Five Eyes agencies warn of serious AI-powered attacks in ‘months not years’

Organisations should begin incorporating AI into their own defensive operations

Western intelligence agencies have warned that advanced AI could soon enable a new generation of cyberattacks, potentially exposing governments and businesses to threats sooner than many experts had anticipated.

In a joint statement, the heads of the Five Eyes cybersecurity agencies - representing the UK, US, Australia, Canada and New Zealand - said the most advanced AI systems are developing at a pace that could fundamentally reshape the cyber threat landscape within months rather than years.

The agencies said that frontier AI models are likely to surpass current expectations for both offensive and defensive cyber capabilities, accelerating the severity of online attacks.

"While AI will help us improve cyber defence over time, it also accelerates the speed, scale and sophistication of cyber threats," the agencies said in an unusually direct assessment.

They warned that the timeline for these changes is "not years, it is months".

Exploiting weaknesses

Western security agencies have become increasingly concerned that rapidly evolving AI technology could enable hostile governments and criminal groups to identify vulnerabilities in digital networks, develop malicious software and launch cyber operations more efficiently than before.

GenAI systems have already demonstrated an ability to analyse software code, identify vulnerabilities and suggest fixes.

Security experts say newer models are increasingly capable of producing the code needed to exploit those weaknesses.

Olivia Shen, an expert in national security and artificial intelligence at the University of Sydney's United States Studies Centre, said recent advances have raised concerns among policymakers and cyber security professionals.

"What's different about the latest [AI models] ones is they're very good at generating exploits," she said.

Although the Five Eyes statement did not name specific companies or AI systems, attention within the cyber security community has focused on a new generation of specialised models designed for security research.

Among them is Fable 5, an AI system developed by Anthropic. The model was introduced as a neutered version of Mythos, a more powerful cyber-focused system that was previously restricted to vetted organisations because of concerns about potential misuse.

Earlier this month, the US government suspended access to both systems for foreign nationals, citing national security considerations.

Shen said the focus on a handful of publicly known models may overlook developments happening elsewhere.

"We can only see what's been released but there could be other models being developed by the likes of China, or other states and other actors and companies, that are just as advanced," she said.

Incorporate AI into defensive operations

The Five Eyes agencies said organisations should move beyond traditional cybersecurity measures and begin incorporating AI into their own defensive operations.

The statement also urged company boards and senior executives to treat cyber resilience as a strategic priority, ensuring systems and response plans can withstand real-world attacks.

Richard Horne, chief executive of the UK's National Cyber Security Centre (NCSC), said the growing capabilities of AI require a significant shift in how organisations approach cyber defence.

"Our shared position with international partners on what frontier AI means for cyber security is clear: recent developments are shifting the global threat landscape, and it is crucial that defenders keep up," he said.

"It is more important than ever that every member of an organisation, from the board to the IT desk, work towards a shared mission: keeping our online world secure from those who would harm it."

Gary Barlet, public sector CTO at security vendor Illumio said: “What worries me is that too many organisations still think they can patch their way out of this problem. We couldn't keep up before AI, and we certainly won't keep up after it.

“Attackers have always had the upper hand because they don't operate under the same constraints as defenders, and that's even more true in the age of AI. It's time for organisations to stop treating a breach as a possibility and start treating it as an inevitability."