A Five Eyes warning about autonomous AI hacking reflects a structural shift in who can cause serious harm, not just how.
Summary
- Five Eyes agencies have jointly warned that AI models are increasingly capable of autonomously conducting cyberattacks with minimal human direction.
- The core problem is not AI itself but the widening gap between skill and ability — AI lets people cause harm that once required deep expertise.
- Guardrails on major AI platforms offer limited protection; open-source models without restrictions will spread in the same way hacking tools did in the 1990s.
- The same AI capabilities that enable attacks — finding vulnerabilities, reviewing code — are also the foundation of stronger defence.
- Standard security advice remains valid but must be executed with greater urgency given how quickly AI is changing risk assumptions.
A Familiar Warning, a Shifting Context
Last week the Five Eyes intelligence alliance — the United States, United Kingdom, Australia, Canada and New Zealand — released a joint statement on the cyber risks posed by AI models. The statement was measured in tone, and the recommendations it contained will be recognisable to any practising security professional. What the agencies acknowledged themselves, however, is that the advice is not new. What is new is the speed at which the underlying threat environment is changing.
The Skill-Ability Gap
Security commentator Bruce Schneier frames the central issue as a decoupling of skill from ability. For most of history, the two were effectively the same thing — you could only do what you had learned to do. Computers began separating them, and AI is accelerating that separation dramatically. The classic example from earlier decades is the ‘script kiddie’: an attacker with little technical knowledge who nonetheless caused real damage by running tools written by others. The pool of potential attackers grew as those tools became more capable and more widely available. AI continues that trajectory at a far greater pace.
What Today’s Models Can Do
According to Schneier, today’s AI systems — not only the most capable frontier models but most of the field — are able to carry out cyberattacks automatically. They can autonomously hack into networks, steal data, deploy ransomware and destroy systems with minimal prompting. Skilled attackers can direct these tools more precisely, but the tools are increasingly effective even without expert guidance. That is a meaningful change in the baseline capability of an unsophisticated or opportunistic attacker.
Why Guardrails Are Not a Long-Term Answer
The major AI developers — OpenAI, Anthropic and others — are investing in controls designed to prevent their models from answering questions that could enable harm. Schneier’s argument, and it is a reasonable one, is that this approach has an inherent ceiling. Smaller, cheaper, open-source models that run locally are already competitive with frontier models in many capabilities, and those models can be distributed without any restrictions at all. History suggests they will be, in the same way that attack tools circulated freely decades ago. Monitoring prompts on commercial platforms may buy some time, but it does not address the broader availability problem.
The Knowledge Cannot Be Separated
There is no clean technical fix that removes harmful capability while preserving beneficial use. AI models that can review code and identify vulnerabilities are, by necessity, drawing on the same knowledge as models that can exploit those vulnerabilities. The same is true in medicine, engineering and every other domain where expertise cuts both ways. Restricting what AI can know well enough to prevent misuse would also destroy the defensive value. That tradeoff is one security leaders need to understand clearly when evaluating AI risk.
The Defence Opportunity
The Five Eyes statement points to AI as a tool for strengthening defence across multiple dimensions: detecting vulnerabilities earlier, improving software quality, monitoring for unusual behaviour, and responding to incidents faster. Schneier endorses this framing. The organisations that deploy AI effectively on the defensive side stand to reduce both the frequency and the impact of incidents. The question for security leaders is whether their defensive adoption of AI is keeping pace with the offensive capabilities being made available to potential adversaries.
Risk Assumptions Have a Shorter Shelf Life
Perhaps the most operationally significant line in the Five Eyes statement is this: the rapid pace of frontier AI development means cyber risk assumptions can become outdated in months, not years. For CISOs, that has direct implications for how often threat models should be revisited, how threat intelligence is incorporated into planning cycles, and how quickly the organisation can adapt its controls when the environment shifts. The advice from 1998 is still sound. The tempo at which it must be applied has changed substantially.
Why it matters
CISOs are accustomed to managing a threat landscape that evolves gradually. The combination of AI capability improvements and open-source model distribution means that the population of actors who can cause serious harm is growing faster than traditional threat modelling accommodates. Organisations that are still treating AI-assisted attacks as an emerging or future concern need to reassess. Equally, the defensive applications of AI — automated vulnerability detection, code review, anomaly monitoring — represent a genuine and immediate opportunity to improve security posture. The risk is symmetric, and the organisations that recognise that earliest will be better positioned.
What to do now
- Revisit your threat models on a shorter cycle — the Five Eyes advise that AI risk assumptions can become outdated within months rather than years.
- Evaluate and deploy AI-assisted defensive tooling across vulnerability detection, code quality assurance, behavioural monitoring and incident response.
- Do not rely solely on the guardrails of major commercial AI platforms as a control; assume capable adversaries have access to unconstrained open-source alternatives.
- Ensure existing foundational security controls — patching, access management, network segmentation — are being executed with consistent discipline, as these remain the basis of the Five Eyes recommendations.
- Prepare your organisation to adapt continuously rather than reach a fixed state of readiness, given the pace of change in both AI capability and adversary technique.
