Intelligence agencies do not usually use words like "months". The Five Eyes alliance — the United States, United Kingdom, Canada, Australia and New Zealand — did, in a joint statement warning that the newest generation of AI models will exceed the industry's own expectations and fundamentally change both attacking and defending computer systems. Not in years, the statement says, but potentially within months.
What the statement actually says
Strip the diplomatic language and there are three points. Frontier models are becoming capable of finding software flaws and chaining them into working attacks faster than human teams can. The same models can be turned to defence, and defenders should be using them now. And the basics have not changed: patch promptly, and take offline anything that does not need to be online.
The statement names no products. The agencies' message is that capabilities once reserved for well-funded state teams are being commoditised.
The shift underneath, stated plainly
The alarming part is not that AI discovers flaws nobody knew about. It is what happens to the cost of using the ones already published, and that deserves to be spelled out because it changes who is in danger rather than how dangerous things are.
Turning a disclosed vulnerability into a reliable working exploit has always been skilled, slow work: understanding the flawed code, getting a crash to become controlled execution, defeating the operating system's protections, and making it work across versions and configurations. Days to weeks of an expert's time, per bug. That cost is the reason most organisations have never been attacked through most of the vulnerabilities they carry. There were simply not enough people willing to spend a week on a target worth very little.
In other words, a great deal of real-world security has never come from systems being secure. It has come from attacker attention being scarce and expensive, which protected the long tail — the small bank, the district hospital, the mid-sized outsourcing firm — far more effectively than any control they had bought.
Collapse that cost and the protection disappears. Not because the small organisation got weaker, but because it stopped being beneath notice. That is the actual content of "months, not years", and the warning is aimed at everyone rather than at the usual high-value targets.
Why defenders do not get an equal benefit
The statement is right that defenders can use the same models, though why that does not simply cancel out takes explaining.
An attacker needs one path to work. A defender needs every path closed. AI makes both sides faster at finding things — but what follows differs completely. The attacker's next step is to run the exploit, which is instant and parallel. The defender's next step is to change a production system: schedule the work, test for regressions, find a downtime window, get approval, and do it without breaking the thing that earns the money.
AI compresses the discovery half for both sides. It does almost nothing to the defender's second half, which was always the slow part. That asymmetry is the real reason the warning is urgent.
The three-day clock is an organisational problem
The most concrete signal in the statement comes from CISA, the US cyber-defence agency and a co-signatory, which has cut the time federal networks may leave a serious known vulnerability unpatched to three days. The logic is direct: if a newly published flaw can be weaponised in hours, a patch cycle measured in weeks is an open door.
Why patch windows are long in the first place deserves an honest answer, because "just patch faster" is advice that fails for reasons that are not laziness. Patches break things. A security update to a database driver takes down an application that depended on old behaviour; a kernel update needs a reboot and the system runs a production line. So organisations batch patches, test them, and schedule downtime — and each of those steps is sensible in isolation and adds a week.
Compressing that to three days is not a technical problem. It requires pre-approved emergency change procedures, environments you can test in without ceremony, the ability to roll back quickly, and someone with authority to accept a small risk of breakage against a larger risk of compromise. Most organisations have none of those, and buying a tool does not provide them.
The four things that still hold
1. Reduce what is reachable, before anything else. This is the highest-leverage item in the statement and the most ignored, because it is unglamorous. A system that cannot be reached from the internet does not need a three-day patch clock. Inventory what is exposed — old admin panels, forgotten test servers, a VPN appliance nobody owns, a database listening on a public address — and remove it. Almost every organisation is exposing things nobody intended, and nothing else on this list gives a comparable return.
2. Set a patch clock and mean it. Three days is aggressive. A week for anything internet-facing is the minimum a serious organisation should now target, and the thing to fix is not the tooling but the approval path.
3. Multi-factor authentication everywhere it fits. No amount of model capability helps an attacker who cannot authenticate. One caveat worth stating: SMS one-time codes are the weakest common form and are defeated by the phishing proxies already in wide use. App-based codes are better; hardware keys and passkeys are the versions that actually resist phishing.
4. Assume the first alert is late. Faster attacks compress the window between intrusion and damage, which raises the value of things that work after the fact — offline backups you have actually restored from in a test, logs kept somewhere the attacker cannot edit, and a written plan for who is called at 2am.
None of this is new advice. What has changed is the cost of ignoring it, and the speed at which that cost arrives.
