I’ll Never Forget

THE NUMBER: $400,000. That is the low end of what the 9/11 Commission concluded the entire plot cost to plan and carry out — somewhere between four and five hundred thousand dollars, all in, for the deadliest attack on American soil in history. Hold that number, because it showed up again last week wearing different clothes. A company called Cognition pointed its AI agents at RSA-260, a cryptographic problem that had stood since 2020, and cracked it for about $400,000 in compute. The same method puts the 1024-bit keys still guarding real systems at roughly $30 million and falling. The sum that once bought a catastrophe now rents a skeleton key. Twenty-five years, and the terrible arithmetic of that morning didn’t get better. It got cheaper.

What I saw

I lived in New York City on September 11th, 2001. That morning was crystal clear — literally the perfect New York day — and I was on the phone arguing with an insurance company over a charge when I saw a plane flying low and definitively in the wrong place. I was a bit of a plane spotter back then, and my 40th-story apartment gave me a view of the runways at both Kennedy and LaGuardia, so I knew what the traffic was supposed to look like. This wasn’t it.

I had a dead-on view of the World Trade Center and a Leica spotting scope on my deck, and I bore witness to the attacks. Not on a small TV. Not in the newsreels afterward. Live, with optics good enough that in the minutes before the towers fell I could see the people standing in the openings, deciding how they wanted to die. I’ve thought about that choice more than I’ve ever said out loud — burn, or jump, and if you somehow survived long enough, a hundred stories came down on your head anyway. I’ll leave it there. Twenty-five years later, and it’s not the kind of memory that fades.

We tell each other the lesson of that day was the buildings — that they hit us where the skyline was, that it was about a symbol. It wasn’t. It was the math. Nineteen men and about four hundred thousand dollars took down the two tallest buildings in my city and remade the country for a generation. What broke that morning wasn’t a skyline. It was the old assumption that to wound a nation you had to be a nation. Catastrophe came unbolted from scale. You didn’t need an army, a navy, a flag, or a budget. You needed nineteen people, some box cutters, and less money than a Manhattan apartment cost even then.

We spent the next twenty-five years and several trillion dollars building a security state around that single fact. You can thank those nineteen men for the TSA, for the shoes-off line, for the watch lists and the warrantless everything and the two wars. The whole apparatus is a monument to one lesson learned the hard way: when the barrier to mass harm falls, the people it falls for don’t need to look like a threat. They just need the tool.

The week the calendar made a point

Now look at what landed in my inbox this anniversary week, as if the calendar were making a point I didn’t ask it to make.

On Wednesday, Anthropic published a threat report — a catalogue of people it caught using Claude to do harm, disclosed voluntarily, which is itself notable. I’ve read a lot of these documents in my life. This one had a sentence in it that I had to read twice: “For threat intelligence investigators, sophistication has stopped being a reliable signal of who is behind an operation.”

Sit with what that means, because it is the whole issue in one line. For as long as there has been cyber defense, the tell for a serious adversary was craftsmanship. A clean, patient, multi-stage intrusion meant a state — a Russia, a China, an Israel — because only a state could afford to train and pay the operators who could pull it off. Crude smash-and-grab meant an amateur. The quality of the work told you who you were fighting, and therefore how scared to be. That signal is now dead, and Anthropic killed it with receipts.

Read the cases. A lone actor using the handle “JackPoterz,” whose behavior matched Russian state espionage — the group the trade calls Midnight Blizzard — ran a campaign against more than twenty government and defense targets across Ukraine and Europe, using a custom toolkit of Windows implants, a mobile exploitation kit, a credential stealer, and a phishing platform. When his malware got flagged by security products, the AI agents autonomously modified and rebuilt it to evade detection — the arms race between attacker and defender, compressed into a loop that runs without a human in it. He stole 300,000 national identity records from a North African government along the way, almost as an afterthought.

Two undergraduates in China stood up an automated exploit foundry that produced more than a dozen possible zero-days in a single month, running “agent swarms” — a lead agent dividing the work among parallel subagents, keeping campaign memory between sessions like a real intelligence shop. Criminal affiliates of the ShinyHunters collective dumped 2,100 cloud access tokens across 40 corporate tenants in about 34 hours, and Anthropic’s own words are that “AI agents performed nearly all of the work.” Another crew went from a single stolen developer token to full control of a company’s cloud in roughly three hours.

The tradecraft that used to separate a government from a kid in a dorm room is now a download. That is not a forecast. That is a report on what already happened, between December and August, on the systems of one company that happened to be watching.

The price fell right on cue

And the cost kept falling, right on the anniversary week, as if to underline it.

RSA is the math that quietly secures a great deal of the internet — the handshake behind a lot of what you’d rather strangers didn’t read. Its whole promise rests on one bet: that factoring a big enough number is so expensive nobody will bother. Last week Cognition pointed its Devin agents at RSA-260, a 260-digit number, and the agents rewrote most of the open-source factoring toolchain to run on GPUs — a genuine engineering feat, done largely by the machine — and cracked it in sixteen days for about $400,000 in compute. RSA-250 had stood since 2020. The same method now puts 1024-bit RSA, which is still in service in more places than anyone wants to admit, at around $30 million. That is a rounding error for a state and a stretch-but-doable number for organized crime, and the price of that kind of compute only ever moves one direction.

So here is the shape of it. In 2001, catastrophe came unbolted from scale — you no longer needed to be big to hit big. This week it came unbolted from skill — you no longer need to be good. The two guardrails that quietly protected the world, size and expertise, both fell inside a single human lifetime, and the second one fell this month.

The part I lived

Here’s why this isn’t an abstraction to me, and it’s not the part from 2001.

In 2017 I was hacked. Badly — a state-sponsored quality of hack, pointed at one private citizen who is not important enough to warrant it. They took my Gmail. They took my Apple ID. They ransomed all of it for Bitcoin, and when I refused, they went deeper: took over my home router, went after my Chase account, seized my cell phone account. For a month I fought back hand to hand and clawed control back without a dollar of financial loss — but I changed every account I owned, every password, every phone number, everything I had. I know exactly what it feels like to have a competent, patient adversary decide you’re the target and come through every door at once.

That took real people real weeks. Now read the threat report again and do the math on what the same campaign costs when the operator is an AI agent that never sleeps, never gets bored, rewrites its own malware when it trips an alarm, and coordinates a swarm of copies of itself. What took a skilled crew a month against me is now a prompt. I got a preview, in 2017, of a movie the whole world is about to watch at scale.

The ceiling went up while the floor fell

And here is the part I genuinely can’t shake, the reason I couldn’t let this week pass with a normal issue.

On 9/11, the ceiling was two buildings. Horrific, unforgivable, roughly three thousand souls — and bounded. A building has a top floor. This week, in the same report, Anthropic also disclosed that its biological safety classifier caught five separate attempts to use Claude for biological weapons work. One of them was gain-of-function research on a chikungunya virus — engineering it for greater transmissibility and immune evasion — tied to a military research institute. Another was bird flu. Another was a pipeline for optimizing venom toxins.

A pathogen does not stop at the property line. It does not have a top floor. The floor — the cost, the skill required — is collapsing toward a rounding error, and at the same time the ceiling — the worst thing a single determined person can now reach for — has gone from a skyline to a genome. That is one step from a pandemic, attempted by people a classifier had to stop, this year, using a commercial AI. I watched what nineteen men could do to two buildings with box cutters. I do not want to find out what one man can do to a species with a chatbot and a wet lab.

The one piece of grace

I promised you this got to a point that matters, and here it is, and it is not despair.

The one genuinely hopeful thing in this entire week is buried in the same report: the classifier held. The bioweapons attempts were caught. The accounts were banned. The company found the misuse, disrupted it, told the authorities, and then told the rest of us. Every one of those cyber campaigns I described was detected and shut down by the same lab whose model was being abused. Anthropic’s framing is that it’s arming “society’s defenders,” and for once the corporate line is the important part.

Because the wall was never what kept you safe. Not your firewall, not your password, not the two towers’ steel. What kept you safe, for most of human history, was the other guy’s incompetence — the fact that the person who wished you harm usually couldn’t pull it off. That asset just went to zero. It is not coming back. And once the attacker’s skill is free, the only defense left is on the defender’s side: building the catch into the machine itself, and making the defense move at the same machine speed the attack now moves at. The classifier that caught the chikungunya attempt is not a nice-to-have. It is the entire ballgame. The single most important question in AI safety is no longer “will the model be smart” — it’s “will the watcher be as fast as the thing it’s watching.”

I remember the six weeks after the towers came down, when for one strange and terrible moment this fractious country was actually one country — everyone giving blood, flying the flag, holding doors, meaning it. It didn’t last, and I’ve spent twenty-five years mourning that it didn’t. But the defense this new thing demands is exactly that impulse, made permanent and built into the code: a shared, standing, boring commitment to catch the misuse before it ships, funded and staffed on the days nothing is on fire. We were one country for six weeks. This asks us to be the version of that which doesn’t need a catastrophe to summon it.

We said we’d never forget. What we were supposed to remember was never the towers — it was how little it takes. Build like you believe that.

— Harry