AI Security Is Repeating the 1990s Worm Era Before Defenses Catch Up
Investor Martin Casado says defenders can outspend attackers, and will likely find a fix again.
Invest Like the Best with Patrick O'Shaughnessy · Martin Casado on Frontier Model Economics, AI's Slowdown, and the Cursor Deal - [Invest Like the Best, EP.498]In the 1990s, Martin Casado remembers, you could take a computer with Windows 95, connect it to the internet, start the installation, and find it infected before the installer was done.
Casado is a technology investor who studied computer security and says he lived through that early internet period on the ground. By that point, self-spreading worms had caused billions of dollars in economic damage and taken out critical infrastructure.
He thinks the current wave of AI-related breaches is another one of those moments. Each time a new technology changes how computers are run, security falls behind, and the industry faces a few years of mayhem.
That mayhem includes breaches that cause real problems. But his expectation is that the industry will then evolve, as it did after the early internet.
His test is whether defenders can spend more than attackers. If they can, which is typically the case, they will develop a practical answer.
He points to the vulnerabilities now coming to light as an encouraging sign. Their appearance means somebody used an AI model to spot the weakness and make things safer.
The eventual payoff, in his view, is software that ends up far safer because AI also helps defend it. First comes the chaos of the Windows 95 era, then comes the cleanup.
Questions people ask
Why was an unprotected Windows 95 machine infected so quickly?
In the 1990s and early 2000s, many home computers connected directly to the internet with little blocking of incoming traffic, and early versions of Windows left network services exposed. Automated worms constantly scanned for vulnerable machines, so an unpatched computer could be found and compromised in minutes.
Which early internet worms caused the most damage?
Famous examples include the ILOVEYOU worm in 2000, Code Red and Nimda in 2001, and SQL Slammer in 2003. Estimates vary, but several caused billions of dollars in cleanup, lost productivity, and business disruption, and some slowed banks, airlines, emergency systems, and internet traffic itself.
How is AI changing both attacks and defense today?
Attackers use AI to write phishing emails, find software bugs, and automate intrusions, which increases the volume and speed of attacks. Defenders use the same technology to scan code, detect unusual activity, patch systems, and sort through security alerts far faster than people could alone.