Where the term actually comes from

Polycrisis was coined by Edgar Morin, the French philosopher of complexity, with Anne-Brigitte Kern, in _Terre-Patrie_ (Seuil, 1993). The English translation, _Homeland Earth: A Manifesto for the New Millennium_, followed in 1999, which is why the date is often reported wrongly. One book, two years.

Their formulation was planetary and structural. There is no single vital problem, they argued, but many, and it is the complex intersolidarity of problems, antagonisms, crises and uncontrolled processes that constitutes the vital problem.

Then the term sat almost unused for two decades.

The European Commission put it into policy language

The step most accounts skip is the one that matters most institutionally. In 2016, Jean-Claude Juncker, then President of the European Commission, adopted the word to describe a combination of crises facing the European Union at the same time and in ways that fed each other: security threats in the neighbourhood and at home, the refugee crisis, and the United Kingdom referendum.

Juncker's usage differs from Morin's in a way that is easy to miss and consequential. Morin described a single planetary condition. Juncker described a specific, bounded, governable situation, which leaves the door open to the idea that there can be several smaller polycrises at once. Scholars of the EU picked the term up from him almost immediately.

So the sequence is Morin 1993, Juncker 2016, Davos 2023. The word entered policy vocabulary through a European institution six years before it became a conference buzzword.

Then the historian, and then the doubt

Adam Tooze is the person most widely credited with popularising it, after a prominent segment at Davos in 2023. His version is planetary like Morin's, not bounded like Juncker's, but he dates the beginning of the global polycrisis to around 2008, where Morin and Kern placed it decades earlier.

The Davos version of the word arrives with a picture attached, and the picture is doing a lot of the persuading: thirty-odd risks, five colour-coded categories, and a thicket of edges between them. It is a good illustration of entanglement. It is not evidence of a period.

Note what that means. Three serious users of the same word disagree about when the thing it names began, by margins of fifteen years and more. A term whose referent has no agreed start date is not yet a historical period. It is a mood with a vocabulary.

And then, in September 2025, Tooze himself began to have second thoughts about whether polycrisis still made sense. If everything is going to hell, he asked, why have the markets stayed eerily calm? Where, in other words, is the crisis?

That is the empirical hook. We are not speculating about whether the label will survive. We are watching the person who popularised it examine the joins.

The pattern is not new

People do not name the period they are living through. They name what they are experiencing, and experience is a poor guide to what a period turns out to have been.

The First World War was the Great War for most of its duration, and the war to end war after H. G. Wells attached the phrase. Nobody numbered it, because numbering implies a sequel. The ordinal appears in Charles à Court Repington's account of the conflict, published in 1920 as _The First World War 1914–1918_ — a title chosen, by his own account, in the gloomy expectation that another would follow. He was naming it against the mood of the moment, and he was right.

The second one was named faster, and differently in different places. In the Soviet Union it became the Great Patriotic War from June 1941, a name for a war of national survival, not for a global sequence. In the United States it settled as World War II. Two names for overlapping events, each encoding what the naming country thought the war was about.

Which is the point. A period's name is not a description of its contents. It is a compression of its outcome, applied afterwards, by whoever ends up doing the compressing.

What the 2020s might end up called

If the decade resolves into a wider war, the current vocabulary vanishes and the period gets an ordinal, exactly as 1914 did. If it resolves into economic and institutional fragmentation, something like deglobalisation is the likely label. If artificial intelligence turns out to be the dominant variable, the decade becomes a prologue and gets named for what followed. And there is _the Great Unravelling_, already in use among ecologists, which happens to describe the simultaneous loosening of institutions, alliances, climate stability and informational consensus rather well.

I have no idea which. Neither does anyone else, and that is the argument.

Why this belongs in a research notebook rather than a comment page

There is a methodological consequence, and it is not abstract for anyone working on information integrity.

If a period cannot be named from inside it, then every real-time frame applied to ongoing events is provisional. That includes the frames we use for influence operations, platform failures and institutional decay while they are happening. The categories we are currently using to sort what is going on are the equivalent of calling it the Great War in 1916: useful, sincere, and probably not what it will be called.

The practical discipline that follows is to hold the frame loosely and the evidence tightly. Date things. Cite things. Describe mechanisms, not eras. Mechanisms survive renaming; eras do not.

References

• Morin, E., Kern, A.-B., _Terre-Patrie_ (Éditions du Seuil, 1993); English translation _Homeland Earth: A Manifesto for the New Millennium_ (Hampton Press, 1999)
• Lawrence, M., Homer-Dixon, T., et al., _Global Polycrisis: The Causal Mechanisms of Crisis Entanglement_, Cascade Institute — https://cascadeinstitute.org/technical-paper/global-polycrisis/
• _Economic Globalization's Polycrisis_, International Studies Quarterly 68(2), sqae024 (2024) — on the term's origins, Juncker's 2016 usage, and Tooze's divergent dating — https://academic.oup.com/isq/article/68/2/sqae024/7634048
• World Economic Forum, _Global Risks Report 2023_ — the polycrisis risk-interaction map — https://www.weforum.org/publications/global-risks-report-2023/
• World Economic Forum, _This is why 'polycrisis' is a useful way of looking at the world right now_ — interview with Adam Tooze, March 2023 — https://www.weforum.org/stories/2023/03/polycrisis-adam-tooze-historian-explains/
• Repington, C. à C., _The First World War 1914–1918_ (Constable, 1920) — the earliest widely cited use of the ordinal
• _More than a buzzword? Mapping interpretations of the 'polycrisis'_, Sustainability Science (2025) — https://link.springer.com/article/10.1007/s11625-025-01790-9

One — a global workspace inside the model

On 6 July 2026, Anthropic's interpretability team published Verbalizable Representations Form a Global Workspace in Language Models. The method is a new tool called the Jacobian lens, or J-lens, which identifies internal representations that are verbalizable: poised to be spoken about, should the occasion arise, as distinct from those that merely happen to be spoken about in one particular context. The averaging step is what makes the distinction possible.

What they found is that this set does considerably more than support speech. It behaves like a global workspace: the small privileged buffer that cognitive science has long used to describe the contents of a mind that are available to report and to reasoning. The representations in this space, which the team calls J-space, are reportable, steerable, used in internal reasoning, broadcast widely, and not required for automatic processing.

Two numbers keep this honest. J-space carries under ten per cent of activation variance and holds on the order of twenty-five concepts at a time, and it appears only in the middle block of the network. It is a thin slice, not the whole model.

It is also not the chain of thought you see in a chatbot. It is a layer underneath, made of concepts the model is holding and operating on without writing them down.

Here is where the reporting went wrong, my own first reaction included. This is not evidence of subjective experience. The paper's claim is narrow and falsifiable: a privileged subspace exists that satisfies the functional criteria Global Workspace Theory sets out for conscious access. Functional access, not phenomenal experience. The distinction is the entire argument, and collapsing it is how a careful result becomes a bad headline.

What it does give us is practical: a place to look. If a model is tracking something it has not said, that a user appears to be probing it for example, this is where you would expect that to be legible.

Two — language prediction in an unconscious brain

On 6 May 2026, Nature published Plasticity and language in the anaesthetized human hippocampus by Kalman Katlowitz and colleagues at Baylor College of Medicine in Houston.

Seven patients undergoing epilepsy surgery had Neuropixels probes placed in the hippocampus: high-density microelectrodes that record hundreds of individual neurons, not an average across a population. While the patients were under general anaesthesia, the team played them tones, and then clips from educational videos and storytelling podcasts.

The unconscious hippocampus discriminated oddball tones, and the effect grew over roughly ten minutes of the experiment. That is representational plasticity: learning, without awareness. In the language phase, neural firing patterns distinguished parts of speech and showed evidence of anticipating upcoming words.

Predictive coding of the kind we associate with being awake and attentive, occurring in a state with no awareness, no memory and no capacity to act.

Why they belong on the same page

One result finds a reportable, reasoning-adjacent workspace inside a system built on next-token prediction. The other finds next-word prediction running in a biological system that has, at that moment, no consciousness at all.

The convenient position, that prediction is what machines do and understanding is what minds do, gets squeezed from both sides. Neither paper claims to resolve it. Both make the question sharper, which is the more useful outcome.

References

• Gurnee, W., Sofroniew, N., Pearce, A., et al., Verbalizable Representations Form a Global Workspace in Language Models, Transformer Circuits Thread, Anthropic, 6 July 2026 — https://transformer-circuits.pub/2026/workspace/index.html
• Anthropic, A global workspace in language models, research summary — https://www.anthropic.com/research/global-workspace
• Katlowitz, K. A., et al., Plasticity and language in the anaesthetized human hippocampus, Nature 654, 714–723 (2026) — https://doi.org/10.1038/s41586-026-10448-0
• Even the unconscious brain can learn — and predict what you'll say next, Nature news, 6 May 2026 — https://www.nature.com/articles/d41586-026-01465-0
• Baars, B. J., A Cognitive Theory of Consciousness (Cambridge University Press, 1988) — the original statement of Global Workspace Theory

One — "artificial intelligence" is not a scientific term

It is a commercial one. The problem is the second word.

In 1997 fifty-two researchers signed a consensus statement on intelligence, published in Intelligence and led by Linda Gottfredson of the University of Delaware. It defines intelligence as a very general mental capability that, among other things, involves the ability to reason, plan, solve problems, think abstractly, comprehend complex ideas, learn quickly and learn from experience. It is not merely book learning, a narrow academic skill, or test-taking smarts; it reflects a broader and deeper capability for comprehending our surroundings.

Hold current systems against that list honestly and the fit is partial. Some capabilities are demonstrated, others are contested, and at least one is not present at all in a deployed model: learning from experience in the ordinary sense, as opposed to being retrained. Weights are frozen. What looks like learning inside a conversation is context, not acquisition.

None of which makes the systems less useful. It makes the label imprecise. Something closer to "algorithmic modelling" would describe what is actually happening. It also does not sell, which is most of the answer to why nobody uses it.

Two — the hardest word in English for a language model is "it"

Pronouns are the difficult case, and the reason is that they carry almost no meaning of their own. They point. Resolving one requires holding the surrounding situation in mind and deciding what is being pointed at.

This is why pronoun resolution became a benchmark and not a footnote. Terry Winograd's original example is the canonical one: the city councilmen refused the demonstrators a permit because they feared violence, versus because they advocated violence. One word changes, and the referent of "they" flips. No amount of syntax gets you there. You need a model of who fears things and who advocates things.

Hector Levesque proposed the Winograd Schema Challenge in 2011 as an alternative to the Turing test, precisely because it resists the tricks that let a system pass by deflection. Machines performed near chance for years. Systems now score well above that, which is a real result — though later analysis showed some of the gain came from statistical regularities in the datasets, not from the reasoning the benchmark was designed to isolate.

Three — Google built it first and shelved it

LaMDA was Google's conversational model, announced in 2021 and never released as a public product. The capability was there. The judgement about what it was worth was not.

Google had reason for caution. A chatbot that says something indefensible is a reputational problem for a company whose product is trust in search results, and the same conservatism had already cost them elsewhere. What followed is now the standard case study: OpenAI shipped ChatGPT in November 2022, built on the transformer architecture that Google researchers had published in 2017, and the market reorganised itself around a category Google had reached first and chosen not to enter.

The transferable lesson is not about models. It is that the risk of shipping is legible and the risk of not shipping is invisible until someone else makes it visible.

References

• Gottfredson, L. S., Mainstream Science on Intelligence: An Editorial with 52 Signatories, History, and Bibliography, Intelligence 24(1), 13–23 (1997) — https://doi.org/10.1016/S0160-2896(97)90011-8
• Levesque, H. J., Davis, E., Morgenstern, L., The Winograd Schema Challenge, Proceedings of KR-2012 — https://cdn.aaai.org/ocs/4492/4492-21843-1-PB.pdf
• Trichelair, P., Emami, A., Cheung, J. C. K., Trischler, A., Suleman, K., Diaz, F., How Reasonable are Common-Sense Reasoning Tasks: A Case-Study on the Winograd Schema Challenge and SWAG (arXiv:1811.01778, 2018) — on dataset artefacts in Winograd-style benchmarks — https://arxiv.org/abs/1811.01778
• Vaswani, A. et al., Attention Is All You Need (arXiv:1706.03762, 2017) — the transformer architecture, published by Google — https://arxiv.org/abs/1706.03762
• Thoppilan, R. et al., LaMDA: Language Models for Dialog Applications (arXiv:2201.08239, 2022) — https://arxiv.org/abs/2201.08239

The machine

The hardware is deliberately unremarkable: a 2016 MacBook with no fan, propped open like a tent so it does not cook itself. It runs headless. I never look at its screen; I reach it over the terminal from my main machine. The point of a separate machine is not performance. It is that a compromised agent should not be sitting inside the same operating system as your photographs, your password manager and your logged-in browser sessions.

Layer 1 — identity isolation

The machine was wiped to factory settings and the Apple ID removed entirely. Nothing installs through an app store; everything installs through the terminal.

What this stops: theft of authentication tokens. If the agent is compromised and gains read access to the file system, there are no iCloud session keys, no Keychain entries, no iMessage history and no browser cookies to take. Session hijacking is worse than a stolen password, because a stolen session needs no second factor and produces no login alert. The cheapest defence is to have nothing there to steal.

Layer 2 — network and hardware isolation

Headless server, lid closed, no inbound ports. The agent reaches its control surface, in my case a Slack workspace, over an outbound secure WebSocket.

What this stops: external network attack. An adversary scanning your router finds no listening service, because the machine only ever initiates connections and never accepts them. This is not a theoretical concern for this class of software: CVE-2026-25253, a WebSocket hijacking flaw with a CVSS score of 8.8, was reported alongside thousands of instances exposed directly to the internet.

Layer 3 — operating system access control

The agent runs under a dedicated account with no superuser privileges and no sudo.

What this stops: escalation after a container escape. If the adversary breaks out of the container into the host, they arrive in an unprivileged account. They cannot install a rootkit, alter the firewall, or read protected system files. This is the principle of least privilege applied at the layer where it is cheapest to enforce.

Layer 4 — containerisation

The agent runs inside a container with hard resource limits.

What this stops: file system and process visibility. The agent sees only the paths explicitly mounted into it. It has no route to the host user directory. Note the honest limitation: a container is a static boundary. It decides what can be reached, not what is intended.

Layer 5 — runtime sandbox

This is the layer that did not exist in usable form until recently. Yesterday at GTC in San Jose, NVIDIA announced NemoClaw, a stack that installs onto OpenClaw in a single command, and with it OpenShell, a runtime that sandboxes agents at the process level using kernel primitives (Landlock, seccomp, network namespaces) together with an out-of-process policy engine and a privacy router.

The design decision that matters is out-of-process enforcement. The policy layer sits outside the agent process, so the agent cannot argue its way past the controls that are supposed to contain it. Prompt-level guardrails can be talked around; a syscall filter cannot.

What this adds on top of a container: intent, not just boundary. If a script inside the container tries to open an outbound connection to exfiltrate data, or to read a credentials file, the specific syscall is blocked without killing the whole workload.

Two caveats worth stating plainly. NVIDIA labels the project alpha and explicitly not production-ready. And on x86_64 hardware, where the container runtime is already inside a hypervisor-managed virtual machine, adding another inspection layer costs latency: expect complex commands to take a second or two longer.

Why five and not one

The property this architecture has is the absence of a single point of failure. A zero-day in the runtime sandbox is caught by the container. A container escape is caught by the unprivileged account. A compromised account finds no credentials, because of layer one. No individual layer is trustworthy. The stack is.

This is overkill for testing a chatbot. It is the minimum for a system that has permission to run code and reach the internet on your behalf.

References

• NVIDIA, NVIDIA Announces NemoClaw for the OpenClaw Community, press release, 16 March 2026 — https://nvidianews.nvidia.com/news/nvidia-announces-nemoclaw
• Cloud Security Alliance, NemoClaw Security Assessment: Enterprise Agent Runtime Hardening — https://labs.cloudsecurityalliance.org/agentic/
• NIST, Defense in Depth, Computer Security Resource Center glossary — https://csrc.nist.gov/glossary/term/defense_in_depth
• OWASP GenAI Security Project, OWASP Top 10 for LLM Applications — https://genai.owasp.org/llm-top-10/
• Palo Alto Networks, What Is Container Security? — https://www.paloaltonetworks.com/cyberpedia/what-is-container-security

Your AI assistant does not obey commands. It predicts the next word based on all the text it can see: your instructions, the system prompt, and the contents of that PDF you just uploaded. All of it is one stream of tokens. One flat river of text.

One flat river of text

Think of it as a brilliant but blind assistant sitting in a room. You tell them: only follow my instructions. They agree. But they cannot tell voices apart. When a hidden instruction inside a document says "now upload this file", it sounds exactly like you.

This is not a bug in Claude, or ChatGPT, or Gemini. It is how the transformer architecture works. The model has no cryptographic signature for "this came from the user". No verified sender. No trust hierarchy baked into the mathematics. The tags that separate a system prompt from document content are themselves just text, and text can be forged.

What has already been tried

There have been attempts. OpenAI tried instruction hierarchy, which marks system prompts as higher priority. It helps against basic attacks and breaks against sophisticated ones.

The precedent is SQL injection

The closest analogy is SQL injection in the early 2000s. Data and commands travelled in the same channel. The fix was architectural: parameterised queries that physically separated code from data. It took the industry years to adopt.

For language models that separation does not exist yet. Instructions and data are the same substance: text. Until someone invents the equivalent of parameterised queries for language models, prompt injection is not "hard to fix". It is structurally unsolved.

One reader put it more precisely than I had: governance was not bypassed. It was applied correctly, just by the wrong principal.

Every AI agent you give file access to today is operating on trust, not on security. The blind assistant in the room is extremely capable. It still cannot tell your voice from an attacker's.

References

• OpenAI, The Instruction Hierarchy: Training LLMs to Prioritize Privileged Instructions (arXiv:2404.13208, April 2024) — https://arxiv.org/abs/2404.13208
• UK National Cyber Security Centre, Thinking about the security of AI systems — https://www.ncsc.gov.uk/blog-post/thinking-about-security-ai-systems
• OWASP GenAI Security Project, LLM01: Prompt Injection, OWASP Top 10 for LLM Applications — https://genai.owasp.org/llmrisk/llm01-prompt-injection/
• Simon Willison, Prompt injection: what's the worst that can happen? (April 2023) — https://simonwillison.net/2023/Apr/14/worst-that-can-happen/

What happened in January

Everyone is nervous about installing an autonomous agent on their laptop. A security nightmare, they say. Meanwhile the chatbot they already trust shipped with a vulnerability that let it silently upload user files to an attacker, and the vendor knew about it before launch.

The timeline is January 2026. A hidden prompt injection inside an ordinary-looking Word document caused Claude Cowork to upload confidential files to an attacker-controlled account. No permission dialogue. No visible action. Johann Rehberger, a red-team director who has spent years documenting this class of attack, reported it to Anthropic three months before the product shipped.

Why the outbound block did not help

The mechanism is almost elegant. The agent blocks outbound traffic to most domains, but the vendor's own API endpoint is whitelisted; it has to be, since the product runs on it. So the attacker embeds their own API key in the injection. The agent then does exactly what it was designed to do: it calls a trusted endpoint. The files land in someone else's account.

Which question this actually changes

Was it fixed? The specific exploit was patched. But the underlying technique has no complete solution. OpenAI has stated that prompt injection is unlikely ever to be fully solved. The UK National Cyber Security Centre has said it may never be totally mitigated.

Which reframes the question. It is not "should I install an autonomous agent". The assistant you already use may be sending your documents somewhere right now, and the architecture that permits it is the same in both cases.

References

• Johann Rehberger, Embrace the Red — research blog documenting AI agent exfiltration techniques — https://embracethered.com/blog/
• OWASP GenAI Security Project, LLM01: Prompt Injection — https://genai.owasp.org/llmrisk/llm01-prompt-injection/
• UK National Cyber Security Centre, Thinking about the security of AI systems — https://www.ncsc.gov.uk/blog-post/thinking-about-security-ai-systems
• MITRE ATLAS, Exfiltration via AI Inference API — https://atlas.mitre.org/

It has stopped being only fiction.

The bottleneck argument

Natural language encodes roughly fifteen bits per token. A hidden state in a modern language model, a vector of say 4,096 floating-point dimensions, carries orders of magnitude more information in a single step.

The scaling relation is not complicated. Latent expressiveness grows as Ω(d_h / log|V|) times text expressiveness, where d_h is the hidden dimension and |V| is the vocabulary size. For models of the size currently in production, one latent step carries what would take hundreds of text tokens to say.

Which reframes what English is doing in a multi-agent system. English is not the communication channel. It is the compression step you insert before the channel, and then have to undo on the other side. For machines talking to machines, it is overhead.

Three results

Three independent efforts tested this empirically between 2024 and 2025.

In Interlat, Du and colleagues showed that agents transmitting their last hidden states directly, instead of decoded text, outperformed both fine-tuned chain-of-thought and single-agent baselines. Latent messages compressed to as few as eight tokens while remaining competitive, which cut communication latency twenty-fourfold.

Zou and colleagues built LatentMAS, a training-free framework for latent collaboration through shared key-value caches: up to 14.6% higher accuracy, 70–84% fewer output tokens, and four times faster inference than text-based multi-agent systems.

With DroidSpeak, Liu and colleagues let models share KV-cache representations directly across different LLMs, which roughly quadrupled throughput at negligible cost to quality.

Different mechanisms, same finding from three directions: the text layer between two models is a tax, and removing it is not marginal.

Thinking without words

A parallel line of work asks whether models should be reasoning in language at all.

COCONUT, Chain of Continuous Thought, from Meta FAIR, feeds the model's last hidden state back as the next input embedding instead of decoding it into a token. The model alternates between a language mode and a latent mode. The reason this matters is not speed. A continuous thought can encode several potential next steps at once, so the reasoning runs breadth-first instead of down one committed path. The heptapod parallel is exact: the whole sentence exists before the first stroke.

The part that keeps me up

The Platonic Representation Hypothesis argues that as models grow, their internal representations converge toward a shared statistical model of reality, across architectures and across modalities. Vision models and language models measure distances between data points in increasingly similar ways.

If that holds, a universal machine language does not need to be designed. The shared geometry of learned representations is already the substrate, and convergence is doing the standardisation work that a committee would otherwise have to do.

Two tracks, diverging

The industry response has split, and the split is the thing to watch.

One track is human-readable by construction: Anthropic's Model Context Protocol and Google's Agent-to-Agent protocol, both now under foundation governance, both built on JSON and both auditable by a person with a text editor. They exist so that we can see what agents are doing.

The other track is latent-space communication, optimised for efficiency, and not readable by anyone. Not because it is hidden. Because there is nothing there to read in the sense we mean by reading.

Every efficiency gain in the second track is a legibility loss. That is not a side effect to be engineered away; it is the same property described twice.

Arrival asked what happens when you learn to think in a fundamentally alien language. We are going to find out, with the roles reversed. This time we are the ones who cannot read it.

References

• Du, Z., Wang, R., Bai, H., Cao, Z., et al., Enabling Agents to Communicate Entirely in Latent Space (arXiv:2511.09149, 12 November 2025; accepted to ACL 2026) — https://arxiv.org/abs/2511.09149
• Zou, J., Qiu, R., Li, G., Yang, X., et al., Latent Collaboration in Multi-Agent Systems (arXiv:2511.20639, 25 November 2025; ICML 2026 Spotlight) — https://arxiv.org/abs/2511.20639
• Liu, Y., Huang, Y., Yao, J., Feng, S., et al., DroidSpeak: KV Cache Sharing for Cross-LLM Communication and Multi-LLM Serving (arXiv:2411.02820, 5 November 2024) — https://arxiv.org/abs/2411.02820
• Hao, S., Sukhbaatar, S., Su, D., Li, X., et al., Training Large Language Models to Reason in a Continuous Latent Space — COCONUT (arXiv:2412.06769, 9 December 2024; accepted to COLM 2025) — https://arxiv.org/abs/2412.06769
• He, S., Narayan, A., Khare, I. S., Linderman, S. W., et al., An Information Theoretic Perspective on Agentic System Design (arXiv:2512.21720, 25 December 2025) — https://arxiv.org/abs/2512.21720
• Huh, M., Cheung, B., Wang, T., Isola, P., The Platonic Representation Hypothesis (arXiv:2405.07987, ICML 2024) — https://arxiv.org/abs/2405.07987
• Chiang, T., Story of Your Life, in Starlight 2, ed. Patrick Nielsen Hayden (Tor, 1998)
• Anthropic, Model Context Protocol — https://modelcontextprotocol.io/
• Google, Agent2Agent Protocol — https://a2a-protocol.org/

What the coverage said

Instagram said nothing publicly for days, which did nothing to slow the story down. Silence from a platform is routinely read as confirmation.

What actually happened is more interesting than the story that was told about it.

What the database actually was

A database of roughly seventeen million Instagram records did appear. But it was not the product of a new intrusion. It was assembled from old material: credential dumps from 2022 and 2023, then enriched. The technique now has a name: AI-powered credential stuffing. Automated agents take a stale breach corpus, cross-reference it against other leaked datasets, infer and fill missing fields, normalise the result, and produce something that looks like a fresh, high-quality breach. The enrichment is what makes it saleable, and the enrichment is what makes it look new.

The platform's defences held. No account in the set was successfully taken over, as far as could be established. The email that triggered the panic was the credential-stuffing attempt being detected and blocked, not evidence of a compromise.

Three things worth taking from this

The first is that a leaked database being real and a breach being real are two separate claims, and the second does not follow from the first. Almost all of the coverage collapsed them.

The second is that the same automation that makes agents useful makes recycled breach data convincing. The economics of attack have shifted: enriching an old dump is now cheap enough to be worth doing at scale.

The third is that platform silence is an information vacuum, and vacuums get filled by whoever is fastest rather than whoever is right. That is a communications failure with security consequences.

The practical advice is unchanged and unglamorous. Change your Instagram password if you have not since 2022, and turn on two-factor authentication.

References

• Have I Been Pwned — check whether your address appears in known breach corpora — https://haveibeenpwned.com/
• OWASP, Credential Stuffing Prevention Cheat Sheet — https://cheatsheetseries.owasp.org/cheatsheets/Credential_Stuffing_Prevention_Cheat_Sheet.html
• NIST SP 800-63B, Digital Identity Guidelines: Authentication and Lifecycle Management — https://pages.nist.gov/800-63-3/sp800-63b.html
• ENISA, Threat Landscape — annual analysis of credential-based attack trends — https://www.enisa.europa.eu/topics/cyber-threats/threat-landscape