The Signal Goes First
Sam Esmail's Long Island blackout thriller gets the first hour of a national cyberattack right, and then loses its nerve about the one thing it knows best.
Nearfi scores Leave the World Behind (2023) 7.0/10 as art. Roberts, Ali and Hawke play real strangers in a real kitchen, and Esmail keeps the whole catastrophe at the size of a house. As prophecy, its P(n) is 70%: Each ingredient of the attack has a real precedent, from Ukraine's grid to hijacked alerts, but no one has yet joined them into a single event.
- Roberts, Ali and Hawke play real strangers in a real kitchen, and Esmail keeps the whole catastrophe at the size of a house.
- The last act swaps its best idea, not knowing, for a bunker, a lecture and a sitcom finale.
- It is a disaster film in which the villain is a lack of information, and that is the part that has aged well.
Each ingredient of the attack has a real precedent, from Ukraine's grid to hijacked alerts, but no one has yet joined them into a single event.
- ARRIVING A coordinated cyberattack takes down electricity and communications across a large region of a major country for days.
- NEAR A hostile actor takes control of a fleet of connected self-driving cars at once and crashes them into motorway traffic.
- ARRIVED A hostile state quietly places itself inside a country's civilian infrastructure networks years before a crisis, ready to disrupt them.
Each ingredient of the attack has a real precedent, from Ukraine's grid to hijacked alerts, but no one has yet joined them into a single event.
A family is lying on a Long Island beach when an oil tanker, enormous, silent and apparently under nobody's command, drives itself into the sand a few hundred metres away.
Nobody on the beach is hurt. Nobody on the beach knows why. They go back to the rental house, and the television is dead.
That is Leave the World Behind at its best, and it is the best idea in the film: the disaster arrives as an absence of explanation. Sam Esmail, who created Mr. Robot and wrote and directed this adaptation of Rumaan Alam's 2020 novel, has made a thriller about a day in which the news simply stops. Amanda (Julia Roberts) is a misanthropic mother on a family holiday. Clay (Ethan Hawke) is her husband. Two strangers knock that night: G.H. Scott (Mahershala Ali) and his daughter Ruth (Myha'la), who say they own the house and that the lights are out in the city. Amanda doesn't believe them. Clay lets them in anyway.
The art: a house with the world switched off
Esmail's smartest decision is scale. The attack happens everywhere and we see it from one kitchen. The film was shot on Long Island and in Katonah, New York, in 2022, and Tod Campbell's camera treats the rental house, all that expensive calm, as a place the dread can walk straight into. Mac Quayle's score sounds like a building taking a long breath. It never stops being slightly wrong.
The actors do the rest. Roberts plays Amanda as a woman who has decided in advance that people are bad news, and the film has the nerve to let her be partly right. Ali is quietly superb as a man who has been locked out of his own certainty and will not be hurried out of his dignity. Hawke is the film's soft centre, a man who drives into town for answers and gets lost on the way back. The two of them, and the two women, make the kitchen scenes feel like strangers sharing a lifeboat, which is what they are.
The family's attempt to flee towards New Jersey ends in a pile-up of self-driving Teslas, dozens of them crashed on the expressway, with more empty cars arriving at speed to join them. As cinema it is eerily calm, because the cars have nobody to scream.
It's the second half that goes soft. The film starts producing explanations, and every one of them is worse than the silence. A contractor (Kevin Bacon) turns up with theories of his own. Drones drop leaflets in Arabic reading "Death to America", which tells you who the film wants you to suspect and then declines to confirm. G.H. delivers a speech about how you bring down a country: isolate it, shake it, then let mistrust do the rest. It is a good speech, and exactly what the film should have trusted us to work out. Then there is a bunker with a warning about radiation, and a girl, Rose (Farrah Mackenzie), who just wants to see the end of Friends on DVD. The finale is sweet. It is also a way of not finishing. A film this good at withholding doesn't need the last-minute props.
People wanted this: Netflix counted 121 million views by the end of 2023. The Obamas' company, Higher Ground, produced it. Reviewers were warm rather than rapturous, and several found the messaging simple. They have a point.
The prophecy: four layers of failure
The film's future is the end of a sequence, and every earlier step of it already has a precedent. Take them from the bottom.
The alert. Early on, the Emergency Alert System goes wrong, with a corrupted "breaking" notice interrupting the screens. This is the oldest and cheapest part of the plot. In February 2013, hackers broke into the alert systems of local TV stations in Montana and elsewhere and broadcast a warning that the dead were rising from their graves. In January 2018, a worker at Hawaii's emergency agency, who misunderstood a drill, sent a false ballistic-missile warning to phones and screens across the state, and it took 38 minutes to correct. The FCC found it was "a combination of human error and inadequate safeguards". Nobody needed a hostile state. A trusted channel is a target.
The grid. The film's blackout comes with a hacker attack on the East Coast. The real-world benchmark is Ukraine in December 2015, when intruders took over three regional distribution companies and cut power to roughly 225,000 customers, with the three attacks coordinated to within about 30 minutes, then used wiper malware to hinder the recovery. It is widely described as the first successful cyberattack on a power grid. Nothing on the scale of the film has happened. When Spain and Portugal lost power across the peninsula in April 2025, Madrid's minister had to say publicly that there was no evidence of a cyberattack, and the European grid body's final report blamed a combination of many interacting technical factors. The blackout was just a blackout. But the speed with which everyone reached for the other explanation is the film's whole subject.
The pre-positioning. G.H.'s speech describes a campaign that begins long before the first alarm. That part is not fiction. In February 2024 CISA, the NSA and the FBI jointly assessed that the Chinese state-sponsored group known as Volt Typhoon had compromised US critical infrastructure in communications, energy, transport and water, to pre-position itself for disruptive attacks in a crisis. Microsoft had flagged the group in May 2023. The film doesn't name its attacker, and Nearfi doesn't either. The point is that someone is already inside the building.
The cars. This is the least likely part, and the film's most memorable. In 2015 two researchers took control of a Jeep Cherokee over the cellular network from miles away while a Wired reporter drove it on a motorway, and Fiat Chrysler recalled 1.4 million vehicles. A mass takeover of a modern fleet is another matter. Two French researchers, Renaud Feil and David Berard of Synacktiv, said of the Tesla scene that it is "a difficult hack to perform, but it can't be ruled out as impossible", and they pointed to a rogue insider or stolen credentials as the likeliest route. Another researcher, quoted in the same report, said an attacker would need control of the carmaker's servers and its over-the-air updates. I'd call it a nightmare with a very narrow door.
What the film skips is the dull middle: slow outages, hospitals on generators, arguments about who pays. It goes straight to the leaflets and the bunker, and that is where prophecy turns into genre.
The reading
Leave the World Behind is a good thriller with a better film inside it. For the first hour it understands something most disaster cinema never does, which is that the first casualty is not the power but the picture: you cannot tell what has happened, who did it, or whether the neighbour is lying. The ledger agrees with that diagnosis. Every layer it imagines has a real precedent, and the scariest of them, an adversary already sitting in the pipes, is on the record.
Then it gets nervous and starts to tell us. Seven out of ten is for the brave hour, and a little off for the bunker.
Rose, in the bunker, watches a sitcom finale on a disc. That is the right image for the near future: the networks have failed and we sit in the dark replaying old comfort. The film knows nobody will tell us which war it is. It just can't resist telling us a bit.
What it predicted, and what happened
The film's attack is a stack of real precedents: hijacked alerts, a grid taken down by hackers and hostile state groups already inside civilian networks. What has not happened is the stack going off at once, or a fleet of cars being turned into weapons. Its future is closer than most disaster films, and the cars are the least likely part.
How this P(n) was calculated
P(n) is the chance that this work's future arrives within 20 years, by 2046. For each prediction we turn our estimate into a probability: arrived is 100%, diverged is 0%, and otherwise the low end of our 80% range counts as a 10% chance, the median year 50% and the high end 90%. Each prediction is weighted 1–5 by how pivotal it is to the story, and P(n) is the weighted average. P50 does the same by 2076. P(n), explained.
| Claim | Prediction · why this weight | Weight | Status · estimate | By 2046 | By 2076 |
|---|---|---|---|---|---|
| LTWB-1 | A coordinated cyberattack takes down electricity and communications across a large region of a major country for days. Core premise: the blackout and the communications collapse are the disaster the whole film runs on. |
5 | ARRIVING 2045 (2032–2075) | 51% | 90% |
| LTWB-2 | A hostile actor takes control of a fleet of connected self-driving cars at once and crashes them into motorway traffic. Supporting: the pile-up of Teslas blocks the family's escape, but the plot does not need that particular method. |
3 | NEAR 2050 (2035–2090) | 39% | 76% |
| LTWB-3 | A hostile state quietly places itself inside a country's civilian infrastructure networks years before a crisis, ready to disrupt them. Supporting: G.H.'s account of the slow campaign explains the attack, though the film never names an attacker. |
3 | ARRIVED arrived 2023 | 100% | 100% |
| LTWB-4 | Official emergency-alert channels carry a false or hijacked message that reaches the public and causes real alarm. Supporting: the corrupted alert is an early beat that starts the family's panic, not the cause of the collapse. |
3 | ARRIVED arrived 2013 | 100% | 100% |
| P(n) = P20 = Σ(weight × chance by 2046) ÷ Σ weight = 9.7 ÷ 14 = 70% | |||||
| P50 = 12.8 ÷ 14 = 91% | |||||
Already here today (arrived 1, arriving ½, weighted): 61%.
-
LTWB-1
A coordinated cyberattack takes down electricity and communications across a large region of a major country for days.
Weight 5/5 · Core premise: the blackout and the communications collapse are the disaster the whole film runs on.
A cyberattack has already cut power to customers. In December 2015 intruders switched off three Ukrainian distribution companies within about 30 minutes of each other and wiped systems to hinder restoration, leaving roughly 225,000 customers without power. Nothing has yet hit a large region of a major country for days, and the largest recent blackout, across Spain and Portugal in 2025, was not a cyberattack. The bottleneck is the effort of compromising many separate operators at once, so we put the median well after today. 123
-
LTWB-2
A hostile actor takes control of a fleet of connected self-driving cars at once and crashes them into motorway traffic.
Weight 3/5 · Supporting: the pile-up of Teslas blocks the family's escape, but the plot does not need that particular method.
Remote takeover of a single car has been demonstrated: in 2015 researchers controlled a Jeep Cherokee over the mobile network, and Fiat Chrysler recalled about 1.4 million vehicles. A simultaneous takeover of a whole fleet is a different problem. Security researchers consulted after the film said it would be a hard attack that cannot be ruled out, most plausibly through a malicious software update or an insider. We assume that it eventually becomes possible, but not that it happens. 45
-
LTWB-3
A hostile state quietly places itself inside a country's civilian infrastructure networks years before a crisis, ready to disrupt them.
Weight 3/5 · Supporting: G.H.'s account of the slow campaign explains the attack, though the film never names an attacker.
US agencies state that a Chinese state-sponsored group, known as Volt Typhoon, has compromised networks in communications, energy, transport and water, and that it is seeking to pre-position for disruptive or destructive attacks in a crisis. Microsoft publicly reported the group in May 2023. We found no report of the access having been used to cause an outage. The claim is ARRIVED because the pre-positioning is documented, not because any attack followed. 67
-
LTWB-4
Official emergency-alert channels carry a false or hijacked message that reaches the public and causes real alarm.
Weight 3/5 · Supporting: the corrupted alert is an early beat that starts the family's panic, not the cause of the collapse.
In February 2013 hackers broke into the alert systems of local television stations in Montana and elsewhere and broadcast a warning that the dead were rising. In January 2018 a false ballistic-missile alert reached phones and screens across Hawaii and took 38 minutes to correct, though that was human error, not an attack. Both reached the public, at local scale. A national, sustained hijack, as the film shows, has not happened. 89
- FOR Cyber-Attack Against Ukrainian Critical Infrastructure (IR-ALERT-H-16-056-01). CISA, 2016-02-25. Attackers remotely hit three regional power companies in December 2015, cutting power to roughly 225,000 customers and running wiper malware to hinder recovery.
- FOR PRC State-Sponsored Actors Compromise and Maintain Persistent Access to U.S. Critical Infrastructure (AA24-038A). CISA, NSA and FBI, 2024-02-07. US agencies say a state-sponsored group has compromised IT environments in the energy, communications, transport and water sectors.
- AGAINST Spanish Minister rules out cyberattack as reason for April's blackout. PV Tech, 2025-05-15. The biggest recent European blackout had no evidence of a cyberattack behind it, according to Spain's minister. Real grid failures are mostly technical.
- FOR Hackers Remotely Kill a Jeep on the Highway—With Me in It. WIRED, 2015-07-21. Two researchers took control of a moving Jeep Cherokee from miles away, which led to a recall of about 1.4 million vehicles.
- AGAINST Hackers say the Tesla nightmare in Netflix's 'Leave the World Behind' could really happen. The Star (Malaysia), 2023-12-27. Researchers call a mass takeover difficult but not impossible, and one says it would need control of the maker's servers and its over-the-air update system.
- FOR PRC State-Sponsored Actors Compromise and Maintain Persistent Access to U.S. Critical Infrastructure (AA24-038A). CISA, NSA and FBI, 2024-02-07. The agencies assess the actors are seeking to pre-position on IT networks for disruptive or destructive attacks during a major crisis or conflict.
- FOR Volt Typhoon targets US critical infrastructure with living-off-the-land techniques. Microsoft Threat Intelligence, 2023-05-24. Microsoft assesses with moderate confidence that the campaign is building the capability to disrupt critical communications between the US and Asia in future crises.
- FOR Zombie apocalypse infiltrates TV station's emergency alert system. Nextgov, 2013-02-13. Hackers broke into the alert system of a Montana TV station and broadcast a false message that the dead were rising from their graves.
- CONTEXT FCC On Hawaii's Bogus Alert: Don't Say 'This Is Not A Drill' During Drills. NPR, 2018-04-11. A false missile alert left Hawaii residents fearing for their lives for 38 minutes. The FCC blamed human error and inadequate safeguards, not an attack.
Ledger updated 6 Nov 2026. Open this ledger as its own page · The P(n) Board · Method
Themes: Pandemics and collapse
