The Bad Guys Have AI. So Do You.

The internet had one of its worst security weeks ever, and attackers are using AI to write better scams. Here's a plain checklist for every device in your house, and how to use AI to protect yourself.

Derek Ross

October 26, 2026 · 17 min read

Last week was brutal for online security. In a few days, PHP, Node.js and Go all shipped security fixes, a certificate authority's keys turned out to be broken, home media servers got hijacked, and a popular AI software package shipped with a password stealer built in. On October 21, TechCrunch ran the headline "The internet is having a very bad cybersecurity day." Two days later the EFF wrote that "three percent of all software vulnerabilities ever found in history were found just in the month of October."

At the same time, the people attacking you have AI. The scam emails don't have typos anymore. The fake login pages look real. The voice on the phone can sound like your kid.

This post is the bare minimum for you and your family. Send it to the people you already do tech support for.

What broke#

You don't need to run a server for this to matter. The websites and apps you use every day run on this stuff, and so does some of the gear in your house.

Old bugs still get used too. On October 8, the US government's list of actively exploited vulnerabilities added five that are between three and eleven years old. Gear that never gets updated stays vulnerable forever.

I've been giving this talk for 20 years#

About 20 years ago I ran a computer consulting and repair business for homes and small and medium businesses. A lot of the job was cleaning up computers, and a lot of it was teaching people how not to need me again.

Back then the enemy was adware, spyware and malware. People brought in computers buried under browser toolbars, pop-ups and fake antivirus programs that demanded money to remove the viruses they had installed themselves. My advice fit on an index card: don't download random things, and don't click on things.

A lot has gotten easier since then:

A lot has also gotten harder. Back then you had one computer, and the worst case was usually losing what was on it. Now your bank, your email, your photos, your doctor, your doorbell, your thermostat and your kids' school all live online, and most of it is tied to the phone in your pocket. Attackers stopped going after the computer and started going after you: your accounts, your phone number, your trust. Instead of a virus that slows down your PC, it's a perfect fake text from your bank, or a call that sounds like your daughter.

The index card still holds. Don't download random things, and don't click on things. It just isn't the whole card anymore.

The bad guys have AI#

The old advice was to look for bad spelling and weird grammar. That's done.

One thing to do today: pick a family safe word. If someone calls sounding like your mom or your son and asks for money, ask for the word.

The checklist#

1. Update every device#

Phones, tablets, laptops, desktops. All of them, including the old iPad in the drawer that the kids still use.

Turn on automatic updates everywhere so you don't have to remember.

2. Updating the OS isn't enough. Update your apps.#

Your phone can be fully patched and still run a two-year-old app with a known hole in it. Do this on every device:

Apps like Zoom, Slack and Discord update themselves, but only when you restart them. Quit them once in a while.

3. Update the house#

Your router, modem, mesh Wi-Fi, printer, smart TV, cameras and smart plugs are all computers, and they all need updates.

Replace anything that no longer gets updates. In May 2025 the FBI warned that criminals take over old, unsupported routers and rent them out to other criminals as proxies. The malware they use "does not require a password." The FBI also said routers from 2010 or earlier likely no longer receive updates. If your router is that old, a new one is cheaper than the problem.

4. Put your gadgets in jail, and give guests their own Wi-Fi#

You're only as secure as the weakest device on your network. That might be a $10 smart plug that will never see another update, or a friend's phone that hasn't been updated in a year, or the sketchy site your nephew visits while he's on your Wi-Fi.

Most modern routers let you split your network so those devices can't reach your laptop or your files:

Most smart home gear only works on 2.4 GHz, so set the IoT network to that if your router asks.

5. Use a VPN#

A VPN encrypts your traffic between your device and the VPN provider. It protects you on coffee shop and airport Wi-Fi, and it keeps your internet provider from seeing every site you visit. Use one, even a free one:

Be clear about what a VPN does. It does not stop phishing, malware or a stolen password. You still need everything else on this list.

Never click or open a link that was emailed, texted or DMed to you. Assume every one is phishing, even when it looks like it came from your bank, your boss, the post office or your best friend. Their account could be hacked, and AI makes fakes look perfect.

What to do instead:

  1. Go to the website yourself. Type the address or use the company's app.
  2. If it's about money, call the number on the back of your card or on your statement, never a number in the message.
  3. Never share a login code with anyone. Your bank will never call you and ask for one.
  4. Never install software because someone called, emailed or messaged you out of nowhere.

Report what you get. Forward phishing emails to reportphishing@apwg.org, forward scam texts to 7726 (SPAM), and report fraud at ReportFraud.ftc.gov. (FTC)

7. Use a password manager#

Every account gets its own long, random password, and you only remember one. When a site you use gets breached (and some will), the attackers get a password that works nowhere else.

Any of these is much better than reusing the same password everywhere.

8. Turn on two-factor authentication, and passkeys where you can#

Two-factor authentication means a stolen password isn't enough to get in. Not all of it is equally strong:

  1. Best: passkeys or a security key. A passkey replaces your password with your face, fingerprint or PIN, and it can't be phished. Turn them on for your email, Apple, Google and Microsoft accounts, your bank, and your password manager first. For Google, go to g.co/passkeys. A hardware key like a YubiKey is the strongest option. Buy two and keep one as a backup.
  2. Good: an authenticator app. 2FAS, Ente Auth, Proton Authenticator, Aegis (Android) or Google Authenticator.
  3. Weakest: text message codes. Criminals can steal your phone number with a SIM swap. If SMS is your only option, use it, and ask your carrier for a PIN and a port-out lock on your account.

Before you remove SMS from an account, save the recovery codes. Print them or keep them in your password manager.

9. Back up what matters, encrypted#

If ransomware hits, or a phone gets lost, a backup is the difference between an annoying afternoon and losing your photos forever.

10. If you might be a target, turn on Lockdown Mode#

Apple's Lockdown Mode shuts off the features attackers most often use to break into iPhones and Macs. It blocks most message attachments and link previews, some web features, and FaceTime calls from people you haven't contacted. Apple built it for people who might be personally targeted: journalists, activists, people in the public eye, or anyone holding a lot of money in crypto. It will break some things, but if any of that sounds like you, turn it on in Settings > Privacy & Security > Lockdown Mode on every Apple device you own. You have to turn it on separately on each one. (Apple)

You have AI too#

AI cuts both ways. OpenAI says people use ChatGPT to spot scams up to three times more often than scammers use it to run them. Here's how to put a chatbot to work.

What to ask#

Which AI to use#

Turn on the AI protection you already have#

The rules for using AI safely#

  1. Never paste passwords, recovery codes, login codes, card numbers or crypto seed phrases into any AI.
  2. AI can be wrong. Treat it as a second opinion. If it says a message from your bank looks real, still call the number on your card.
  3. Be careful letting AI read your email or browse for you. Hidden text in an email or web page can give an AI agent instructions you never see. OpenAI has said this problem "may never be fully solved." (CyberScoop)

For the IT person in your life#

If you're the one who manages a business network, or just the family server, in case you missed it:

Start today#

None of this is hard, and none of it requires being a tech person. If the whole list is too much, do one item a day this week. Start with updates and a family safe word.

Then send this to your parents, your kids, and the friend who still uses the same password for everything. Attackers only need one way in, and too often it's someone you love clicking a link that looked real.

When in doubt, ask AI for help.

#ai#howto#phishing#privacy#security
0

Written by

Derek Ross

The purple pill helps the orange pill go down. 🪺 NostrNests.com 🎙️ YakBak.app 🖼️ Zappix.app 🗓️ Plektos.app 🎶 ZapTrax.app 📈 Zaplytics.app 🎧 Podstr.org 📋 Nostrometer.com

derekross@nostr4.social

Comments0

No comments yet. Start the conversation.