Five Eyes warns frontier-AI cyber risk is months, not years, away

The timeline for AI-driven cyber risk is being pulled forward from “eventually” to “prepare now.” According to The Guardian, cyber intelligence agencies from the Five Eyes alliance warned in a rare joint statement that frontier AI could substantially change both cyber offense and defense within months.

The central point is acceleration. The agencies said AI can improve cyber defense over time, but it also increases the speed, scale, and sophistication of threats. The statement warned that frontier AI models may exceed current industry expectations and transform offensive and defensive cyber capabilities on a timeline measured in months rather than years.

The warning lands in the middle of the dispute over Anthropic’s Fable 5 and Mythos 5 models. The Guardian reports that the U.S. government moved in June to block foreign nationals from using the models, citing national security concerns, and that Anthropic’s response broadened the access restrictions. The Five Eyes statement did not name a specific company or model, but the policy debate is clearly being shaped by whether frontier systems can find, chain, or operationalize vulnerabilities faster than existing security teams can respond.

For companies, the practical message is that this is no longer just a security tooling issue. The agencies framed cyber resilience as tied to business continuity, market confidence, and long-term value. If AI lowers the barrier to complex attacks, leadership teams have to treat cyber readiness as an operating-risk question, not a specialist concern delegated after budgets are set.

The next questions are concrete. Governments will need to explain what model-access restrictions are based on, how they apply to domestic and foreign users, and whether they can survive the release of comparable systems outside allied jurisdictions. Enterprises will need to test whether their incident response, identity controls, software supply chain, and AI-assisted defense workflows are fast enough for adversaries using the same class of tools. The “months, not years” framing matters because it leaves little room for slow procurement cycles or symbolic AI policies.