Last week, national security agencies from the **Five Eyes** alliance – comprising the U.S., UK, Canada, Australia, and New Zealand – released a joint statement warning of the increasing cyber risks associated with AI models. The core concern revolves around AI's newfound ability to autonomously compromise systems and networks. While the statement's recommendations largely mirror existing cybersecurity advice, its tone conveyed a stark new urgency. This urgency is driven by a fundamental shift in the landscape of cyber threats, exacerbated by AI. ### The Expanding Gap Between Skill and Ability For most of human history, skill and ability were intertwined. Computers, however, began to decouple them, and AI is accelerating this separation dramatically. AI tools empower individuals to achieve more – in writing, research, and analysis, but also in causing damage. These models can, with minimal instruction, autonomously breach networks, exfiltrate data, deploy ransomware, and destroy systems. This phenomenon is not entirely new. In 1998, members of the hacker group **L0pht** testified before Congress, famously claiming they could take down the internet in 30 minutes. Their actions, while partly bravado, underscored that significant hacking capabilities then required deep technical skill. Contrast this with the rise of "script kiddies" – individuals who lacked deep understanding but leveraged pre-written hacking tools. As these tools became widespread, the pool of potential attackers expanded, requiring less skill but still enabling significant damage. ### AI: A Universal Adviser for Harmful Actions Today, AI systems, including many beyond just frontier models, are capable of automatically executing cyberattacks. While skilled attackers can still achieve more, AI increasingly allows for autonomous action with minimal prompting. This means individuals with ability but limited traditional hacking skills can now wield powerful offensive tools. This poses a significant societal risk. Just as a doctor possesses knowledge to poison, or an engineer to demolish a bridge, the acquisition of such skills traditionally came with an ethical framework. AI, however, acts as a universal adviser, democratizing access to harmful capabilities without the inherent ethical checks. Attempts by major AI corporations like **OpenAI** and **Anthropic** to implement guardrails against malicious use are unlikely to succeed long-term. Smaller, cheaper, open-source models, often runnable locally and combinable, are rapidly catching up to frontier models in capability. These open-source alternatives will proliferate without built-in ethical constraints, much like early script kiddie tools. Similarly, efforts to instruct AI models to report malicious prompts are futile in the face of decentralized, locally run open-source models. ### The Defense Dilemma: Shared Knowledge for Attack and Defense Another proposed solution – making AI models inherently incapable of harmful actions – is also problematic. The knowledge required to find and fix vulnerabilities in code is the same knowledge that can be exploited for attacks. We need AI to identify and remediate security flaws, a benefit that could be enormous. However, this same capability can be weaponized. This leaves us in a world of heightened volatility. AI-augmented humans will possess the capacity for both incredible innovation and destructive actions. ### The Path Forward: Urgent Adaptation The **Five Eyes** statement reiterates security recommendations that have been standard for decades. As the agencies themselves admit, the advice isn't new; its urgency is. The rapid pace of AI development means that cybersecurity assumptions can become obsolete in months, not years. The call to action is to anticipate and adapt to evolving threats proactively. The **Five Eyes** specifically advocate for harnessing AI for defensive purposes: to detect vulnerabilities earlier, enhance software quality, monitor unusual behavior, and accelerate incident response. This approach aims to reduce both the cost and impact of cyber incidents. This dual-use nature of AI for both offense and defense underscores the critical need for proactive, AI-driven cybersecurity strategies across all sectors.