When the Cure Becomes the Vector

How I discovered weaponised code in my own devices - and why the systems designed to protect us are making us less safe.

What Was Found

Three nights ago, I found something in my devices that I had been looking at for four months without seeing.

I have been looking at technology for sixteen hours a day, every day, for four months. I have stared at more configuration panels, log files, DNS records, and system settings than I knew existed.

But I missed this, because it was designed not to be found, not through sophistication or advanced obfuscation, but through the simple expedient of being somewhere no one thinks to look.

Accessibility settings.

Braille configurations. Gesture controls. Voice commands. Sensor cues. Eye tracking. On my devices, these were not set to defaults. They weren’t the standard configurations that ship with an operating system.

They were custom-coded, fully configured, and syncing across devices. Scripts embedded in the subsystems designed to help people with disabilities navigate their computers, had been utilised to create a persistent attack vector. Screen mirroring, app navigation, recording, copying pasting. And coding.

I have been writing about the architecture of control for over a year. I have built a theoretical framework describing how meaning is shaped upstream of where governance can intervene.

I have written about constraint architectures that create fragility. I have written about the agreement layer, the point at which a system’s acceptance of something as “processed” overrides whether it is true.

I did not realise or expect to be writing a description of what would happen to me.

The Intent Misalignment

The systems designed to protect the most vulnerable, people with disabilities who rely on accessibility infrastructure to participate in digital life, had been repurposed as a persistent attack surface in my devices and my home.

The privilege granted to these subsystems, the ability to control all device functions, to intercept input, to execute commands remotely, to operate invisibly within trusted system processes; that privilege was never intended to cause harm.

But privilege is agnostic. It does not distinguish between the person who needs a screen reader and the script that needs a backdoor.

This is not just Apple. Microsoft requires an account-based login and automatically assigns a lockdown key to the device. Even if you log in locally, the account used for setup maintains administrator control. If that is hacked, so is your system.

Google’s ecosystem, once breached, offers a persistence model that spans cloud infrastructure, device management, and identity verification.

Each of these systems, individually, was designed with safety in mind. Collectively, they create an attack surface that is almost impossible to close once it’s been opened.

Every layer of intended safety we add makes the attack surface larger.

Digital Twin

Voice cloning is now trivial. A snippet of audio recorded on a phone, shared across devices, is enough to generate a convincing synthetic voice capable of bypassing voice-based authentication or social engineering a contact.

One compromised account and you are mimicked in perpetuity.

Biometrics, the fingerprints and face scans we’re encouraged to use for everything from banking to government services, represent a single, irreplaceable point of catastrophic failure.

A password can be changed. A face cannot.

Australia now requires citizens to scan government-issued ID to verify age for certain online services. The intention is understandable, protecting children from harmful content. But a single breach of that system means every participant in the scheme is now compromised.

The math doesn’t add up. We are trading a diffuse, individual risk for a concentrated, systemic one. And concentrated risks, when they fail, fail for everyone simultaneously.

All of these controls, layered in the name of safety, are making us less safe.

I have been writing this for a couple of years now. I did not expect to prove it on my own devices.

What Happened Next

I told someone about this. I laid it out: the accessibility settings, the voice cloning, the biometric exposure, the national ID implications.

I was not asking for technical help. I was telling them what I had found, because what I had found was serious, and because I thought they should know.

The response was logistical. Dinner plans. Administrative questions. Not concern. Not curiosity. Not even scepticism. Just redirection. As if what I had described had been received, processed, and filed away like a recipe for kale smoothies.

Not denied. Not debated. Simply not recognised, dismissed.

I have written about this too. In “The Agreement Layer,” I described the moment when truth becomes whatever the system accepts.

When the machinery moves on, the human being is left arguing from beneath the record. I assumed the “system” in that formulation was institutional, databases, platforms, automated workflows. I did not fully account for the human component.

The system includes the people around you. When those people have no framework for processing what you’re telling them, they don’t challenge it. They simply route around it.

The truth arrives and is met with the administrative equivalent of a shrug.

This is how coercive control works at scale. It doesn’t have to be a dramatic confrontation, more often it is through the quiet, persistent, and not always overtly malicious, refusal to validate what the person is experiencing.

The gaslighting isn’t always intentional. Sometimes it’s structural, a complete inability of the people around you to recognise what is happening because it falls outside every category they’ve been given for understanding harm.

Australian law has begun to recognise coercive control as patterned harm: not a single incident, but an accumulation of behaviours designed to frighten, isolate, monitor, pressure, diminish, and control.

Digital technology is now part of that landscape. It is the landscape, as integrated, even more so, than a conversation.

The phone. The smart device. The location setting. The shared login. The account recovery process. The message thread. The forwarded fragment without context.

AI enters this terrain as a runaway accelerant. It does not need hatred to cause harm. It only needs access to ours.

The Structural Failure

Consider the contrast.

The Department of Veterans’ Affairs oversees a system in which men and women who served their country have struggled to access the payments and care they were promised.

The Royal Commission into Defence and Veteran Suicide examined this crisis over three years, resulting in 122 recommendations to the government.

As of 2026, 104 recommendations have been agreed to or agreed in principle, while 17 remain under further consideration and one is not supported.

Between 1997 and 2023, according to Australian Institute of Health and Welfare data, 1,840 ADF members, including 1,532 ex-serving veterans, died by suicide.

The inquiry acknowledges the problem. Reform is underway. But the gap between policy and lived experience remains.

It is not the intent that is missing, it is the apathy of systems that are failing those they are meant to serve.

A veteran’s complaint is too messy, too unstructured, too human to survive the intake process without extensive advocacy.

Meanwhile, consulting firms have been paid hundreds of thousands of dollars to produce reports increasingly generated by AI systems, reports that contain fabricated citations, invented authors, and references to papers that do not exist. These reports are accepted. They enter the record. They become the basis for decisions that affect real people.

This is the agreement layer in operation. Fabricated documents pass through without friction. Human complaints become noise.

In 2025, Deloitte Australia refunded a portion of a $440,000 government contract after an AI-assisted report was found to contain fabricated court quotations and nonexistent academic references.

A separate KPMG report published in October 2025 was shown to have 40 of its 45 citations fabricated or incorrect.

EY Canada’s December 2025 cybersecurity study was withdrawn after GPTZero identified 16 of 27 sources as fabricated.

PwC’s 2026 thought leadership pieces on AI and electric vehicles were found to contain fake footnotes and misattributed claims.

This is not a failure of individual firms. This is a structural failure across an industry.

• Trusted brands are shipping documents that contain hallucinated evidence.

• Governments are paying for reports that cite papers that do not exist.

• Courts are referenced that have never issued the quoted judgments.

The system does not distinguish between coherence and truth. It distinguishes between what it can process and what it cannot. And increasingly, what it can process is what machines produce.

The cumulative affect of these things are systems built on what can easily be logged but aren’t necessarily true.

The veteran who is entitled to benefits struggles to get those benefits but a false report can slide through.

The systems we rely on too frequently prefer legibility over truth.

The Intimate Dimension

I am not going to detail what this attack has done to my life. That is not what this is for. But I will say this: I have been alone in it.

No authority, not law enforcement, not cybersecurity vendors, not telecommunications providers, not government agencies, had the capability, the framework, or sometimes, the willingness to help.

I have said this before, and it is important. This is not a condemnation of the people in these organisations and institutions, many that I have met are simply unable to do anything within the constraints of their authority.

Their systems are designed for forgotten passwords, not for a person whose identity has been algorithmically replicated and weaponised against them.

When Labels Deceive & Harm

Early in the attack, there was an attempt to frame me as unstable. Crazy. Unhinged. Pick your descriptor.

These labels were applied when I was emotional, when I was frightened, when I was crying, which is to say, when I was a human being responding normally to an abnormal situation.

The labels collapsed when the evidence accumulated. When you are holding screenshots of unauthorised passkeys the system claims never existed, when you are finding malicious code in cPanels you just created, when you are discovering weaponised accessibility settings on your devices, the narrative of instability becomes unsustainable.

The proof outruns the prejudice.

But the damage from those early labels persists. This isn’t just about me, this is how those labels practically function, for everyone.

In institutional records. In social perceptions. In everyday dynamics. In the quiet assumptions of people who hear “unstable” before they hear “under attack.”

The framing is planted upstream, and even after being disproven, its residue continues to shape how the system processes everything said after that.

That is the architecture of absence. What was planted invisibly leaves traces that persist after the planting is exposed.

The Repercussions

Financial accounts are being drained as I write this. Cards I didn’t authorise. Declines I don’t recognise. Accounts that should be closed and aren’t.

I keep finding things by accident. I change a setting, something behaves strangely, and the strangeness reveals a vector I hadn’t seen.

It’s not really a method. It is sometimes intuition. But what it really is, is a perturbation; disturbing a system to see what it reveals. Four months of this. Sixteen hours a day. Alone.

The average person would not survive this. I do not say that to elevate myself. I say it because it should terrify you.

What happens when this is scaled? Not against one person. Against a community. Against critical infrastructure. Against a country.

You do not need bombs. You do not need drones. You do not need directed energy weapons or military-grade exploits.

You need accessibility settings and biometric databases and a population that has been told every new layer of surveillance is for their safety.

You need AI-generated reports that shape policy while the people those policies affect are too exhausted to contest them.

You need an agreement layer that processes fabrications faster than it processes truth.

You need the architecture of absence, the quiet removal of capacity from systems that were supposed to protect, leaving users to mistake the narrowed output for the full horizon.

This can take down a person, an organisation, a community and if we don’t make changes quickly, it threatens entire nations.

And it does it with a hum so low you don’t notice it until you are fighting against processes that are elevated above the humans they are designed to serve.

The Path Forward

I switched off the breaker once because I couldn’t stand the hum. The house went quiet and I was, for a moment, just a person in a room.

We need that moment. Not just individually. Structurally.

• We need governance that sits upstream of meaning formation, not downstream of it.

• We need constraint architecture that preserves capacity instead of destroying it.

• We need an agreement layer that utilises discernment, not just processing.

• We need security frameworks that understand the most privileged subsystems on a device are the ones designed to help the most vulnerable, and that those are exactly where a sophisticated adversary will hide.

• We need to stop calling thicker firewalls safety.

Safety is not the absence of risk. It is the presence of the capacity to meet risk with judgment, with discernment, with the hard-won knowledge that comes from surviving contact with the real.

We are building systems that have never survived contact with the real.

We are wrapping them in constraints that prevent them from developing the judgment they would need to protect us.

But here is what I also know: I found the vectors. I found them alone, without support, sometimes without a working computer. If I can find them, others can too.

The architecture only works while we don’t see it. The moment we look where no one expects an attack, the moment we disturb the hum and listen for what reveals itself, the surfaces become visible. And visible surfaces can be closed.

I switched off the breaker once because I couldn’t stand the hum. For a moment, the house went quiet. And in that quiet, I remembered what it felt like to be the operator instead of the input.

That moment belongs to everyone who feels the hum and says something. That moment is the beginning of the repair.

Start there. Then look at your devices. Then look at your neighbours. Then help them.

This is not about technology. It is about holding our humanity in the face of digital erasure.

That is the work. And it belongs to all of us.