Near-future "cyberpunk" era: roughly 2026–2032

Here's my prediction for a near-future "cyberpunk" era, roughly2026–2032: The offense/defense collapse.

hacking needed scarce skill

You had to know C, understand protocols, chain exploits carefully. Agents collapse that scarcity. Automating vulnerability discovery, exploit adaptation, and lateral movement turns attacks into a search problem you can parallelize across a fleet of agents. Offense scales with your GPU budget; defense doesn’t, because defenders must patch/cover every possible path, attackers only need one.

Zero-day markets collapse first

Today’s vuln brokers sell RCEs to governments and ransomware crews. Once an agent pipeline reliably discovers bugs in real targets, there’s no reason to sell the shortcut — just rent the agents. Grift economics goes from “sell a secret” to “sell a service at scale.”

Identity becomes the whole game

If software attacks are cheap, the pivot is the human: credential theft, session hijacking, OAuth consent phishing, synthetic voice/video for help-desk resets. Deepfake voice cloning is already good enough for a convincing phone call to a support line. Every MFA scheme will get a bypass, because the weakest factor was always “a human who can be persuaded.”

Two market outcomes, and I lean toward one:

1. Better state + worse state: a handful of powerful actors (states, big firms) get near-universal capability, small-time crime gets crushed, citizens have essentially zero privacy.
2. Flat: cheap agents give opportunistic low-skill actors parity, and the disorder is diffuse and constant.
   I think you get (1) as the ceiling with (2) as the floor — most of the world lives near the middle, feeling like (2) because they can’t see (1).

The horror isn’t the hacker; it’s that “how do you know this score is wrong?” has no answer, because nobody can read the reasoning chain. Optionality is the real currency people fight over: contestable decisions.
The counterweight I genuinely believe in: patching speed. If vulnerabilities get fixed in days rather than months, the agents can’t settle anywhere , no time to establish persistence. Also, the bottleneck moves to verification: whoever can confirm an exploit works gets the advantage, so capability shifts from attacker to defender and to signing infrastructure. Software-signing provenance (SBOMs, hardware attestation, reproducible builds) is quietly the most important defense investment of the decade.

Wildcard: not AI, but scale of infrastructure. Cloud sprawl and the fact that nobody can draw the org chart anymore. AI makes a flat organisations chart into an attack surface.