Five Eyes: AI models autonomously hack systems and lower the barrier to cyberattacks to zero

Intelligence agencies of the Five Eyes alliance have published a joint statement on escalating cyber threats posed by AI models. According to expert Bruce Schneier, we are entering an era where cyberattacks no longer require professional skills.

What Five Eyes Warns About

The alliance of five English-speaking countries—the United States, United Kingdom, Canada, Australia, and New Zealand—focused its statement on a specific threat: modern AI models are capable of autonomously hacking systems and networks. This is not a theoretical possibility—agencies are documenting real cases of AI use in attacks.

The statement itself, as Bruce Schneier notes, proved more measured than one might expect from sensational headlines. The recommendations are standard: update software, use multi-factor authentication, monitor suspicious activity. But the tone has shifted—these recommendations now carry a sense of new urgency.

AI as an Adversary's Advisor

Schneier frames the core problem bluntly: modern AI systems are essentially a "universal advisor for conducting malicious acts." This changes the very nature of cyberattacks. Previously, a complex attack required years of training: deep knowledge of network protocols, the ability to find and exploit vulnerabilities, experience with specific systems. AI lowers this threshold to a minimum—the model guides a novice attacker through each step, explains technical concepts, and suggests specific tools.

What becomes more accessible with AI:

• Next-level phishing—personalized emails in any language based on public information about the target
• Vulnerability reconnaissance—analysis of specific systems and identification of weak points
• Autonomous attacks—AI agents execute chains of actions without operator involvement
• Social engineering—convincing manipulation scenarios targeting employees
• Scaling—attacks that previously required a team of specialists are now deployed at scale

Asymmetry of Threat

Cybersecurity has always involved a fundamental asymmetry: an attacker needs to find just one vulnerability, while a defender must protect against all of them. AI exacerbates this disparity. Defense still requires professional expertise, infrastructure understanding, and human judgment. Attack—increasingly does not. When hacking tools become accessible through a chatbot conversation, the balance of power in cyberwarfare shifts fundamentally.

"We need to use AI for defense as well," —

Bruce Schneier, security expert, Harvard Kennedy School.

Internet risks have existed since the beginning of the network—long before the advent of generative AI. But previously, the scale of the threat was constrained by the requirement for specialized knowledge. Now this barrier is rapidly disappearing.

What This Means

The cybersecurity world is entering a phase where mass attacks with low barriers to entry will become the norm. For companies, this means: standard security hygiene is no longer sufficient. Organizations need to actively deploy AI tools on the defense side—anomaly monitoring, automated threat detection, real-time behavior analysis. Otherwise, the asymmetry between attackers and defenders will only grow.