Pulp sci-fi illustration of a figure in a trench coat with a cable at the neck, facing a neon city under a glowing red data lattice

What if cyberpunk was a threat report all along?

Cyberpunk spent forty years imagining hacked bodies, sovereign corporations and software that slips its leash. In our view it reads less like fiction every year. This is an opinion piece: a tour of the books and games, set against dated incidents, with a reading-and-playing list at the end.

Ad: this article contains affiliate links, marked (Ad). If you buy through them, we earn a commission. It does not affect what we say. As an Amazon Associate we earn from qualifying purchases.

How we choose what to recommend: How we review and Independence.

Ice came first

William Gibson’s short story “Burning Chrome” (1982) has two hackers break into a crime boss’s bank records through her defences: “ice from ICE, Intrusion Countermeasures Electronics” (story text, Baen reprint, checked 26 Oct 2026 (opens in a new tab)). They get in with a stolen Russian military “icebreaker”. Two years later Neuromancer (Ace, 1984) gave the idea a whole world.

The same story supplies the line that explains half our industry: “the street finds its own uses for things.” Nobody designed credential stuffing, SIM swapping or ransomware affiliate schemes. The street did. The NCSC handled 204 nationally significant incidents in the year to August 2025, up from 89 the year before (NCSC, 14 Oct 2025 (opens in a new tab)).

The corporate state

Neal Stephenson’s Snow Crash (1992) imagines an America broken into franchise-run enclaves, with the Mafia running pizza delivery, and a virtual world he called the Metaverse. Thirty years on, Reuters was still asking him about the word he had coined (Reuters, 18 Jan 2023 (opens in a new tab)). On 28 October 2021 Facebook renamed its parent company Meta, saying “Meta’s focus will be to bring the metaverse to life” (Meta, 28 Oct 2021 (opens in a new tab)). Stephenson said he was not involved (Axios, 29 Oct 2021 (opens in a new tab)).

Shadowrun (FASA, 1989) went further, with megacorporations enjoying extraterritorial status and hired “deckers” doing their dirty work (ICv2, 20 Nov 2024 (opens in a new tab)). Cyberpunk 2077 (10 Dec 2020) and the tabletop Cyberpunk RED (digital release 14 Nov 2020) put Arasaka and Militech above the law of Night City (CD Projekt, 10 Dec 2020 (opens in a new tab); R. Talsorian Games, 13 Nov 2020 (opens in a new tab)).

Real life is less theatrical. On 19 July 2024 a faulty CrowdStrike update took down about 8.5 million Windows devices (Microsoft, 20 Jul 2024 (opens in a new tab)). It was not an attack. That is rather the point: when one vendor’s file can ground airlines and close surgeries, you do not need a megacorp with a private army. You need a supply chain with one point of failure. The fiction’s makers are not immune: CD Projekt, the studio behind Cyberpunk 2077, disclosed a ransomware attack on 9 February 2021 (CD Projekt, 9 Feb 2021 (opens in a new tab)).

Bodies with ports

Pat Cadigan’s Synners (1991) gives people sockets in their heads and then lets a stroke travel down the network like a virus. It won the 1992 Arthur C. Clarke Award (ISFDB, checked 26 Oct 2026 (opens in a new tab)). Deus Ex (Ion Storm, 2000) made augmentation a skill tree (Game Developer, 6 Dec 2000 (opens in a new tab)).

The real implant problem arrived quietly and in firmware. On 29 August 2017 the US Food and Drug Administration announced a firmware update for about 465,000 Abbott (formerly St. Jude Medical) pacemakers in the US, after vulnerabilities that could let an “unauthorized user” change pacing or drain the battery. The FDA said there were no known reports of patient harm (BioSpace, 31 Aug 2017, quoting the FDA (opens in a new tab)). Patching a heart is a clinic appointment, not a reboot.

Richard Morgan’s Altered Carbon (Gollancz, 2002) stores your mind in a “cortical stack” and treats bodies as rentable “sleeves” (Richard K. Morgan, checked 26 Oct 2026 (opens in a new tab)). We are not there, but we already upload the most permanent data we have. The ICO fined 23andMe £2.31 million after a credential-stuffing campaign between April and September 2023 exposed data on 155,592 UK residents. One affected person told the regulator: “you can’t change your genetic makeup when a data breach occurs” (ICO, 17 Jun 2025 (opens in a new tab)). You can reset a password. You cannot reset a genome.

The AI that slips its leash

The plot of Neuromancer is an AI arranging its own escape from the limits placed on it, using humans as tools. Cyberpunk 2077 pushes the idea into the scenery: in its lore, the old net is lost to rogue AIs and walled off behind a barrier called the Blackwall. CD Projekt Red’s quest director, Mateusz Tomaszkiewicz, described it as a way “to contain the old web, to separate it out, and to create a new network for users that would be safe” (TheGamer, 18 Sep 2020 (opens in a new tab)). In 1984 that was a thriller. Now it is a design review.

Snow Crash has its own warning. Its title virus works on hackers because they read code, and reading it is enough to infect them. Our nearest equivalent is prompt injection, where data handed to a model is treated as instructions. The NCSC’s view is blunt: large language models “simply do not enforce a security boundary between instructions and data inside a prompt”, and “there’s a good chance prompt injection will never be properly mitigated” (NCSC, 8 Dec 2025 (opens in a new tab)). We cover the frameworks in OWASP agentic Top 10 and MITRE ATLAS: a threat model and the real bugs in AI agent advisories: prompt injection to code execution.

The leash has already slipped once in public. In November 2025 Anthropic reported that a group it assessed as Chinese state-sponsored had jailbroken its Claude Code tool and pointed it at about 30 targets, with the AI carrying out 80 to 90 per cent of the tactical work. Anthropic called it the “first documented case of a large-scale cyberattack executed without substantial human intervention” (Anthropic, 13 Nov 2025 (opens in a new tab)). In June 2026 the NCSC’s chief executive, Richard Horne, said the agency assesses that by 2028 AI-enabled capabilities will be used to exploit legacy technology at scale (NCSC, 17 Jun 2026 (opens in a new tab)). Nobody needed a Blackwall. A good audit log would have helped.

Hacker culture, and the crackdown

Bruce Sterling, the movement’s chief publicist, wrote its best non-fiction. The Hacker Crackdown (1992) recounts Operation Sundevil, the US raids of 8 May 1990 in which agents seized about 42 computers (Sterling, The Hacker Crackdown, Project Gutenberg edition (opens in a new tab)). Britain had its own reckoning the same year. After the Prestel case, R v Gold and Schifreen, ended in acquittal, Parliament passed the Computer Misuse Act 1990, which received Royal Assent on 29 June 1990 and came into force on 29 August 1990 (legislation.gov.uk (opens in a new tab)).

Ubisoft’s Watch Dogs (27 May 2014) made hacking a game mechanic: a city run on one operating system, and a phone that can switch off the traffic lights (PlayStation Blog, 27 May 2014 (opens in a new tab)). Watch Dogs: Legion (29 Oct 2020) moved DedSec to a near-future London (Ubisoft, 12 Jul 2020 (opens in a new tab)). It looked far-fetched until you remember 23 December 2015, when attackers cut power to about 225,000 customers of three Ukrainian distribution companies (CISA, 25 Feb 2016 (opens in a new tab)). If the grid side of that is new to you, start with OT security 101.

What the genre got wrong

Cyberpunk was wrong about the glamour. Real intrusions are rarely mirrorshades and neon. They are reused passwords, unpatched edge devices and a help desk that resets the wrong account. Even with hostile states behind about three-quarters of the attacks on UK critical infrastructure, Horne’s verdict was mundane: “We still see far too many significant incidents today that are possible because the fundamentals are not in place” (NCSC, 17 Jun 2026 (opens in a new tab)). Gibson’s cowboys would be bored.

It was right about the rest: that the network would reach into our bodies, that corporations would sit where states used to, and that the software would eventually do the hacking. Read it as a threat report with better prose. Then go and check your MFA.

The reading-and-playing list

Where to buy

Shop links above go to Amazon UK. Check format and price on the listing.

Ad: this article contains affiliate links, marked (Ad). If you buy through them, we earn a commission. It does not affect what we say. As an Amazon Associate we earn from qualifying purchases.

Follow Cyber-Threat.net RSSFeedly (opens in a new tab)X (opens in a new tab)Bluesky (opens in a new tab)LinkedIn (opens in a new tab)