ai risk today logo svg bl font
Menu
SUBSCRIBE
SUBSCRIBE
ai risk today logo svg bl font
Menu

cyber risk

Abstract Earth from space with a digital AI overlay illustrating a Five Eyes warning about frontier AI cyber risks.

Five Eyes Warn Frontier AI Could Enable Major Cyberattacks Within Months

, , , , , , , , , , ,

The cyber agencies of Australia, Canada, New Zealand, the United Kingdom and the United States said advances in frontier AI may soon increase the speed, scale and sophistication of cyber operations.

The cybersecurity and intelligence agencies of the Five Eyes alliance issued a rare joint statement, warning that frontier AI advances could enable more serious cyberattacks within months, potentially altering the threat landscape faster than many organizations expect.

The statement was released by the leading cyber agencies of Australia, Canada, New Zealand, the United Kingdom and the United States, including organizations such as the U.S. National Security Agency (NSA), the Cybersecurity and Infrastructure Security Agency (CISA), the United Kingdom’s National Cyber Security Centre (NCSC), the Australian Cyber Security Centre (ACSC), and the Canadian Centre for Cyber Security (CCCS).

According to the agencies, increasingly capable AI models could enable threat actors to conduct cyber operations with greater speed, scale, and sophistication. The agencies warned that advances in frontier AI may reduce the expertise and resources traditionally required to carry out complex cyber activities, potentially placing more powerful capabilities into the hands of a broader range of threat actors.

The Five Eyes called on organizations to take practical steps now to understand their risks, strengthen cybersecurity fundamentals, and ensure leadership is prepared to respond as threats evolve.

The statement also emphasized that responding to AI-enabled cyber risks cannot be treated solely as a technology challenge. The agencies said a “whole-of-organization and whole-of-society response is required,” with leaders across business, government, and critical infrastructure working together to improve resilience.

For organizational leaders, the agencies highlighted several priority actions. Here they are verbatim:

  • Reduce your attack surface: Limit unnecessary system access and external connectivity. Challenge whether systems need to be exposed at all and isolate those that do not.
  • Accelerate patching processes: AI is shortening the time between vulnerability discovery and exploitation. Delays in patching increase risk, especially for operational systems with long update cycles. Prioritize security updates accordingly to manage risks.
  • Address legacy systems: Unsupported systems are easy targets. They are not just technical debt; they are strategic liabilities.
  • Review and strengthen identity and access controls: Limit who can access critical systems. Enforce strong authentication and regularly review permissions.
  • Prepare for incidents before they happen: Test response plans, train and prepare teams, and assume breaches will occur. Focus on fast containment and recovery.

The agencies also encouraged organizations to use AI as part of their defensive strategy, noting that the technology can help improve threat detection, accelerate incident response, and strengthen overall cyber resilience when deployed responsibly.

The Five Eyes agencies concluded by calling on leaders to act now rather than wait for future guidance or major incidents. Their message was that organizations should build resilience before more capable AI systems further compress the timeline between identifying a vulnerability and exploiting it.

Abstract blue geometric visualization of AI risk surging as the top long-term business threat, AI Risk 2026 Emerging Risk Survey

Actuaries Rank AI as the Top Long-Term Business Risk

, , , , , , , , ,

In the Society of Actuaries’ 19th annual survey, 100+ insurance executives ranked AI 4th for 2026 and 1st for the three-year outlook.

Key Takeaways

  • 27% of C-suite executives named AI as their top long-term risk. Near-term, 8% named it.
  • Financial volatility (25%) and geoeconomic and globalization shifts (19%) led the 2026 rankings.
  • 53% of consulting firm executives named AI as their top long-term risk.
  • AI + other risks was the top risk combination, named by 33% of executives.
  • Geopolitical risks had the lowest carryover: 24% of executives who named one near-term also named one long-term.

The Society of Actuaries Research Institute (SOA) and Casualty Actuarial Society (CAS) published the 19th Annual Emerging Risk Survey, drawing on responses from 100+ Chief Risk Officers, Chief Actuaries, and senior consulting partners in insurance and financial services. Participants ranked the risks most likely to affect their organizations in 2026 and over the next 3 or more years.

 

AI is the top long-term risk

27% of executives named AI adverse outcomes as the top risk over the next 3 or more years. Financial volatility ranked second at 17%. Geopolitical risks fell out of the top five entirely.

Consulting firms are the most concerned. 53% of consulting firm executives named AI as their top long-term risk. Even in the near term, 35% named it. That is the highest near-term share for AI of any responder group.

Property and casualty insurance executives also named AI as their biggest long-term concern at 18%, tied with extreme weather events.

 

Near-term concerns

For 2026, financial volatility leads. 25% of executives named it as the top near-term risk. 19% named geoeconomic and globalization shifts, driven by tariffs, export controls, and sanctions. AI ranked fourth at 8%.

Geopolitical risks had the lowest carryover of any category. Only 24% of executives who named a geopolitical risk near-term also named one long-term.

 

When risks are combined, those mixed with AI create the most concern

33% of respondents said AI combined with other risks is a top concern. 

Among these combinations, AI paired with cyber threats and AI paired with financial volatility topped the list at 9% each. 

The survey is in its 19th consecutive year. Disruptive technology, the broader category that includes AI, has ranked in the top three emerging risks since 2023, spiking in 2026.

Abstract visualization of interconnected software vulnerabilities and cyber threat detection linked to Anthropic’s Claude Mythos cybersecurity research.

Anthropic Says Its Claude Mythos Preview Identified More Than 10,000 Serious Software Vulnerabilities

, , , , , , , , , , , , , ,

Organizations participating in Anthropic’s Project Glasswing identified more than 10,000 serious software vulnerabilities, including flaws participants said previous methods likely would not have found. 

 

Anthropic released a detailed update on Project Glasswing, its restricted cybersecurity initiative that gives selected organizations access to Claude Mythos Preview (Mythos) to identify software vulnerabilities in widely used technology systems before attackers can exploit them.

Participating organizations identified more than 10,000 high- and critical-severity vulnerabilities during the first weeks of the program. The company said the vulnerabilities were found in “systemically important” open-source software projects heavily used across cloud infrastructure, operating systems, browsers, enterprise applications, and internet services.

Anthropic noted that several partners are finding more bugs faster, often by a factor of 10, outpacing human-guided efforts and even previous versions of Claude. Some examples include:

  • Cloudflare identified roughly 2,000 software flaws across critical systems, including 400 classified as high or critical severity. Cloudflare said the system produced fewer incorrect vulnerability alerts than its human security testers typically generate.
  • Mozilla said it found and fixed 271 vulnerabilities in Firefox 150 after testing with Mythos. Mozilla said that was more than ten times the number of vulnerabilities identified in Firefox 148 using Claude Opus 4.6, an earlier Anthropic model.
  • The UK’s AI Security Institute said Mythos became the first AI model to successfully complete both of its simulated cyberattack exercises, meaning the system was able to carry out an entire multi-step intrusion scenario from identifying a weakness to achieving the attack objective.

 

Finding open source threats

Anthropic used Mythos to scan over 1,000 open-source software projects that support major internet systems.

The company said Mythos identified 23,019 total vulnerabilities, of which 6,202 were estimated to be high- or critical-severity.

Anthropic said 1,752 of the high- or critical-rated findings have been reviewed by six independent security research firms, with a small number reviewed by Anthropic. Of the reviewed findings, 90.6% (1,587) were confirmed as real vulnerabilities. Anthropic said 62.4%, or 1,094, were confirmed as high- or critical-severity.

Based on those review results, Anthropic said Mythos Preview is on track to identify nearly 3,900 high- or critical-severity vulnerabilities in open-source code, even if it finds no additional flaws. The company said it plans to continue scanning open-source projects, so it expects that number to increase.

The company said most vulnerabilities identified through Project Glasswing have not been publicly disclosed because software maintainers are still developing fixes. Anthropic said vulnerabilities are handled through coordinated disclosure processes, in which affected organizations receive private notice before public disclosure.

 

Anthropic introduces Cyber Verification Program, countering OpenAI’s Trusted Access for Cyber (TAC) program

Anthropic also announced a separate gated cybersecurity program for security professionals. The program removes certain cyber guardrails, allowing security professionals already using Anthropic cyber models (Mythos excepted) for cybersecurity purposes to conduct real-world research and testing.

Anthropic said it plans to expand the number of Project Glasswing partners and increase collaboration with critical partners, including governments and infrastructure operators.