Intelligence Agencies Say AI-Driven Cyberattacks Are Months Away, Not Years

Cybersecurity and intelligence agencies from the US, UK, Canada, Australia, and New Zealand issued a joint statement warning that frontier AI models capable of significantly escalating offensive cyber capabilities are close to becoming publicly available. The alliance's language was specific about timeline: "the timeline is not years, it is months."

The joint statement said frontier models are "anticipated to exceed current industry expectations, fundamentally transforming both offensive and defensive cyber capabilities." The agencies pointed to legacy systems, slow patching cycles, unnecessary internet-facing connectivity, and weak access controls as the specific weaknesses AI-assisted attacks would exploit first.

A warning aimed at defenders who are already behind

What makes this notable is not that intelligence agencies are worried about AI and cybersecurity, that concern has been standard for years, but the specificity of the timeline and the plainness of the language used to describe it. Joint statements from all five members of an intelligence-sharing alliance are relatively rare, and reserving one for a months-not-years warning signals a level of internal confidence in the assessment that's harder to dismiss as routine caution.

The weaknesses the agencies flagged are not exotic. Slow patching and unnecessary internet exposure are decades-old problems that organizations have failed to fully solve even without AI in the picture. The warning implies that whatever AI-driven escalation is coming will not need a new category of vulnerability to exploit, it will simply automate and scale attacks against the same gaps that already exist today.

That framing puts the burden back on organizations rather than on any single AI lab or model release. If the vulnerabilities are already known and already unpatched, the months-long window the agencies describe is less a countdown to a new threat than a shrinking deadline to fix old ones before they get automated against at scale.

Sources: CyberScoop · CNN · CBC News