The Hysteria Trap: How We Manufacture Crises While Ignoring the Problems Already in Front of Us
When a new pathogen or AI model arrives, the response is immediate and loud. When longstanding vulnerabilities persist, the response is shrugs and deferred maintenance. That asymmetry is worth examining.
Two news items crossed the wire this week with a striking structural resemblance. Neither, on its own, would seem to demand a broader column. Together, they raise a question worth sitting with.
The first: a confirmed hantavirus outbreak aboard a ship — the first such maritime transmission on record. Public health experts are now racing to draft guidance for vessel sanitation, crew quarantine protocols, and passenger notification procedures. The timeline in current reporting suggests these protocols did not exist before the outbreak occurred.
The second: Anthropic's Mythos model arrived in enterprise environments and triggered what industry observers described as "cybersecurity hysteria." Banks, software companies, and government agencies scrambled to assess exposure. But security researchers, many of them quoted in trade publications this week, were quick to note the uncomfortable truth: the threats Mythos was allegedly enabling were already present. Unpatched systems. Credential reuse. Supply chain dependencies that have been exploitable for years.
The pattern is familiar enough that it barely registers as noteworthy. A novel arrival — pathogen or AI model — produces an immediate, loud institutional response. Meanwhile, the structural conditions that made the harm possible persist quietly, deferred, underfunded, unaddressed.
The Novelty Premium
This is not a criticism of the experts drafting ship-borne hantavirus guidance. Outbreaks require response; protocols need to exist before they can be deployed. The issue is the sequencing. Hantavirus had been circulating. The conditions for maritime transmission had been present every time a vessel carried rodent contamination from port to port. The guidance did not exist because the threat had not yet been dramatized by a visible cluster of cases.
The cybersecurity version follows the same script with different actors. The panic around Mythos reflects something real — organizations do need to assess new model capabilities against their threat models. But the researchers pointing out that the underlying vulnerabilities predate Mythos are making a structural argument, not a dismissive one. If the infrastructure had been hardened, the arrival of a capable AI model would be a different kind of problem: one of incremental adjustment rather than emergency reassessment.
It is the novelty premium that distorts the allocation of attention and resources. A new pathogen gets international coordination within days. Years of underfunded municipal sanitation infrastructure — which produces far higher cumulative disease burden — does not.
The Infrastructure That Nobody Funds
In both cases, the gap is between the dramatic intervention and the unglamorous maintenance that prevents the dramatic intervention from being necessary. Maritime biosecurity protocols that would have slowed hantavirus transmission were absent because writing and testing such protocols generates no headline until an outbreak forces the issue. Cybersecurity hygiene that would have limited the blast radius of AI-enabled attacks exists in patchy, organization-specific form because the work of maintaining it is invisible, iterative, and chronically under-resourced.
The organizations now scrambling to assess Mythos exposure are largely the same organizations that have, in many cases, deferred basic security upgrades for budget cycles at a time. The AI model is new. The vulnerability is not.
This is not a revelation. Security researchers have made the "the threat is already here" argument in every major breach cycle since the early 2000s. The pattern recurs because the incentive structures do not change. Maintenance does not generate the same urgency as crisis. Prevention does not produce the boardroom moment that response does.
What Would Change the Calculus
The honest answer is that the calculus does not change easily. The industries and institutions best positioned to act preventatively are, by definition, those that have not yet experienced the failure that would justify the expenditure in the minds of budget-holders. This is not irrational — it is the standard logic of risk assessment when the costs of prevention are certain and immediate while the costs of failure are probabilistic and deferred.
What the Mythos episode and the ship-borne hantavirus outbreak share, then, is not a solution — they are different problem domains with different institutional structures — but a diagnostic. Both episodes tell us something about how organizations allocate attention. The allocation follows the drama, not the data. Persistent vulnerabilities accumulate in the gap between crises. The gap is where the real exposure lives.
The experts drafting maritime hantavirus guidance deserve support. The organizations hardening their infrastructure in response to AI model risk deserve credit for moving before a breach forces the accounting. But the column worth writing is not about Mythos or the ship. It is about the infrastructure nobody funds until the headlines demand it.
That story does not change because the pathogen or the model changes. It changes when the incentives do.
Wire provenance
This editorial synthesis draws on the following public wire/social posts:
- http://reut.rs/4uX5Ynp