Why I Think an Internet Blackout Is Coming Soon

Something has been becoming more frequent in recent weeks: hacker attacks on large companies one would think invulnerable. Even in my country, Ecuador, several important government institutions and private banks have been breached within a span of a few days — the National Transit Agency, the Civil Registry, Banco de Machala, among others — with the cybercriminals making off with the data not of hundreds or thousands, but of millions of users. It's no coincidence. As artificial intelligence capabilities grow, coding exploits that breach servers — especially misconfigured ones — keeps getting easier: the barrier to entry for this kind of attack is being eliminated.

And with this comes something else to my mind. One day, perhaps soon, it won't be a website that goes down, or an app, or a social network. Something more invisible will fail: the entire map.

The map almost no one looks at

I say map because that's how the internet works, deep down. We type names: google.com, wikipedia.org, neomano.com. But machines don't travel by names; they travel by numbers: IP addresses, routes. Between the human name and the machine address exists a silent layer we almost never look at: DNS, the system that translates one into the other. Cloudflare explains it with a familiar metaphor: DNS is like the internet's phone book — you look up a name, and the system finds the number. When people talk about an "internet blackout," they imagine cut undersea cables, destroyed satellites, data centers burning, or governments switching off giant routers. All of that can happen, of course, but there's a more elegant, more modern, and perhaps more unsettling way to cause chaos: not destroying the internet, but making the internet forget how to call itself.

That's where root servers come in, a kind of first information desk for DNS. They don't necessarily know where every site is, but they know where to direct the question: if someone asks about a .com, .org, or .ec domain, the system must be able to reach the root somehow to find out who manages that zone. The root isn't the entire library, but it is the index that lets you find the aisles.

For a long time people repeated that there are 13 root servers, which is technically true and false at the same time. There are 13 names or logical addresses, from A to M, but they're not thirteen lonely computers in a basement guarded by men with headsets: today those addresses are distributed via anycast across many physical locations, operated by 12 independent organizations, and root-servers.org reports more than 2,000 instances of the root system as of May 20, 2026. In other words, there's no red button that says "turn off the internet." And yet, the temptation exists.

The 2007 precedent and what changed

That someone would want to attack DNS is nothing new: it already happened. In 2007 there was a distributed attack against the root servers, and ICANN reported that six of the thirteen were affected and two were severely impacted, though the impact on end users was limited thanks to engineering, distribution, and the use of anycast. RIPE also noted that the attack went almost unnoticed by the average user.

What's new is that now there's a tool capable of making an attacker's obsession more dangerous: artificial intelligence. Not because AI is magical, or because it "thinks" like a movie villain, or wakes up at three in the morning wanting to hate us. The danger is more boring and, for that very reason, more realistic: AI reduces costs. It helps search for information, automate tasks, write code, summarize technical documentation, find patterns, produce convincing messages, coordinate attempts, translate languages, simulate scenarios, and accelerate cycles of trial and error. The UK's National Cyber Security Centre warned in 2024 that AI would almost certainly increase the volume and impact of cyberattacks and would lower the barrier to entry for novice criminals, hackers for hire, and hacktivists, especially in reconnaissance, social engineering, and access operations.

And that governments are taking this seriously is no longer in doubt. On June 12, 2026, the US Department of Commerce did something unprecedented: it ordered Anthropic to suspend access for any foreign national to Fable 5 and Mythos 5, its two most advanced models, deeming them a national security risk given their offensive cybersecurity capabilities. Anthropic, with no reliable way to sort its users by nationality, chose to take both models offline for everyone, and so they remained for more than two weeks, until Washington lifted the restrictions. Days later, OpenAI, at the government's own request, limited access to its new GPT-5.6 family to a list of "trusted partners." For the first time in history, access to an AI model was handled like the export of a strategic weapon: with licenses, allowlists, and quarantine.

The paradox is that while Washington was learning to quarantine models, the exact opposite was happening on the other side of the world. On July 16, 2026, China's Moonshot AI unveiled Kimi K3, a 2.8-trillion-parameter model the company describes as the largest open-weight system ever built, and announced it would release those weights under an open license before the end of the month. With published weights there is no possible quarantine: the model can be downloaded, modified, and run without anyone's permission, and no government has a button to pull it out of circulation. The barrier to entry isn't just falling: it's disappearing at both extremes — the closed model that scares governments, and the open model that no longer needs their permission.

Outlasting the memory

A brief attack against the root probably wouldn't be enough, because the internet has memory. Recursive DNS servers cache answers for a certain time, defined by the TTL (Time To Live): if a server already knows where a popular domain is, it can respond without asking the entire hierarchy again. Cloudflare explains that recursive DNS servers cache answers for a determined time and can respond from cache without consulting other servers; RSSAC, ICANN's advisory committee for the root system, likewise explains that DNS records have a TTL after which the caching server must query again. That's why an attack lasting minutes can be invisible: people keep accessing the same sites because many names were already resolved, apps keep working because they maintain open connections or have their domains cached, and large sites resist better because everyone queries them all the time and their responses are repeated across thousands of resolvers.

For us to notice, the attack would need to have one special characteristic: it would need to last longer than the system's memory. That's the key. Hitting hard wouldn't be enough: it would have to hit for long enough, in enough places, and against enough parts of the resolution process, until the caches start to expire and the recursive servers need to ask again.

That's when the strange feeling would begin. Not everything would go down at once — that would be too cinematic: first some sites would fail, then others. Some people would get in from one carrier but not another; one country would see errors another doesn't; a user on public DNS would have a different experience from someone on their provider's DNS; some mobile services would keep working while certain websites seemed dead. And there would be absurd conversations:

—It opens for me.
—Not for me.
—Try with mobile data.
—Try with another DNS.
—Reboot the router.
—No, wait: now it's not opening for me either.

That would be the most modern blackout: not total darkness, but inconsistency. The internet would still be there, but we'd lose confidence in its map — and confidence, in infrastructure, is almost everything.

Something even more unsettling could also happen: not that names stop responding, but that they respond incorrectly. There the problem stops looking like a blackout and starts looking like a collective hallucination: sites pointing where they shouldn't, services that won't load, certificates that fail, apps that think they're talking to a server without managing to verify anything. It wouldn't take all domains failing; it would be enough for enough important domains to fail for people to feel that "the internet is acting weird." That phrase could be the first symptom.

Resilience doesn't eliminate risk

The root infrastructure is more resilient than most people imagine. Anycast, redundancy, independent operators, monitoring, caches, DNSSEC, local copies of the root zone, and other defenses mean the system isn't a house of cards. In fact, RFC 8806 describes a method for resolver operators to keep a local copy of the root zone, precisely to give more reliable responses during network attacks against the root servers.

But the history of computer security teaches something uncomfortable: resilience doesn't eliminate risk, it only raises the price of the attack. And AI lowers prices. Attacking something like this used to require knowing a lot: weeks reading technical documentation, patience to write tools, people coordinating people. Today that documentation gets summarized in minutes, prototypes are produced, fixed, and automated at dangerous speed, and processes coordinate themselves. A current attacker can know less and ask better. AI doesn't turn any teenager into a cybercrime genius, but it turns a mediocre attacker into a less mediocre one, and a good attacker into a faster one.

Who would want to turn off the map?

Then the uncomfortable question appears: why would anyone do such a thing? The first motivation is the simplest and the oldest: hatred. There are people who don't want money, or a cause, or negotiation: they just want to see something burn. Before they broke windows, then they took down pages, later they leaked databases; tomorrow they might want to leave a mark on the infrastructure we all take for granted — not because they gain something practical, but because destruction can also be a sick form of expression.

The second motivation is money. Whoever demonstrates they can affect name resolution at scale, even for a short time, can extort. Banks, exchanges, governments, cloud providers, e-commerce platforms, telecommunications operators: all depend on names working, and a partial DNS blackout for an hour can cost more than many traditional ransoms. In the digital world, disruption is a currency.

The third is fame — though not normal fame with interviews, photos, and biography, but a strange fame: faceless, alias-based, manifesto-published-in-some-dark-corner fame; the fame of "I was the one who made everyone look at the sky and wonder why there was no signal." A contradictory fame, besides: wanting to be known without being identified, to go down in history without appearing in it, to make millions suffer an inconvenience so that a few on a forum will say "that guy did it."

There can also be political, military, or ideological motivations: such an attack could serve as a show of force, a distraction, a retaliation, or a rehearsal. But I'm more interested in the small, almost human motivation: that of the resentful, the ambitious, the invisible. Because AI doesn't only empower major actors; it also gives new tools to misdirected solitude.

A tremor, not the end of the world

We may not see a great global blackout, but something more modest: a regional blackout, a massive resolution failure, an attack against several recursive providers, a chain of incidents that seem isolated until someone connects the dots. Maybe it won't last days, but hours; yet that will be enough for banks not to load, apps to fail, sites to disappear, and half the world to think the problem is their router. And when it happens, many will discover for the first time that the internet isn't a cloud, but a collection of agreements, protocols, servers, routes, caches, and people who, miraculously, almost always cooperate.

AI didn't invent the internet's fragility: it can only make it more exploitable. Maybe that's why I think we'll soon see a blackout. Not necessarily the end of the internet or an apocalyptic scene, but a warning: a tremor large enough to remind us that digital civilization rests on layers almost no one knows about. And that day, when we open our browser and nothing loads, we won't necessarily be disconnected. Maybe we'll just be lost: the road will still be there, but the map will have stopped responding.