Five Eyes: AI Models Can Hack Systems Autonomously, Cutting the Barrier to Cyberattacks to Zero

The Five Eyes intelligence agencies have published a joint statement on the growing cyber threats posed by AI models. According to expert Bruce Schneier, we are entering an era in which a cyberattack no longer requires professional skills.

What Five Eyes is warning about

The alliance of five English-speaking countries (the US, UK, Canada, Australia and New Zealand) focused its statement on a specific threat: current AI models can hack systems and networks autonomously. This is not a theoretical possibility. The agencies are documenting real cases of AI being used in attacks.

As Bruce Schneier notes, the statement itself turned out to be more measured than the loud headlines would suggest. The recommendations are standard: update your software, use multi-factor authentication, watch for suspicious activity. But the tone has shifted, and these tips now carry a new sense of urgency.

AI as an adviser to the attacker

Schneier states the core problem bluntly: modern AI systems are essentially a "universal adviser for committing malicious acts." That changes the nature of cyberattacks itself.

A sophisticated attack used to demand years of training: deep knowledge of network protocols, the ability to find and exploit vulnerabilities, experience with specific systems. AI cuts that barrier to a minimum. The model walks a novice attacker through every step, explains technical concepts and suggests specific tools.

What AI makes more accessible:

• Next-level phishing — personalized emails in any language, drawing on public information about the victim
• Vulnerability reconnaissance — analysis of specific systems and a search for weak points
• Autonomous attacks — AI agents carry out chains of actions without an operator
• Social engineering — convincing scripts for manipulating employees
• Scaling — attacks that once required a team of specialists can now be replicated at industrial scale

The asymmetry of the threat

Cybersecurity has always had a basic asymmetry: an attacker only needs to find one vulnerability, while a defender has to close them all. AI worsens this imbalance. Defense still requires professional expertise, an understanding of the infrastructure and human judgment. Attack requires less and less.

When hacking tools become available through a conversation with a chatbot, the balance of power in cyberwarfare shifts fundamentally.

"We need to use AI for defense as well," —

Bruce Schneier, security specialist, Harvard Kennedy School.

Internet risks have existed since the network's earliest days, long before generative AI. But the scale of the threat used to be held in check by the need for specialized knowledge. Now that barrier is vanishing fast.

What this means

Cybersecurity is entering a phase in which mass attacks with a low barrier to entry will become the norm. For companies, this means standard security hygiene is no longer enough. They need to actively deploy AI tools on the defensive side: anomaly monitoring, automated threat detection, real-time behavior analysis. Otherwise the asymmetry between attackers and defenders will only grow.