The Internet of Shit: Billions of Unsecured Devices Are Already Weaponized, and AI Is Accelerating the Damage

A software security specialist confirms what engineers have known for years: most connected devices ship with negligible security, never get patched, and are already conscripted into botnets. AI hasn't changed the game — it's shortened the clock.

A letter from a software security specialist with industrial-control expertise cuts through the hype cycle around IoT hacking with a practitioner's clarity. The core message: millions of internet-connected devices — fridges, cameras, ovens, blast furnaces — share three fatal properties. Their firmware is almost never upgraded. Their security features are cosmetic. And most of them never needed an internet connection in the first place.

The specialist, responding to a Guardian report on hacked fridges, fake nuclear alerts, and a $6 billion heist, frames the problem not as an emerging threat but as an existing one. Many of these devices are already compromised, already enrolled in botnets used to attack other systems. The Mirai botnet of 2016 demonstrated this at scale; the intervening years have only expanded the attack surface while manufacturers continued shipping devices with default credentials and unpatched code. AI enters the picture not as a novel threat vector but as a force multiplier for known techniques. What previously required a skilled attacker spending hours finding firmware vulnerabilities can now be partially automated, compressing the timeline from discovery to exploitation. The structural vulnerability — devices shipped insecure and never updated — remains the root cause. AI is the accelerant, not the arsonist. The economic incentive structure is the real disease. Device manufacturers capture the sale price and move on. Security costs money — secure boot, signed firmware updates, ongoing patch support — and consumers don't comparison-shop on firmware hygiene. The result is a market failure where the costs of insecurity are externalized to everyone else on the internet: the botnet traffic hits banks, hospitals, and infrastructure operators, not the manufacturer who shipped the vulnerable fridge. The specialist's advice is elegant in its simplicity: upgrade if you're confident, unplug if you're not. Don't give your oven the wifi password. This isn't paranoia — it's rational risk management when the device manufacturer has no economic incentive to protect you after the sale. The "internet of things" versus "internet of shit" naming split captures the divide between marketing and engineering reality perfectly. The deeper structural question is whether anything changes without regulation. Voluntary security standards have failed. Manufacturers will not internalize security costs unless forced to by liability rules, mandatory update windows, or market access requirements. The EU's Cyber Resilience Act is the first serious attempt; the UK's Product Security and Telecommunications Infrastructure Act sets a floor. Whether enforcement keeps pace with the billions of devices already deployed is another matter entirely. Twenty years of this trajectory means a world where every connected device is either actively maintained or actively hostile — and the ratio tilts heavily toward hostile as legacy devices accumulate faster than they're retired.