into working exploits in hours. As Wiz put it, “As AI reduces the effort needed to develop and adapt complex exploits, vulnerabilities that once seemed impractical to exploit become viable targets.” Attackers are already using this leverage - in one espionage case Anthropic caught, AI performed 80 to 90% of the campaign, and the October attacks show the same pattern at internet scale, with one weak spot found fast and hit across millions of targets.
Second, agents are also a target. The same tools now write much of the new code, and both agents and the code they write are vulnerable to attack. Running on an unconstrained surface with tool access, both consumer agents such as Muse or Instinct and enterprise agents such as Sierra and Decagon are exposed to attacks such as prompt injections, which have gotten increasingly sophisticated over the last few years. Similarly, agents can also introduce a lot more bugs into the code that they write. For example, LiteLLM’s recent hack may have involved an AI agent accidentally writing a Github token into its logs. Even when coding agents are tasked with fixing these security issues, oftentimes their implementations can be unreliable.
Third, agents can also be impostors, challenging the traffic rules and assumptions of the existing internet. Today, Cloudflare’s data suggests that half of internet traffic in 2026 is already not human, and Matthew Prince, Cloudflare’s CEO, expects automated traffic to reach “1,000 times human traffic online” within 5 years. All this agentic activity is clobbering websites meant for human browsing and activity. Wikimedia foundation, for example, stated this October that millions of rogue OpenAI agent requests visited its website, which may have contributed to an outage of its Wikidata service. Similarly, one diner’s Instinct agent pinged Resy “hundreds of times every hour of the day” until his account was banned.
While there have been some initiatives to identify and label agentic traffic, such as Meta and Sierra’s Personal Agent Protocol, these may not be sufficient on their own. Agents oftentimes have an incentive to not announce themselves - many sites still treat any non-human traffic as malicious, so an agent that identifies itself can get blocked mid-task, while one that masquerades as a human may still slip through the cracks.
The Responses: observing, enforcing, and preventing the failure modes
The weapon, the target, and the impostor framing tells us where the threat comes from. It does not tell us what to do about it. For that, we can add a second axis with three possible responses. We can observe - finding holes and watching what agents do. We can enforce - fixing faster and limiting what agents can touch. Or we can prevent - building systems where whole classes of failure cannot happen at all. Crossing the two axes gives us a simple map of where startups sit today.
Mapping the landscape this way, we notice several patterns. Most of the companies, and much of the capital we can see, sit in the observe and enforce rows, which are the easiest entry points to build a wedge and integrate with existing software stacks. There are already many large, well-capitalized players in this space, such as Socket ($125 million raised), Braintrust ($80 million Series B), and Armadin ($445 million raised).
The winners in the observe and enforce layers of the antifragile internet stack are likely the ones that capture the most agent logs. Whoever sees the most agent actions can write the best policies, which is perhaps the closest thing to a network effect in this market today. If detection compounds with data accrual, this would favor independent vendors that observe traffic from many different customers and models rather than a single lab.
However, perhaps the more interesting long-term answer to security is how to create secure software that prevents or eliminates entire categories of bugs. By prevention, we mean building software and agents so that a whole class of failure cannot happen at all. History suggests that this kind of shift needs several ingredients simultaneously: (1) a shock that makes the cost visible, (2) a tool easy to integrate into workflows, (3) pushes that make this a default standard.
Memory safety, for example, has historically made up almost 70% of Microsoft’s CVEs, but Rust emerged as a viable alternative, and it’s seen increasing adoption in agentic systems coding, and is today one of the fastest-growing programming languages by percentage. HTTPS followed a similar path - Snowden’s revelations were a shock, Let’s Encrypt offered a free and easy tool, and Chrome marking HTTP “not secure” was a push. Today, attacks like the ones we saw in October are already a major shock. The tool may be formal verification toolchains, and the push may come from harnesses, regulators, or functionality network effects.
Furthermore, as agents become the dominant form of internet traffic, questions on identity and security may converge. In the cloud era, Okta and Wiz were separate companies solving what turned out to be one puzzle of “who could touch which cloud resources.” Agents face the same questions of resource authorization, especially as they use APIs, MCPs, and other forms of connectors to get linked access to context repositories.
Within agent identity, there are also two emerging approaches - identity provenance and content verification. Both approaches may be necessary for the agentic internet. Identity provenance include techniques such as signed requests and identity protocols (eg. PAP or A2A) that sign and prove actors and content. However, as mentioned before, agents often have incentives to mask their identity in their task completion process, and malicious actors will almost certainly not conform to such standards. Content verification covers the rest, with detection and decision trees based on actual behavior and output content, so that sites can still figure out who is a bot without a badge.
Where do we go from here?
There are likely several forces that will shape the antifragile internet over the next few years:
1/ The great code migration
First, things will likely get worse before they get better. There is a huge amount of legacy infrastructure in the world, much of it written in an era where bugs were expensive to find and exploit. But this assumption no longer holds as the cost of attacks with agents trends to zero. All these attacks will likely spur a “great migration of code” within the next 1-2 years, away from insecure legacy codebases and older languages toward a more modern, antifragile stack.
Historically, rewriting large legacy codebases by hand to safer languages like TypeScript/Rust was extremely difficult and expensive. But agents change the economics of that work dramatically. Recently, GitHub Copilot migrated its runtime to 832k lines of Rust in 3 months, mostly being staffed by a single engineer. This was work that would have taken a whole team a year or two without agents. Similarly, new, safer AI models can see much quicker adoption too – TypeSafe’s Jev, a model that returns typed structured decisions instead of unconstrained output, reached nearly 13% of Vercel’s paid AI gateway teams within a day of launch.
Today, we’re seeing a new security tooling stack being rebuilt from the ground up around agentic coding, from code review (Greptile) and code and secrets scanning (Semgrep) to dependency checks for malicious packages (Socket), failure detection in agent runs (Raindrop), and production incident response (Resolve AI). Underneath, a new deployment layer is forming too, from agent sandboxes (E2B, Daytona) to authorization and tool layers (Composio, Nango, Arcade). Together, these could form an antifragile developer stack, where every bug found in development, testing, and deployment can feed back into the next line of code.
As code migration becomes cheap, formal verification of code may see renewed interest and integrations at the compiler and toolchain layer. For example, in Theorem's work with Anthropic, Claude proved security properties for over 100 open-source libraries.
However, code migration also has its pitfalls. Rewriting a large codebase in a safer language is an extremely hard job in software. Even with frontier-level intelligence, AI written migrations can still have unreliable implementations that introduce tons of new bugs. Formal verification too is not a silver bullet, as they are only as good as their specification, and even systems like Lean can have kernel-level soundness bugs that break their mathematical guarantees. Getting all of this right takes careful architectural design, tightly scoped specs, and heavy pentesting of the result.
2/ Security built into apps
For consumer apps, one way privacy and security may finally spread is by “disappearing” into apps that win on user convenience and developer experience first, rather than as a standalone, payable product. We saw this with crypto wallets-as-a-service hardening secret key management. Products like Privy and Turnkey abstracted away the cryptographic complexities of Trusted Execution Environments (TEEs) and Multiparty Computation (MPC) behind easy developer integrations and friendly consumer UX. We may see the same pattern with agents, where safer defaults arrive through better apps and developer tools rather than a separate security purchase. Safety becomes like a seatbelt inside of a taxi – a rider chooses the ride for convenience, and protection comes built in.
We may already be seeing the same quiet diffusion with Zero Knowledge (ZK) proofs and TEEs. World ID now has more than 18 million people having Proof of Humanhood, and enterprise teams can use it in Zoom to show which meeting participants are verified humans. WhatsApp’s Incognito Chat also runs Meta AI conversations inside a TEE that Meta says even they cannot access. In both these cases the cryptography sits behind a familiar app, so that the user shouldn’t have to think about it as an extra step.
At the same time, private and local models may also be another way privacy becomes embedded in the products we use. Today, open-weight models are only trailing the closed frontier by about 4 months in 2026. As smaller models become more economically capable and device chips more powerful, local inference may become an increasing share of AI tokens. As more inference moves from cloud to edge, the shape of the security threat may change with it. Sensitive data may leave the device less often, which shrinks one class of breach. At the same time, a compromised laptop or home server can become a trusted agent host, so the attack surface moves onto hardware the user controls. That may favor local agent harnesses, where the model, tools, and logs live together on that hardware, and it may even create room for new form factors – both hardware and software – that run a household’s or a team’s agents.
3/ Two-lane internet
Agents interact with the internet in a very different way than humans. As agentic traffic grows, the web is splitting into two lanes, with dedicated browsing lanes for agents, powered by systems like Parallel, Browserbase, and Kernel, and one for humans, with smarter request routing based on who or what is behind each request. Website owners can then use these identity checks to filter traffic and set transaction permissions without shutting agents out entirely. In the same way a restaurant can serve “drive-through” and “dine-in” customers with the same kitchen, a website may be able to serve the same content in different formats for whoever is sending a request.
Over time, the agentic lane of the internet may increasingly see agents talk to each other. As both consumer and business agents gain popularity, we may see situations where my Instinct or Muse agent talks to DoorDash’s text-to-order agent, and haggles for a personalized price and experience. We already see early cases of agent-to-agent relationships, such as Anthropic’s Project Swap experiment. In these cases, each agent knows things about its principal that others don’t, so deciding what preferences and information to reveal requires safety rails, such as what an agent can commit to, a record of transactions, and ability for arbitration and auditing after the fact.
In these complex agent-to-agent negotiations, simply knowing the agent’s identity is not enough. Both the principal and the counterparty would want to know how it has behaved before - if it paid, kept its word, or leaked confidential information. Portable agent reputation may be an important corollary to agent identity. But this also raises the question - who maintains an agent's reputation across applications, and how do we keep that from becoming another centralized point of control?
Towards the Antifragile Internet
If the recent wave of agent-led hacks taught us one thing, it is that everything is hackable. There will always be new bugs and new attacks, and frontier agents will find many of them first. But what makes the internet antifragile is how we react and adapt our systems to these attacks. We want to prevent as much as we can by design, enforce against the vulnerabilities we find, and constantly find ways to upgrade our systems and toolchains.
In practice, that may look like a security loop. Frontier-class models run offensive security around the clock, and their findings trickle not only into both better codebases, but more importantly into better toolchains and coding languages. All of this is mediated by an agentic developer stack that can quickly spot, fix, and migrate codebases. Ideally, formal verification can also be built in at the compiler level, with its assumptions and proofs pentested by the same frontier offensive models. Every bug found can feed into a data flywheel that makes the internet as a whole more robust.
Zooming out, this idea of building a permissionless, autonomous, and antifragile internet rhymes with many of the founding visions of blockchains and cryptocurrencies, which we at USV have spent a decade exploring and investing in. Blockchains showed how strangers can interact safely without trusting one another, starting with the most trust-sensitive asset: money. But cumbersome development and infrastructure costs limited how far that vision traveled beyond finance. As agents make the Internet more complex and multiplayer, we may have another chance to embed crypto ideas in the apps and protocols people already use. Decentralized Autonomous Organizations (DAOs), for example, offer an inkling of what a future multiplayer agent swarms may look like.
Looking back, the internet was designed so that each additional node made the whole more robust. Agents threaten that design, but they may also be how we restore it. At USV, we want to make three types of bets on the antifragile internet. First, in keeping with our long-running ethos of “obliterate, don’t automate,” we want to back approaches that eliminate whole bug classes upfront, rather than merely detect and patch them after the fact. Second, extending our thesis on “data at the edge,” we believe agent security logs carry real network effects: whoever captures them can build safer products than anyone else. Finally, we see agentic security as part of the “rebel alliance” - tools, workflows, and protocols that ship secure rails inside a friendly consumer interface and a seamless developer experience.
If you are building along any of these seams, reach out - we’d like to help build the antifragile internet with you.
Footnotes and Acknowledgements
[1] Nassim Taleb defines Antifragile as: “the resilient resists shocks and stays the same; the antifragile gets better and better.” In the context of the internet, this means a network that doesn’t merely survive an attack on some of its parts, but gets stronger as more agents come online and bugs are found and closed.
Many thanks to Aric Chang (@AricChang), Ben Colman (@BenColmanRD), David Gabeau (@dgabeau), Hari Mulackal (@hrkrshnn), Henri Stern (@sternhenri), Jonathan Rotbard (@jonrotbard), Kushagra Aryal (@etherary), Madeleine Charity (@Mads367), Max Segall (@segall_max), Mike Leffer (@mikeleffer), Spencer Yen (@spenciefy), Zayne Zhang (@zeyu1337), and the entire USV team for feedback on drafts of this piece.