The Five Eyes intelligence alliance issued a coordinated public advisory on 23 June 2026, warning that the most capable artificial intelligence models are improving at a pace that will allow them to outmanoeuvre current cybersecurity defences within months, not years. The joint statement, signed by security agencies from the United States, United Kingdom, Australia, Canada, and New Zealand, is one of the strongest public intelligence assessments of AI-enabled offensive cyber capability published to date.
What the warning says
The central claim is direct: frontier AI models are approaching a capability threshold that significantly lowers the barrier to sophisticated cyberattacks. Tasks that previously required specialised expertise across vulnerability research, exploit development, and network intrusion can increasingly be automated or augmented by AI systems available to adversaries.
The advisory specifically highlights the pace of change as the most important variable. “Cyber risk assumptions can become outdated in months, not years,” the joint statement reads. Security teams and organisations that have not recently reviewed their threat assumptions may be working from a baseline that is already obsolete.
The warning follows the disclosure in April 2026 that advanced AI models demonstrated unprecedented capabilities in identifying software vulnerabilities, enough so that certain AI model access was restricted by government order, reflecting concern that they could lower the barrier to large-scale exploitation.
How fast adversaries are already moving
Separate from the AI capabilities warning, threat intelligence data from 2026 documents that some criminal and state-affiliated adversary groups can penetrate a network and begin moving laterally within 30 seconds of achieving initial access. AI-assisted reconnaissance and exploitation are contributing to this compression of attack timelines.
The implications for organisations relying on traditional security monitoring are significant. Incident detection approaches that assume attackers spend days or weeks establishing a foothold before moving deeper into a network are increasingly misaligned with the actual threat. Adversaries who achieve initial access with AI assistance can compress what was once a multi-day intrusion lifecycle into hours or less.
What organisations are being advised to do
The Five Eyes advisory does not prescribe a single technical control against AI-assisted attacks. Instead it recommends a structured response across three areas.
Update software and systems promptly. Unpatched vulnerabilities remain the most common initial access vector. AI tools amplify an adversary’s ability to discover and exploit known weaknesses at speed. Organisations with extended patching cycles or large backlogs of unaddressed software vulnerabilities carry significantly higher risk in this environment.
Limit access to critical systems. Reducing the blast radius of a successful compromise requires knowing which accounts and services can reach sensitive systems, and enforcing least-privilege principles rigorously. AI-assisted attacks tend to prioritise high-value targets once inside a network. Reducing lateral movement opportunities limits how far a compromise can spread before it is detected.
Invest in behavioural monitoring. Traditional signature-based detection does not catch AI-assisted novel attack techniques. Behavioural monitoring that identifies anomalous patterns across accounts, network flows, and system interactions provides a more durable detection capability as offensive techniques evolve faster than signatures can keep pace.
The European context
The United Kingdom is one of the Five Eyes signatories, and the warning carries direct relevance for European organisations. The EU’s NIS2 Directive and the forthcoming EU Cyber Resilience Act both require organisations in critical sectors to maintain documented risk assessments and implement proportionate technical measures. A published intelligence advisory from allied governments stating that AI-assisted attacks will materially change the threat landscape within months is precisely the kind of external threat intelligence that should be reflected in current risk assessments.
European organisations that have not updated their cyber risk registers and incident response plans to account for AI-accelerated attack timelines may find themselves out of alignment with both their compliance obligations and the actual threat environment.
What this means for infrastructure and cloud teams
For organisations running cloud workloads, CI/CD pipelines, and interconnected SaaS environments, the Five Eyes warning is a prompt to reassess assumptions about attacker dwell time, detection windows, and the sufficiency of existing monitoring coverage.
AI-assisted attackers can move faster than human analysts reviewing alerts in standard monitoring queues. Closing that gap requires automated response capabilities, access controls that reduce the damage from any single compromised account, and monitoring that prioritises behavioural signals rather than known-bad signatures.
If you want to assess whether your current security architecture and monitoring capabilities are adequate for an environment where AI-assisted attacks move at this pace, contact Excello Digital. We help organisations review their detection coverage, update their risk posture, and implement the controls needed to respond at the speed modern threats require.