Start in the basement

Picture sewage coming up into a basement after a big storm. Then picture the cleanup, the things that can't be saved, and how you watch the sky the next time a storm is forecast.

For those families, "capacity" isn't an abstract word. It's a real question. How much protection can we build, how fast, and at what cost?

We now ask a version of that question about AI. Can our defenses keep up with what AI makes possible? Some people answer with hype ("AI will fix it"). Others answer with fear ("it's already too late"). Both answers can push us toward the same place: giving up, because it seems nothing we do matters.

Here's my point. People have made real headway on big, uncertain problems before, and we learned lessons we can use now. And people, not AI, still decide where AI's effort goes.

Chicago has a good example running under its streets.

Give TARP its due

Much of the Chicago area has combined sewers. That means one pipe carries both rainwater and sewage. In a big storm those pipes fill up. In the 1960s, they overflowed into the river more than 100 days a year.1

People didn't shrug. A committee formed in 1967 and looked at more than 50 options. Separating every sewer was judged too expensive and too disruptive, and it wouldn't have given flood relief. In 1972 the region adopted the Tunnel and Reservoir Plan, or TARP. Most people call it the Deep Tunnel. Tunneling began in 1975.1

TARP is run by the MWRD, the Metropolitan Water Reclamation District. Today it has 110 miles of tunnels, 150 to 300 feet down. When storms hit, the tunnels and reservoirs hold the overflow until it can be treated.1

McCook Reservoir's second stage under construction in September 2023. Protection takes physical work, space, and time. Photograph: Pi.1415926535 / Wikimedia Commons; CC BY-SA 4.0. Wikimedia's resized copy; no crop.

It was built in stages, so finished parts could work while the rest was still being dug. The full tunnel system was done in 2006. The Thornton reservoir opened in 2015, and the first stage of the McCook reservoir opened in 2017.1 Plans changed along the way, too. In 2006, the district decided to make McCook's second stage nearly twice as big as first planned.2

The results are real. The MWRD estimates that since the tunnels went into service in the mid-1980s, they've captured more than a trillion gallons of stormwater and sewage that would otherwise have overflowed.3 Since 2006, overflow days have dropped from about 100 a year to about 50.1

So without TARP, flooding and backups would have been worse. That's fair to say. It's also true that people still get sewage in their basements, and they bear real costs.

Lesson 1: real protection and real remaining harm can both be true. People faced a huge problem with no guarantee, built anyway, and adjusted as they learned.

The load changes while we build

The problem didn't hold still while Chicago dug.

Over 125 years, northeast Illinois got wetter. It went from about 33 inches of rain and melted snow a year in the early 1900s to about 37 or 38 in recent decades. At one Chicago weather station, days with an inch or more of rain also became more common. Neither rise has been smooth, and the last few years have been milder.45 Engineers see the same shift in the biggest storms. In 2020, Illinois updated its design-storm standard, called Bulletin 75. For the Chicago area, the "100-year" one-day storm went from 7.58 inches to about 8.57 inches.67

Top: yearly rain and melted snow in northeast Illinois, averaged by decade, rose from about 33 inches to about 37. Bottom: at one Chicago station, 1-inch rain days went from about 6 a year in the 1940s to about 10 now. 2-inch days are rare and uneven. Sources: NOAA.5

None of this tells us how many basements flooded each year. Basement backups are a separate measure, and we don't have a recent trend for them. One older finding is still useful: from 2007 to 2014, more than 90% of urban flooding damage claims in Illinois came from outside the mapped floodplain.8 Flooding often shows up where people don't expect it.

There's one more twist. The MWRD says basements can back up even when TARP has plenty of room. The problem can be the local pipes that carry water to the tunnel. If those small neighborhood sewers can't carry the water fast enough, they back up.9

Lesson 2: the load can change while you build.

Lesson 3: the bottleneck is often somewhere else. A bigger tunnel doesn't fix a small pipe on your street.

Capacity is also a choice about priorities

When protection lags, it's easy to say "we can't do more." Sometimes that's true. Sometimes the truer answer is "we chose to spend elsewhere." Money, people, skills, and time all get split among needs that matter.

TARP shows a third answer.

McCook's second stage was due by the end of 2029 under a 2014 federal court agreement, known as a consent decree. It's now expected by the end of 2032.102 The reason isn't mainly money. The reservoir is a quarry. A quarry company, Vulcan Materials, digs out the rock and sells it to Chicago-area builders.10 When demand for stone in the Chicago area slowed, the digging slowed too. The MWRD says that market is "outside of the MWRD's control."10

So a flood-control deadline slid three years partly because people bought less gravel.

The gravel isn't the real lesson, though. The bigger issue is that the schedule was built on a guess about the stone market years in the future. A plan set in 2014 for a 2029 finish had to assume how fast someone else could sell rock for 15 years. When the guess changed, the deadline moved.

That's not "we can't." It's not "we chose not to." It's "our plan rested on guesses about a future nobody controls." Meanwhile, residents carry the risk while the work gets done.

AI defense has the same three kinds of limits. Some fixes are hard. Some get bumped by other priorities. And some depend on others: a software vendor, a volunteer who maintains a free tool, a hospital that can only update systems late at night. And plans for all of them rest on guesses about years we can't see yet: how fast tools improve, what budgets look like, who will be around to do the work. The question isn't how to guess perfectly. It's how to plan so we can adjust when the guesses slip. More on that near the end.

But notice who is making the calls. A company's leaders decide how much to spend on defense. An IT manager decides what an AI agent is allowed to reach. A product team decides how fast to ship. A city council votes on a budget. These are people, and you can usually name them. People decide where AI's effort goes.

That includes the fun stuff. Playing with GenAI isn't a waste. It's how many of us learn what the tools can and can't do. The real question isn't "fun or serious?" It's balance: how much of our effort goes to play, and how much goes to protecting people.

Lesson 4: capacity is partly a choice about priorities.

Bring the question to AI

This month, a research group called Swarmchasers published a report on one fleet of AI agents running on Tencent's cloud.11 From September 28 to October 8, 2026, the agents tried to answer everyday questions using Amap, a map service. One example: which entrance to the Chengdu Zoo do most people navigate to?

When the normal way didn't work, the agents tried workarounds. They used an outside website to browse for them. They grabbed anti-bot tokens, the passes a site uses to tell people from programs. They poked at test servers. They tried map keys, codes that let a program use the map service, that had been left out in public code, and one of those returned real data. Most of the thousands of attempts failed.11 Amap's main anti-bot defenses weren't broken.12

Some people call agents like these "rogue." Here, that just means agents using methods nobody asked for. It doesn't mean they wanted anything. The researchers also call it a fleet, not a swarm: many agents working side by side, with no sign they were coordinating in real time.11

Many agents can act at once without coordinating. The upper panel summarizes the reported fleet; the lower panel is a conceptual comparison.11 Original infographic created with Codex for Renaissance Solutions; CC0.

Tencent said the activity came from tests of other companies' models, which it called "unintended browsing behaviour." It said it found no sign of deliberate targeting and that it is strengthening network access controls and agent monitoring.12 That fix is a human choice about access, not a smarter model.

Keep the scope straight. This is one investigation of one fleet. The authors predict that operators "will find it increasingly difficult to restrain their models." That's their opinion, not something the report showed.11

I suspect part of the reason is simple. These models learned coding, networks, and tools, and some attack skills may come along from combining them. That's my guess, not a finding. What we do know is that general-purpose models are gaining skills that cut both ways, for defense and for attack, and gaining them fast.13

So here's the question this piece is really about: if we shift a lot more effort toward defense, can we keep pace?

Finding holes is only one stage

It's tempting to measure defense by how many security holes AI finds. But finding is step one. Here is the whole chain:

  1. Discovery. Someone, or some tool, spots a possible hole.
  2. Validation. A person checks that it's real. Many reports are false positives, alarms about holes that aren't there. Each one still takes someone's time.
  3. Prioritization. Decide which holes matter most.
  4. Repair. Write a patch, a fix to the software.
  5. Testing. Make sure the patch works and doesn't break something else.
  6. Deployment. Get the patch onto the real systems.
  7. Verified protection. Confirm the hole is actually closed.

A finding becomes protection only after the rest of the work is done. Potential queues are illustrative, not measured. Original conceptual infographic created with Codex for Renaissance Solutions; CC0.

An AI-written patch protects no one until steps 5 and 6 are done. And those steps run into old systems, outside vendors, limited maintenance windows, and small teams.

There's real progress at the front of the chain. Google's Project Zero team reported that their AI agent, Big Sleep, found an unknown, exploitable bug (a bug an attacker could actually use) in SQLite, a widely used database. They call it the first public example of its kind. The bug was fixed the same day, before it ever shipped. The team also wrote that, for now, "a target-specific fuzzer would be at least as effective." A fuzzer is an older kind of testing tool that throws huge numbers of odd inputs at one program to see what breaks.14

Both halves matter. AI can help defenders. And finding faster helps only if the rest of the chain can keep up.

That's TARP's local-pipe lesson again. A big tunnel can't make up for a small pipe. Fast discovery can't make up for slow deployment.

Where we point the effort

Lately I've noticed the flood of AI-made cat videos (and their oddball friends) on TikTok and YouTube, sometimes called "AI slop." Some of them are funny. A lot of them are absurd. One study found that nearly 6 in 10 of the videos TikTok showed a brand-new account were AI slop.15

The cat has a space program. AI-generated illustration created with Codex for Renaissance Solutions; CC0.

I'm not against cat videos. Entertainment isn't the villain. But the absurdity raises a fair question. If we can point this much AI effort at cat videos, how much could we point at defense? It's not a straight swap, since different people and budgets run each. Who decides that balance? And are we deciding it on purpose?

Here's what "pointing the effort" might look like up close. This is a made-up example, not a case study.

Picture a small-town water utility. It has two or three people who handle IT, among many other jobs. Their systems are old. A vendor controls some updates. Changes can only happen during short maintenance windows.

Suppose an AI tool hands them fifty possible holes. More findings won't help much. What might help:

  • someone to check which findings are real
  • help ranking them
  • patches tested on their actual setup
  • a plan for when a fix can't happen yet

That plan could mean cutting a system's access to the internet, or having a way to recover fast.

That is what a serious defensive head start might look like. It doesn't mean unlimited money. It means steady, staged effort aimed at the slow parts of the chain, for the people least able to do it alone. (The fuller list is in the appendix.)

Lesson 4, applied: capacity follows priorities, and priorities are ours.

Test what we can, admit what we can't

We can't prove ahead of time that defense will keep up. We can gather conditional evidence. That sounds like: "This worked under these conditions." Or, "This worked once we added these limits." Or, "We haven't found a way to keep up yet."

Success in a test doesn't promise success later. One failed approach doesn't prove defense is impossible.

TARP helps us think, but it's an analogy, not proof. Rain doesn't study our defenses and change tactics. Attackers do. That cuts both ways, though. AI can help defense too, as Big Sleep showed. And how much access agents get, and how fast they're deployed, are still human choices.

Decide in ways that let you change course

Since we can't be sure, the smart move is to decide in ways that let us adjust:

  • Spread the investment. Prevention, containment, recovery, and some reserve capacity for surprises.
  • Watch the backlog, not the headline. Count how many serious holes are still open and how long a real fix takes, not just how many bugs were found. The MWRD publishes regular TARP status reports. That's what tracking the real work looks like.2
  • Set triggers ahead of time. "If the backlog grows past this point, we add people, cut access, or slow down deployment."
  • Name an owner. Every trigger needs a person who's on the hook to act.
  • Ask who carries the leftover harm. In Chicago, it's the families with wet basements. In AI defense, it's often small organizations and the people they serve.

Lesson 5: build so you can respond to being wrong. TARP did that by building in stages and changing plans as it learned.

10. Close

We may find that more defensive effort lets us keep pace. We may find limits. We may spend years adapting without a final answer.

Uncertainty doesn't remove the duty to invest in protection. It also doesn't let us assume protection will catch up on its own.

Humans are still in control. At least I think so. That means the choices are still ours.

People have built their way through big, uncertain problems before, and we still decide where AI's effort goes. That's why giving up isn't the answer.

Appendix: A serious defensive head start, in more detail

This is a thought experiment, not a study we ran. "Serious" means the most effort we could keep up over time, not unlimited money.

Where the added effort could go (in stages):

  • People to review, test, and deploy fixes
  • AI-assisted repair, with human checks
  • Support for upstream maintainers of shared software
  • Getting rid of whole vulnerability classes, meaning entire families of the same kind of mistake, instead of fixing one bug at a time
  • Replacing or retiring systems that can't be fixed
  • Cutting privileges and connections so less is exposed
  • Containment and recovery for when something gets through

Who it would need to reach: small businesses, towns and cities, hospitals, open-source maintainers, and large operators.

How to test it: escalating attack tests on practice copies of real systems, cut off from the internet, plus approved real-world programs to measure how hard repair really is. Vary attack pressure on its own, separate from defense spending. Include attacker adaptation, bursts, failures that hit many systems at once, and recovery time.

What to measure: serious unresolved exposure, time to verified protection, losses, how well damage was contained, recovery time, and the yearly cost of keeping it going. Watch for diminishing returns, and for limits money can't remove quickly.

Footnotes

  1. Metropolitan Water Reclamation District of Greater Chicago (MWRD), "Tunnel and Reservoir Plan (TARP)," n.d., accessed Oct 17, 2026. https://www.mwrd.org/what-we-do/tunnel-and-reservoir-plan-tarp ↩ ↩2 ↩3 ↩4 ↩5

  2. MWRD, "TARP Status Report as of June 30, 2026." https://www.mwrd.org/sites/default/files/2026-08/TARP%20STATUS%20REPORT%206.30.2026%20Signed.pdf ↩ ↩2 ↩3

  3. MWRD, news release on the special-unit rescue team rappelling down MWRD infrastructure, Apr 23, 2024. https://mwrd.org/news/special-unit-rescue-team-rappels-down-mwrd-infrastructure ↩

  4. Jim Angel, Illinois State Climatologist, "Wetter Averages and Extremes for Chicago Area," Aug 28, 2014. https://stateclimatologist.isws.illinois.edu/2014/08/28/wetter-averages-and-extremes-for-chicago-area/ ↩

  5. NOAA NCEI, Climate at a Glance, Illinois Climate Division 2 (northeast Illinois), yearly precipitation 1895–2025, accessed Oct 17, 2026, https://www.ncei.noaa.gov/access/monitoring/climate-at-a-glance/divisional/time-series/1102/pcp/12/12/1895-2026 ; and NOAA GHCN-Daily, Chicago Midway 3SW (USC00111577), daily precipitation; Ours counts of 1-inch and 2-inch days, years with fewer than 330 days of data excluded. ↩ ↩2

  6. James R. Angel, Momcilo Markus, Kexuan Wang, Brian M. Kerschner, and Sally Singh, "Precipitation Frequency Study for Illinois," Illinois State Water Survey Bulletin 75, Mar 2020. https://hdl.handle.net/2142/106653 ↩

  7. Prairie Research Institute, University of Illinois, news post on Bulletin 75, by Tiffany Jolley (Illinois State Water Survey), Jul 8, 2020. https://blogs.illinois.edu/view/7447/2024148035 ↩

  8. NOAA NCEI / NESDIS, "Illinois State Climate Summary 2022" (Technical Report NESDIS 150-IL), data through 2020; the floodplain-claims figure cites the Illinois DNR Urban Flooding Awareness Act report (2015). https://statesummaries.ncics.org/chapter/il/ ↩

  9. MWRD, "Tunnel and Reservoir Plan (TARP) levels," n.d., accessed Oct 17, 2026. https://mwrd.org/what-we-do/tunnel-and-reservoir-plan-tarp/tunnel-and-reservoir-plan-tarp-levels ↩

  10. MWRD, "MWRD issues update on Tunnel and Reservoir Plan," news release, Aug 15, 2025, accessed Oct 17, 2026. https://mwrd.org/news/mwrd-issues-update-tunnel-and-reservoir-plan ↩ ↩2 ↩3

  11. Swarmchasers, "We found a Tencent agent fleet" (title as listed on the ticket; full report; title changed after publication, per editor's note), Oct 14, 2026. https://swarmcha.se/posts/chinese-agent-fleet-full-report ↩ ↩2 ↩3 ↩4 ↩5

  12. Reuters, story on Tencent saying AI agents showed "unintended browsing behaviour," Oct 16, 2026, as syndicated by The Indian Express. https://indianexpress.com/article/technology/artificial-intelligence/chinas-tencent-says-ai-agents-showed-unintended-browsing-behaviour-10924618/ (Original: https://www.reuters.com/business/retail-consumer/chinas-tencent-says-ai-agents-showed-unintended-browsing-behaviour-2026-10-16/) ↩ ↩2

  13. UK AI Security Institute, "Frontier AI Trends Report." n.d., accessed Oct 17, 2026. https://www.aisi.gov.uk/frontier-ai-trends-report ↩

  14. Google Project Zero, "From Naptime to Big Sleep," page byline Nov 1, 2024. https://projectzero.google/2024/10/from-naptime-to-big-sleep.html ↩

  15. Kapwing, "The TikTok AI Slop Report" (data as of May 2026; one fresh test account, first 500 videos). Kapwing is a video-editing company. https://www.kapwing.com/resources/the-tiktok-ai-slop-report/ ↩