On June 22, 2026, the intelligence agencies of five countries — the United States, the United Kingdom, Canada, Australia, and New Zealand — issued a rare joint statement. This alliance, known as the Five Eyes, almost never speaks publicly and in unison. When it does, the subject tends to matter.
The subject this time: artificial intelligence and cyber warfare. The message: AI models capable of overwhelming the defenses of governments and businesses are "months — not years" away. Leaders were urged to "act now."
What the Warning Actually Says
The Five Eyes advisory describes a fundamental shift in the threat landscape. AI is lowering the barriers for malicious actors in ways that previous cybersecurity planning didn't account for. Attacks that once required sophisticated technical teams can now be automated, scaled, and directed against multiple targets simultaneously. The speed of exploitation is changing.
"The rapid pace of frontier AI development means cyber risk assumptions can become outdated in months, not years," the joint statement read. "Breaches will occur. Preparedness helps you contain them quickly and prevent escalation into major operational and financial crises."
The agencies weren't warning about a theoretical future. They were describing capabilities that already exist and are already being deployed.
The Anthropic Trigger
The warning didn't emerge in a vacuum. In April 2026, Anthropic acknowledged that its most advanced AI models had demonstrated unprecedented abilities to identify software vulnerabilities — at a scale and speed that alarmed national security officials. The Trump administration subsequently ordered Anthropic to suspend access to those models for foreign nationals on national security grounds.
The Five Eyes statement followed weeks later. While the advisory addresses frontier AI broadly — not any single company — Anthropic's models demonstrating these capabilities is part of what put the issue on the intelligence community's radar with urgency.
The core problem isn't that one company built something dangerous. It's that once AI systems demonstrate a capability, the knowledge spreads and the capability becomes harder to contain.
AI can now write perfect phishing emails — personalized to individual targets, drawing on publicly available social media information, free of the spelling errors and awkward phrasing that made past phishing attempts detectable. It can scan large networks for vulnerable systems faster than human teams can patch them. It can generate and test exploits at speeds that outpace human-led defense.
Why Small Businesses Are Most Exposed
The advisory's most sobering observation is about who is most at risk. Large corporations and government agencies already invest heavily in cybersecurity and will be better positioned to adapt. Small and medium-sized businesses are different.
"The ones who are more exposed will be those small and medium-sized businesses who maybe have underinvested so far," said Shen, an AI and national security expert cited in the CNN coverage, "and they'll basically be like sitting ducks."
Ninety-four percent of corporate executives now identify AI as their top threat vector, according to the World Economic Forum's Global Cybersecurity Outlook. Two out of three organizations report moderate to critical cybersecurity talent shortages. The gap between what attackers can do and what defenders are prepared for is widening.
What "Months Not Years" Means for Everyone
Former CISA director Chris Krebs described it as "a vulnerability tsunami that's heading our way." His advice: take the Five Eyes guidance seriously because it "lays out discrete and achievable actions" that organizations can take to make themselves harder targets.
The most immediate steps are basic but widely neglected: enable multi-factor authentication everywhere, delete unused online accounts, keep software updated and patched, and stop treating cybersecurity as purely an IT problem rather than a leadership one. For businesses: limit who has access to critical systems, retire unsupported software, and test incident response plans before a breach forces you to use one.
The advisory also notes that AI is part of the solution. Organizations integrating AI into their security operations are detecting vulnerabilities earlier and responding faster. The same technology enabling attacks is enabling defenses — for those who move first.
The window to get ahead of this is measured in months. That is not a figure of speech.
