In short: The intelligence alliance of the US, UK, Canada, Australia and New Zealand (the "Five Eyes") warned in June 2026 that advanced AI able to power major cyberattacks is "months, not years" away, and urged governments and businesses to act now. Russia already sees the effect: Kaspersky recorded a 31% rise in industrial security incidents in the first half of 2026, with attackers increasingly leaning on AI. AI does not break encryption — it scales deception, so basic data hygiene matters more than ever.
What happened
In late June 2026 the Five Eyes intelligence grouping issued a joint statement warning that AI models capable of overwhelming the defences of governments and companies are "months, not years" away, and called on leaders to "act now". The warning was reported by CNN and CBS News. It builds on guidance from May 2026 that mapped more than 23 categories of risk tied to autonomous "agentic" AI — systems that can act on their own, make decisions and chain together multi-step tasks without human oversight.
The alarm is not limited to spy agencies. The International Monetary Fund cautioned that AI-driven cyberattacks could trigger a macroeconomic shock on financial markets, and a member of the European Central Bank's executive board urged eurozone banks to speed up their defences against a new generation of AI-powered attacks. The direction of travel is the same everywhere: automation is lowering the cost and raising the speed of attacks. We covered how this shows up in email fraud in our report on AI-powered phishing.
How AI changes an attack
The point is not a "robot hacker" from a film. AI makes ordinary attacks cheaper, faster and more convincing:
- Automation and scale. Agentic systems can probe defences, adapt in real time and run thousands of attempts in parallel — far beyond what a human team could manage.
- Believable social engineering. Language models write flawless phishing emails with no tell-tale mistakes, in any language, tailored to the victim.
- Faster exploitation. Analysts report that many intrusions now move from initial access to data theft in well under a few hours.
None of this rewrites the fundamentals: attackers still mostly rely on tricking a person or reusing a leaked password. AI just makes the bait harder to spot.
Russia: the numbers behind the warning
The trend is already measurable in Russia. According to Kaspersky ICS CERT, the number of information-security incidents detected and prevented in Russian industry grew 31% in the first half of 2026 versus the same period of 2025; the transport and logistics sector saw a 75% jump. Ransomware detections rose 97% year over year in the first quarter, per the same data, reported by the Russian outlet Anti-Malware.ru.
Crucially, Kaspersky notes that AI is now woven into these campaigns: some groups use chatbots to negotiate ransoms, others disguise malware as AI tools or use language models to help write malicious code. Separate industry figures cited by Russian analysts put the growth in attacks on the financial sector at about 28% for January–April 2026, with roughly one in six incidents involving AI tools. For ordinary people this all lands the same way — more, and more convincing, attempts to reach their money and data.
What it means for your data
You are not the direct target of a state-grade AI attack — but you feel the fallout. More automated campaigns mean more phishing that looks perfect, more fake "bank" calls built on leaked databases, and more automated attempts to reuse a password stolen from one site across hundreds of others. Old leaks do not disappear either; they are merged and reused for years, a problem we unpacked in our news item on database leak postings.
The reassuring part: AI does not magically break strong encryption or a well-protected account. It scales deception. So the same defences that always worked still work — they just matter more, and need to be switched on by default rather than "later".
How to protect yourself
Slow down on urgent messages. AI-written phishing is grammatically perfect, so the old "spot the typo" trick fails. Judge by context instead: unexpected urgency, a request to move money or enter a code, a link that does not match the real site.
Use a unique password everywhere plus two-factor authentication. A password manager and an authenticator app defeat automated credential-stuffing — the attack AI scales most easily. To check where your email has surfaced, see our guide on the blog.
Keep software updated. Faster AI-assisted exploitation means the window between a patch and an attack is shrinking. Install updates promptly on phones, computers and routers.
Reduce your network footprint. To be honest, a VPN will not stop an AI attack on a company's servers, and it does not replace an antivirus or a password manager. But it covers the network half of your own exposure: it encrypts your traffic on untrusted Wi-Fi so logins and codes cannot be intercepted in transit, and hides your real IP from the sites and trackers used to profile and target you. See how LiMP VPN does it on our features page.
Sources
This report is based on coverage by CNN and CBS News of the Five Eyes statement, and Kaspersky ICS CERT data reported by the Russian-language Anti-Malware.ru, from June–July 2026.