The immune system that kills you was doing everything right.
A woman who nursed her mother through cancer develops, after the remission, a habit of attention to her own body that does not stop. It began as something useful: she caught two things early that turned out to be nothing, but catching them early was right. The habit acquired evidence for its own necessity. Now, three years later, she checks herself for symptoms daily, interprets any ambiguous sensation as a warning sign, and has been to the emergency room four times for conditions her body manufactured from the vigilance itself. The system that saved her mother, running at full intensity in a context where there is nothing left to detect, has become the illness.
The immunological version of this is called a cytokine storm: the body’s defense response, having identified a threat, recruits more fighters than the threat warrants, and the fighters do more damage than the invader did. Severe COVID deaths were often this. The virus was manageable; the immune system’s response to it was not. The body was not passive in its own death. It was aggressively, competently, fatally defending itself.
Two ways to fail
Defense systems have two failure modes. The first is insufficient activation: the threat arrives and nothing responds. The second is insufficient discrimination: the response activates but cannot distinguish self from other, danger from safety, the actual threat from its representation. The first failure gets most of the attention because it is legible — there was a gap, the gap was exploited, close the gap. The second failure is harder to see because it looks like the first failure’s solution. A system with high, sustained activation looks like one that will never fail from insufficient vigilance. That it has already failed in a different direction is invisible to anyone who thinks the danger is not enough defense.
Locally optimal strategies follow the same structure. A behavior that protected against a real threat continues past the point where the threat exists, because the system only knows how to detect the threat’s presence, not its absence. The protectors in No Bad Parts are the same observation from inside: a part that once kept something genuinely dangerous at bay keeps doing what it learned, long after the dangerous situation is gone, because no one taught it to ask whether the job is still necessary. The result is protection that produces the injury it was designed to prevent.
Where the boundary blurs
The regulatory version ran in 2008. After the financial crisis, capital requirements tightened, leverage constraints multiplied, and banks moved risk off their balance sheets — the intended effect. The risk didn’t disappear; it relocated to shadow banking — money market funds, repo markets, structured vehicles — which was less regulated precisely because it didn’t look like a bank. The defense perimeter moved; the territory it defended shrank; the risk outside it grew. Each regulatory measure was correctly calibrated against the threat it was designed to see. Together they redistributed risk toward the threat they couldn’t see.
In geopolitics, nationalist movements face the same problem in compressed form. They begin with a genuine constituency to protect and a real threat to defend against. But “the people” is a boundary that must be policed, and policing it requires defining who doesn’t qualify. The boundary narrows to maintain clarity; the group the movement was protecting gets smaller with each round of refinement; and by the end the most committed defenders are destroying what they came to save. This is not a corruption of the original project. It is the project’s discrimination problem running to completion — the structural pattern in which the powerful collude while the powerless compete, including competition over who is pure enough to count.
What makes it hard to correct
What makes the autoimmune error distinctive is that it never looks like failure from inside the defense system. The woman believes she is being appropriately careful. The regulator is enforcing risk discipline. From inside any of these systems, the vigilance is real, the threat-detection hardware is running, and the case for more attention looks stronger, not weaker, because the system keeps finding problems — which is what the vigilance is manufacturing. The defect is in the boundary between what counts as threat and what counts as self — and that boundary cannot be repaired by increasing vigilance, because more vigilance is exactly what produced the problem.
This is why fragility sometimes grows from the inside rather than arriving from outside. The question that matters is not “are we vigilant enough?” It is “can we still tell what we are defending against?” A system that can answer the second question has something a more vigilant but discriminatorily blind one does not: the capacity to recognize when the defense has become the threat, and to use that recognition before the protection finishes what it started.
Threads to Pull
- Bessel van der Kolk, The Body Keeps the Score — trauma’s signature is a nervous system stuck in threat-detection long after the threat is gone: the same discrimination failure at the somatic level, where the alarm keeps firing into silence.
- Robert Sapolsky on chronic stress — the physiological costs of a threat-detection system that never returns to baseline: why the system designed to save your life, run continuously, runs you into the ground.
- Philip Tetlock on hedgehog forecasters — forecasters who apply one strong framework over-classify new situations as confirming the pattern; the discrimination failure in expert knowledge.
- Elinor Ostrom, Governing the Commons — institutions that successfully protect shared resources share one feature: they maintain a well-defined boundary between insiders and outsiders without letting the boundary-maintenance become the institution’s primary activity.