A System That Improved Our Lives
The digital world has raised living standards in ways that now feel routine. Access to financial services, communication, and information is faster and more flexible than ever. Many of the constraints that once defined daily life have been removed.
The risks used to be different. Most threats were tied to physical presence. A criminal had to find you, confront you, and act within a limited window. That imposed natural limits on both scale and frequency.
A digital presence changes that. It allows anyone, anywhere, to attempt to access your identity, your accounts, or your money. AI extends that reach further.
When Anthropic introduced its Mythos model, it reported that the system could identify and exploit zero-day1 vulnerabilities across every major operating system and web browser that they had missed for decades. That is a different kind of signal than the breaches people have grown used to.
Most of us assume our data has been taken at some point. That has not led to a fundamental change in behavior, largely because we assume institutions built on top of that infrastructure can protect us when it matters.
AI places pressure on that assumption. Some speculate that AI bot swarms may soon emerge, drawing on the idea of drone swarms, where coordination was once difficult but later solved. There is little reason to assume that similar coordination challenges in the digital world will remain fixed.
What It Feels Like in Practice
Over the last 10 years, I’ve experienced several intrusions into my bank accounts, and what stands out is how differently they presented.
A fraudulent check was used to steal money from my account. My phone was SIM-swapped, which led to stolen credentials and money was moved without my authorization. Identity information taken in earlier data breaches was used to impersonate me at a bank branch, where withdrawals were taken over several days, even after I reported the first theft. And in another case, there was no breach at all. I was on the phone, believed I was preventing a fraud, and instead authorized the transfer myself.
Some of these were clearly crimes as they happened. Others became clear only in hindsight. Some traced back to earlier compromises I never saw. Others depended entirely on what I did in the moment.
The Role of the Institution
In the first three cases, the bank reimbursed the losses, presumably because the fraud was a failure on their side rather than mine. But the bank provided no detail about what had occurred nor how I could protect myself going forward. The underlying vulnerability remained.
The last case did not follow that pattern. There was no reimbursement, and the system functioned as designed. What it made clear is how difficult it is to protect yourself against professional deception, even when you are aware of the risk.
A Broader Pattern
A similar dynamic appears in the emerging alternative financial system based on blockchains. The Mt. Gox collapse remains one of the most visible examples, but it is not unique. Exchanges have failed for different reasons, assets have been mismanaged, and users have lost access through mistakes or compromised credentials. When recovery does occur, it often reflects the cash value of assets at the time of bankruptcy rather than the tokens themselves, which in the case of FTX (and others) had risen by multiples by the time customers were repaid.
In these cases, access is disrupted, value is altered or lost, and the outcome depends on who is able or willing to absorb the loss.
A Question of Scale
For a long time, the system has operated on the assumption that losses remain manageable. Financial institutions can handle fraud on an individual basis, and governments can provide last-resort backstop when necessary. That assumption has held even through periods of stress, including the 2008 financial crisis and the failure of several U.S. banks in March 2023, because the system has been able to contain the impact.
AI improves the ability to identify and exploit weaknesses, and it does so in ways that can be repeated and amplified exponentially. Techniques that once required effort can be deployed automatically, and social engineering becomes dangerously effective if it can be customized and delivered at volume.
A Structural View of Security
I began to understand these risks more clearly after learning how Zach Herbert, CEO of Foundation, envisions digital security. Foundation is a sponsor of Exploring Prosperity, which reflects my belief that their approach is worth studying.
The tools for securing digital access, identity and assets exist today, but they don’t fit together in a way most people can realistically use. Security-focused individuals must assemble a system piece by piece. A password manager for logins. An authenticator app for codes. A hardware wallet for crypto. A security key for certain accounts. Maybe some form of offline storage. Each component addresses a specific risk. This causes friction and costs add up.
Roughly 70 percent of users express interest in self-custody, yet only a small fraction, closer to 2 percent, actually use it. Most people must rely instead on institutions and infrastructure to manage that complexity.
The gap between what is possible and what is practiced remains large.
Their conclusion is that security hasn’t failed technologically. It has failed structurally.
Foundation’s answer is to simplify that system by combining them into one device. Hardware wallet, two-factor authentication, security keys, encrypted storage, and seed management are handled in a single device. Its potential is boosted by being open-sourced and therefore available for app development by the developer community.
Clip from the full interview below: Passport Prime summary
Where This Leaves Us
For decades, highly capable attackers have refined their methods while institutions have absorbed losses and maintained trust in the system. That arrangement has worked because those losses have remained contained.
AI introduces the possibility that they may not remain contained. As that changes, the assumption that institutions can fully protect users becomes less certain.
Individuals do not need to become experts, but they should take a more direct role in securing their digital lives.
Whether the structure surrounding these systems can hold as the environment changes is the relevant question. If it does not, responsibility shifts with it.
Full interview with Zach Herbert, CEO Foundation.
Thank you very much to our sponsors:
Foundation: Secure your digital life—from passwords, 2FA, files and Bitcoin with Passport Prime, an all-in-one personal security platform. Visit them at https://foundation.xyz/
Truflation: BUY Truflation products/services and save 10% using code BOBDEW10. Learn about what prices are actually doing by going to https://truflation.com/marketplace/us-inflation-rate
River Financial: If not cold storage for your Bitcoin, I’d highly recommend River for buying and holding- River is engineered to protect your Bitcoin over the long run. Use this link for discounts: https://river.com/signup?r=T7GGAF7G
A zero-day vulnerability is a software or hardware security flaw unknown to the vendor, leaving them "zero days" to fix it before attackers exploit it.