Five Eyes Intelligence Warns AI Could Enable Devastating Cyberattacks Within Months
Cyber agencies in the Five Eyes alliance have urged businesses and organizations to prepare, as frontier AI models capable of enabling major cyberattacks could emerge within months.
“As the leaders of the Five Eyes cyber security agencies, we are united in our call to action: the evolving landscape of artificial intelligence (AI) is rapidly transforming cyber risk, and we must act swiftly to remain ahead,” the Five Eyes alliance, comprising the United States, Australia, the United Kingdom, Canada and New Zealand, said in a joint statement.
“Frontier Al models are anticipated to exceed current industry expectations, fundamentally transforming both offensive and defensive cyber capabilities. The timeline is not years, it is months,” the statement added.
The intelligence agencies said organizations should prepare for the possibility of cyber breaches and strengthen defenses by limiting unnecessary access to systems, promptly applying security updates, testing incident-response plans, strengthening identity authentication measures and restricting access to critical infrastructure.
“Breaches will occur. Preparedness helps you contain them quickly and prevent escalation into major operational and financial crises,” the statement said.
The alliance also encouraged businesses and government agencies to incorporate AI tools into their own cybersecurity operations.
“Adversaries are already using AI to move faster and more effectively. Defenders must do the same,” the agencies said. “Organisations that integrate AI tools into their security operations can detect vulnerabilities earlier, improve software quality, monitor unusual behaviour, and respond faster to incidents – reducing both the cost and impact of incidents.”
While the statement did not name any specific company or model, it comes amid heightened scrutiny of advanced AI systems developed by Anthropic.
Earlier this month, the Trump administration blocked foreign nationals from accessing Anthropic’s advanced AI models, including Fable and Mythos, citing national security concerns.
Anthropic’s Mythos model, released earlier this year, is designed to identify vulnerabilities in cyber systems and has been made available only to vetted organizations due to concerns it could be misused. The company has claimed that the AI tool can outperform humans in certain hacking and cybersecurity tasks.
Experts warn that the rapid advancement of frontier AI could democratize sophisticated cyber tools, lowering the barrier for state-sponsored actors, criminal syndicates, and even ideologically driven individuals to launch devastating attacks. “What once required nation-state resources and months of planning could soon be executed by a small team—or a single skilled operator—using AI agents capable of autonomously scanning networks, crafting custom exploits, and maintaining persistence across defenses,” said Dr. Elena Vasquez, a cybersecurity fellow at the Atlantic Council.
The Five Eyes advisory aligns with growing concerns across Western intelligence communities. In recent closed-door briefings, U.S. officials have highlighted how generative AI can produce polymorphic malware that evades traditional signature-based detection, while large language models assist in social engineering at scale. Australia’s signals intelligence agency, ASD, has reportedly observed adversaries experimenting with AI-driven reconnaissance tools that map critical infrastructure vulnerabilities faster than human analysts.
Industry leaders are already responding. Major technology firms, including Microsoft and Google, have expanded their AI-powered security platforms, such as Microsoft Security Copilot and Google’s Mandiant AI, which leverage machine learning to correlate threats across global telemetry. However, integration remains uneven, particularly among small and medium-sized enterprises (SMEs) that lack dedicated cybersecurity teams.
“AI is a double-edged sword,” noted Marcus Hale, former CISO at a Fortune 500 bank. “It amplifies both attackers and defenders, but the advantage currently tilts toward those who adopt it first. Organizations ignoring this risk being left behind in what amounts to an arms race.”
Beyond technical measures, the statement implicitly calls for enhanced public-private collaboration. Governments are encouraged to share threat intelligence more fluidly with industry, while businesses must invest in workforce upskilling. Training programs focused on AI-augmented red teaming and blue teaming are gaining traction, with several universities launching specialized certifications.
The Anthropic example underscores the tension between innovation and control. By restricting access to models like Mythos and Fable, the U.S. aims to prevent proliferation to adversarial nations such as China and Russia, where state-backed AI programs are accelerating. Yet critics argue that over-restriction could stifle domestic innovation and cede ground to competitors.
As frontier models approach or surpass human-level performance in offensive cyber operations, the Five Eyes message is clear: complacency is no longer an option. Businesses and governments must treat AI-driven threats as an imminent reality, not a distant hypothetical. Proactive investment in resilient architectures, zero-trust frameworks, and continuous AI-enhanced monitoring will determine who survives the coming wave of AI-powered cyber conflict.
The alliance pledged ongoing updates and joint exercises to simulate these emerging scenarios, emphasizing that collective preparedness remains the strongest deterrent in an increasingly contested digital domain.
