Appearance
The freezers in France
Four hundred supermarkets in France lost their refrigeration this month. Someone reached into the software that controls commercial fridges and changed how they run. Shoppers found empty shelves. Staff threw out fresh and frozen stock.
This is the example I keep coming back to when people ask what an AI-powered attacker could actually do in the real world. No robots. No Terminator. A controller box on a loading dock that somebody forgot to patch.
The New York Times reported the reach as roughly 300 Intermarché and Netto stores, 80 from Coopérative U, and 30 from Monoprix. Le Monde's count disagrees on the per-chain split, putting 80 at Carrefour, around 100 at Coopérative U, and several E.Leclerc locations in the mix. AFP's figure for Intermarché is 150 to 200, not 300. The one number everyone agrees on is "more than 400."
The cost, per the head of Coopérative U: tens of thousands of dollars for a small supermarket, about $220,000 for a hypermarket. A hypermarket losing $220,000 in spoiled inventory is a line item. Losing a week of customer trust is worse.
Danfoss, one of the manufacturers behind the affected refrigeration systems, said the units were often outdated and no longer receiving security updates. That's the entire vulnerability. Nobody had to find a memory corruption bug. They had to find a device that was still listening.
The defrost cycle was the payload
A detail from Le Monde makes the rest of this article click. The attackers stretched the defrost cycle from one hour to eight. That's it. No destroyed hardware, no ransom note, no dramatic shutdown. A timer set to run long enough that the alarms fired late and the food spoiled before anyone noticed.
The community thread around this story caught something I'd missed. If the maintenance password was shared across all 400 stores, the attack didn't need 400 vulnerabilities. It needed to guess one date. That's a plausible design for a maintenance account. Convenience for the technician, no per-store audit trail, no way to tell which store was accessed by whom.
| Attack | Year | Reach | Resources needed | What broke |
|---|---|---|---|---|
| Stuxnet | 2010 | ~1,000 uranium centrifuges | Nation-state budget, years of design work | Iranian enrichment program |
| Ukraine grid | 2015 | ~230,000 people without power | State-backed team | Regional power distribution |
| Colonial Pipeline | 2021 | US Southeast fuel supply | Ransomware crew | Pipeline business systems |
| French freezers | 2025 | 400+ supermarkets | Internet-exposed controllers | Cold chain |
The pattern is obvious. Stuxnet took a spy agency and years of design work. The freezers took a device that was still running firmware from a decade ago.
Where AI changes the math
The 972mag investigation into Lavender describes an AI system used to generate targets during the bombardment of Gaza. Whatever you think about that specific deployment, one technical property is portable. The system produced candidate targets faster than a human review chain could plausibly evaluate them. When the volume of candidates outruns the reviewer's capacity to check them, the review step stops functioning as a check. It becomes a formality with a signature on it.
The freezer hack shows the same shape without AI in the loop. Patient work across a long list of targets is exactly the thing a model does better and cheaper than a person. A human attacker can only be in one place at a time. An agent doesn't have that constraint.
Quick Take: Every one of these stories is really about throughput, not intelligence. The failure mode is a system that acts faster than the humans around it can react.
The Zoom clause you agreed to
Zoom's terms of service, effective August 11, 2023, gave the company the right to train AI models on user content with no opt-out. That was the plain reading when the clause first circulated. Users couldn't refuse and keep using the product.
The practical implication: every meeting recording, chat transcript, and shared file processed through Zoom during that period was potentially training data. If you standardized on Zoom for internal calls in 2023, your meetings became someone's corpus without a form to sign.
The internet pushed back hard, and Zoom eventually clarified parts of the language. The original clause is worth remembering as a template. The default flipped from "we don't train on your data" to "we do, and clicking is consent." Procurement teams rarely read the diff.
Meta's glasses, and the people watching
Meta Ray-Ban glasses sold 2 million units across 2023 and 2024 combined. In 2025 the number tripled to 7 million. That's the marketing story.
The other story runs through Nairobi. Sama, a subcontractor, employs data annotators who label and quality-check footage captured through the glasses. Workers describe videos of bathroom visits, people undressing, people having sex while wearing the glasses, and bank cards visible on camera by accident. One worker described a pair left on a bedside table. The wearer walks out. A partner comes in and changes clothes.
Meta's own terms of use for its AI state that interactions "can be reviewed" by humans, manually or automatically. Voice, text, image, and sometimes video must be processed for the AI feature to function. That processing can't be turned off.
We bought a pair to test this. We said no to the extra data-sharing step during setup and turned off the internet. The AI stopped working immediately. It needs Meta's servers to interpret anything. When we captured the app's network traffic, it was phoning home to Meta infrastructure in Luleå and Denmark. Whatever the salesperson at the optician says about "everything staying local," the assistant doesn't work that way.
At 7 million units, even a small percentage of users wearing the glasses in private moments produces hundreds of thousands of intimate clips flowing into a pipeline that ends on a screen in an office eight thousand kilometers away. Face anonymization is supposed to blur identifiable people. Workers on the ground say it fails in low light, on unusual angles, and on faces that move mid-frame. The QA process handles volume in aggregate, not per face.
What trips people up
Assuming the freezer attack required a zero-day. It required a controller still reachable from the internet and receiving no security updates. Internet-facing hardware older than five years is the territory you should be auditing.
Trusting the "we don't train on your data" line at the point of sale. The opt-out you set during setup controls one narrow stream. The AI feature itself runs server-side, and the data that makes it work gets processed automatically.
Treating a terms-of-service update as legal noise. The Zoom clause was a default flip delivered silently. If procurement routes ToS changes to a folder nobody opens, you're handing over data policy you never negotiated.
Believing anonymization works because someone said it does. Face blurring fails in poor lighting and on motion. Workers see the failures in their queue every shift. Aggregate QA metrics won't catch the one clip that matters.
Deploying AI agents with write access before you know what they can reach. The freezer controllers were manual. An agent version of the same endpoint gets autonomous write permission. If your payment webhook accepts a forged call, orders get marked paid with no money behind them.
What the community is saying
The recurring theme in the threads I've been reading is that people want safety work aimed at prevention, not capability demos. One developer I traded notes with put it plainly. Everyone wants to give AI more access to computers and servers. What he's actually interested in is how you reliably stop the agent from doing something stupid. He cares about the security layer far more than the demo reel.
Another argument I keep hearing: the audit trail is what saves you. A unique credential per store, sealed at provision time, would have turned one shared password into 400 separate access events. Receipts don't stop an attack. They make the blast radius legible afterward, which is the difference between "we think it was one password" and "here are the 400 stores, the 400 access times, and the one credential they shared."
And a small caution on the number itself. The wire reports don't agree on the per-chain counts. If you cite this in a meeting, cite "more than 400" and leave it there.
The cheap attack is the one to plan for
The attack worked because someone was willing to do slow, boring work across a long list of targets. That is exactly the kind of work models are getting good at, and the list of internet-connected devices nobody thinks of as targets is nearly endless. Building HVAC, water pumps, parking gates, the fridge at your pharmacy. Old software, remote access switched on, no updates in years.
Here's the honest version of the AI-risk argument. The damage runs through the plumbing around the model, not through the model itself. The model just makes the plumbing easier for people who couldn't have pulled it off alone.
The Bottom Line
If you're running internet-facing industrial controllers, replace or isolate anything not receiving updates. The freezers in France fell for the same reason an unpatched home router does: remote access, no updates, nobody checking. That's a scheduling problem, not a research problem.
If your company standardized on a video platform in 2023, audit what the current terms let the vendor do with your calls. Zoom's August 2023 clause is the reference point. Check whether your vendor has the same language today and whether your opt-outs actually cover the AI features you're using.
If you're building AI agents with write access, treat the security layer as the product. The cheapest real-world attack in this article didn't need a frontier model. It needed a controller that was still listening.