A 15-step digital hygiene checklist compiled last year by OpenAI co-founder Andrej Karpathy is back in focus. The source article says Anthropic’s newly released Claude Mythos has shown vulnerability discovery ability close to top human experts, pushing personal cybersecurity from a nice-to-have into a basic requirement. For developers, investors, and crypto holders, the margin for delay is shrinking fast.
The checklist is built around a simple idea: fix the obvious weaknesses first. The article frames the threat plainly. Attack costs are dropping, while attack efficiency is rising. That changes the risk equation for anyone holding digital assets, because an account breach, a stolen device, or exposed communications can quickly turn into unauthorized withdrawals or identity abuse.
Start with accounts: passwords, hardware keys, and biometrics
Karpathy places identity security at the top of the list. The first step is to use a password manager to generate unique random passwords for every account, cutting off the common risk of credential stuffing after a service breach. The second is to enable hardware security keys such as YubiKey, with a recommendation to keep 2 to 3 keys in separate places in case one is lost. By comparison, SMS codes are described as more exposed to SIM-swap attacks.
The third step is broad use of biometric authentication, including Face ID and fingerprint login, across password managers, banking apps, and other sensitive apps. The fourth is to treat security questions like passwords: use random answers and store them in a password manager rather than relying on real personal information.
Protect devices and messages with encryption and tighter defaults
On the device side, the checklist recommends turning on full-disk encryption. The article points to FileVault on Mac and BitLocker on Windows, arguing that encryption can sharply limit the damage if a laptop is stolen. It also advises cutting back on smart home devices, on the basis that each connected device adds another possible entry point.
For communications, the article recommends Signal for end-to-end encrypted messaging and suggests enabling disappearing messages on a 90-day timer to reduce the exposure window of old conversations. For browsing, it points to Brave as a privacy-focused alternative intended to reduce everyday tracking.
Separate search, payments, and mailing details from your real identity
Karpathy’s list also moves into search and payment habits. It suggests switching the default search engine to Brave Search, while using “!g” as a shortcut to Google when results fall short. The source notes that the paid version costs about $3 per month.
For payments, the recommendation is to use virtual credit cards that generate unique card numbers for each merchant and allow spending limits. It also highlights virtual mailing address services as a way to avoid giving a real home address to every online store or service used during checkout and registration.
Skip email links, use VPNs selectively, and monitor outbound traffic
The network section is especially practical. One of the clearest rules is not to click links inside emails. The article says sender addresses are easy to fake, and phishing messages are becoming harder to distinguish from legitimate ones with AI assistance. Its preferred habit is to type website addresses manually and disable automatic image loading in email clients to reduce tracking.
Karpathy also recommends using a VPN in specific situations, especially on public Wi‑Fi or while accessing services that are not fully trusted. DNS-level blocking tools such as NextDNS are included because they can stop ads and trackers before they load. Finally, traffic-monitoring software such as Little Snitch is presented as a way to see which apps are connecting out, how much data they send, and whether any behavior looks abnormal.
The article adds that capabilities like Mythos are still largely in defensive hands for now, but argues that similar tools could reach malicious actors in less than 6 months, possibly sooner. In that framing, spending 15 minutes to tighten baseline security is a small cost compared with the damage a compromised account or device can cause.