The Warning
In a rare joint public statement dated June 22, 2026, the cybersecurity agencies of the Five Eyes intelligence alliance — the United States, United Kingdom, Canada, Australia, and New Zealand — warned that frontier AI models capable of launching sophisticated cyberattacks are approaching critical capability thresholds faster than most organizations have prepared for.
"The timeline is not years, it is months," the agencies said.
The statement was signed by the heads of the US Cybersecurity and Infrastructure Security Agency (CISA) and National Security Agency (NSA), the UK's Government Communications Headquarters (GCHQ), the Australian Signals Directorate, Canada's Communications Security Establishment, and New Zealand's Government Communications Security Bureau.
What the Warning Says
The Five Eyes guidance frames AI as both the threat and the solution. "Adversaries are already using AI to move faster and more effectively," the statement reads, but "organizations that integrate AI tools into their security operations can detect vulnerabilities earlier, improve software quality, monitor unusual behaviour, and respond faster to incidents."
Key recommendations include: - Reduce attack surfaces by limiting unnecessary system access - Accelerate patching processes as AI shortens the window between vulnerability discovery and exploitation - Address legacy systems, which are described as "strategic liabilities" - Strengthen identity and access controls - Prepare for incidents before they happen and assume breaches will occur
CISA separately announced it is requiring federal agencies to patch AI-exploitable vulnerabilities within three days, rather than the standard 15.
Broader Context
The statement arrives after several major AI security incidents this year. Programs like Anthropic's Project Glasswing and OpenAI's Trusted Access for Cyber Program exist to give defenders access to the same AI capabilities.
Industry Reaction
The warning is considered the most authoritative public statement on AI cybersecurity risk ever published. When NSA and GCHQ jointly say "months, not years," they are drawing on classified threat assessments. The core message: act now rather than waiting for formal regulation to catch up.
