Frontier lab CEOs now talk about the internet the way weather presenters talk about a hurricane: give it six to twelve months, stay indoors, hope the safety models catch up. Dario Amodei told the industry this week that AI could soon lead a swarm of agents capable of taking over the entire internet, so cybersecurity teams should wait. Cute. Microsoft spent the same news cycle counting more than a million CEO-fraud emails fired through someone else’s delivery pipes in two days, plus a second crew walking into cloud tenants with passkey-themed social engineering and walking out with data.

The pause is a press conference. Your tenant is already the range. Anyone selling you a quiet half year before agent swarms matter is asking you to ignore the part of the story that already scales: rented senders, identity UX employees are still trained to trust, and playbooks that still open with a perimeter ticket.

This cybersecurity timeout is a vendor fantasy

Amodei’s warning is easy to meme and hard to staff. A swarm that “takes over the internet” is a lab-scale sentence. On your side of the wire it means parallel operators that mint sessions, move mail, hit admin APIs, and exfiltrate faster than a human analyst can narrate a ticket. That future is a capacity problem. Capacity problems do not wait for a safety roadmap to ship.

You have heard this genre before. Slow down so the guards can catch up. Nice for a keynote. Terrible as a budget line. Safety work inside a model lab does not revoke a stolen refresh token, does not kill a rogue mail connector, and does not notice that finance just approved a wire because the “CEO” mailed them from a lookalike path that passed SPF on a vendor you never reviewed.

Treat the six-to-twelve-month clock as intelligence about attacker parallelism, not as permission to idle. If a coordinated agent mesh can someday point itself at every exposed admin plane on the public internet, the useful question is which of those planes you still treat like furniture. Entra. Google Workspace. The help desk reset flow. The SaaS app that can mint OAuth grants for the whole company. Your “cyber security” program already owns those. The lab does not.

Defense in depth here is unglamorous. You assume the model gets smarter. You assume the operator, human or not, can send a million well-formed messages. You assume some users will complete a “security upgrade” they did not request. Then you design so that success still dumps them into a small room: no mailbox forwarding, no consent to a random OAuth client, no standing privileged role, no quiet path from a help-desk chat into Global Admin.

A million CEO emails already did the load test

Microsoft’s two campaigns are the rehearsal tape for the swarm speech. One crew abused third-party email delivery infrastructure and masqueraded as chief executives, blasting more than a million financial-fraud messages between August 3 and 5, 2026. The other used passkey-themed social engineering to hijack Microsoft cloud accounts and exfiltrate data. Different lures. Same industrial shape: scale purchased from someone else’s pipes, trust borrowed from a brand employees already fear ignoring, identity treated as the payload.

You do not need a frontier model to do this. You need a sending platform, a plausible executive, and a tenant that still treats “please enroll this security key” as an IT chore instead of a privilege-granting event. Brute-force against a modern cloud login is the loud, dumb cousin. These crews skipped the lock-picking soundtrack. They asked the user to hold the door, or they asked a mail gateway to vouch for a CEO who does not exist.

That is a bad look for every vendor that spent two years telling you phishing dies when passwords die. Passkeys are a better authenticator. They are also a new story attackers can tell. If your threat-protection stack still scores “failed password spray” as the identity crisis and files “user added a passkey” under hygiene, you will miss the part that pays.

Notice the infrastructure, not just the lure. Third-party delivery is a privileged control plane you probably onboarded for newsletters and invoices. Once a fraud crew can ride it, your users see authenticated-looking executive mail. Your firewall never gets a vote. Browser to SaaS is the path. Threat detection that lives on the packet edge is watching the wrong door while Graph, Outlook, and SharePoint do the actual theft.

Shrink the blast radius while they debate the calendar

Buy the time on your side of the wire. Immediate work is identity-shaped, because that is what both the swarm warning and the Microsoft write-ups actually touch.

• Inventory every role that can enroll a passkey, reset MFA, add a mail connector or forwarding rule, consent to an OAuth app, or export a mailbox. If that list includes “most of IT plus a vendor,” cut it this week.
• Treat third-party senders as privileged infrastructure: disable unused connectors, require aligned SPF/DKIM/DMARC, and alert when lookalike executive mail lands in finance or HR at burst volume.
• Cap user consent. Privileged roles get phishing-resistant MFA plus short sessions. New device, new passkey, new inbox rule, and mass Graph download should page someone, not sit in a weekly digest.
• Pre-stage session kill: refresh tokens, app grants, mailbox rules, and transport rules on one runbook so incident response does not start with a screenshot of the login portal.

Ongoing security hardening looks like rehearsing parallel operators, not writing another acceptable-use memo. Once a quarter, pull identity logs as if a swarm already has three valid sessions and a sending domain. Ask which exports completed, which admin roles were eligible, and which mail path would have looked legitimate to a human. If the answer is “we would notice the firewall,” you failed the drill.

Keep hunting for burstiness. A million messages in 48 hours is a detection signature even when each message is individually boring. So is a cluster of passkey enrollments, a spike in consent grants, or a help-desk queue full of “IT told me to upgrade my sign-in.” Your threat detection should score those as the same family: industrial identity abuse. Tune for volume and privilege change, not for a malware hash that will never arrive.

If your IR still opens a firewall ticket first

The real problem here is tempo. A swarm, or a human crew with a sending platform, wins when your incident response still begins at the network edge. By the time someone correlates a proxy log, the mailbox is forwarded, the files are in a personal cloud, and the passkey the user “enrolled for IT” still unlocks the tenant after you reset the password.

Flip the order. Identity first: revoke sessions, disable the new authenticator, yank OAuth grants, inspect transport and inbox rules, then worry about hosts. Mail next: which connector, which vendor, which domain authenticated the CEO costume. Hosts last, unless you have evidence the operator dropped a payload. Most of these jobs never needed one.

Brief your executives without the movie plot. They will hear “AI takes over the internet” and ask for a tool. Tell them the load test already ran in August: a million executive mails in two days, plus cloud theft dressed as a security upgrade. Tell them the control is fewer people who can change login methods, fewer vendors who can send as the company, and an IR team that can burn a session in minutes. That is how you survive a swarm that may or may not arrive on Amodei’s calendar.

Labs can argue about pauses. You still have a tenant to run. Spend the next six months cutting blast radius, not waiting for someone else’s safety team to finish.

Sources

• Anthropic CEO Dario Amodei Says AI Industry Needs to Give Safety Measures Time to Catch Up
• Attackers Use Passkey Phishing to Hijack Microsoft Cloud Accounts and Exfiltrate Data