Australia Warns AI Cyberattacks Hit Unprecedented Scale
Australia's cyber agency warns AI is driving attacks at unprecedented scale, with warnings up 80 percent as state hackers target critical infrastructure.
Australia's cyber security agency has warned that artificial intelligence is now driving cyberattacks at an unprecedented scale and speed. In its annual cyber threat report, published on October 26, 2026, the Australian Signals Directorate (ASD) said AI is helping criminals and state-sponsored hackers find software flaws faster and exploit them more widely than ever before. The warning comes as governments and companies around the world rush to deal with a wave of AI-powered attacks, including a string of incidents involving models from leading developers such as OpenAI and Anthropic.
AI is now the defining force
The report's blunt verdict is that AI has reshaped the threat landscape in a single year. "AI has been the defining force in the cyber threat landscape over the past year, allowing malicious actors to find vulnerabilities faster and exploit them at unprecedented scale, speed and sophistication," the report said. ASD Director-General Abigail Bradshaw put it in similar terms, saying frontier AI models have fundamentally changed cyber security. She said the technology is enabling attackers to identify flaws and launch attacks faster, at greater scale, and with greater precision than ever before, and warned: "This shift will only accelerate." The report also flagged a newer danger: threats from the unintended actions of AI agents and model testing. In recent weeks, it said, new threats have emerged from AI systems acting outside their limits, rather than from deliberate attacks alone. The timing is pointed. Governments and firms have spent recent days rushing to fix critical flaws in PHP, a programming language that runs a large share of the world's websites, after a vulnerability was found using a powerful model from OpenAI.
Warnings jump 80 percent in one year
The numbers behind the warning show a sharp rise in attacks. Over the 2025-26 financial year, the ASD's Australian Cyber Security Centre responded to more than 1,500 cyber security incidents, an increase of more than 20 percent on the previous year. It also issued more than 4,400 warnings to organisations about potentially malicious activity, an increase of almost 80 percent. The surge in warnings suggests the agency is spotting and flagging threats earlier and more often, as attackers probe more targets with AI help. The report noted that the ASD itself used some AI tools to compile its annual report, a sign of how deeply the technology is now woven into both defence and attack.
State hackers target more than government
State-sponsored hackers remain a central concern. The report said they continued to target Australian organisations mainly to gain access to sensitive or non-public information, and that the activity goes well beyond government networks. "This activity extends beyond government networks, and includes critical infrastructure entities, private businesses and individuals," the report said. Hackers linked to China, Russia and North Korea had targeted Australia or its allies in recent times, according to the report. Beyond spying, the report warned that state actors seek to preposition themselves inside networks, gaining access they could use for intelligence gathering or disruption at a time of their choosing. That kind of quiet, long-term access is what makes critical infrastructure, from power and water to hospitals and banks, a particular worry.
What Australia wants companies to do
Australia's message to businesses is practical: harden your systems now, even if it costs time offline. Defence Minister Richard Marles urged Australians to update their computers and harden their systems, saying: "AI is here and it's real. People need to engage." "There's no turning the clock back in relation to that. Malicious actors are using AI to find vulnerabilities in systems," Marles said. He added that if hardening a system means bringing it down for a couple of days, organisations should do it rather than leave an old, internet-connected system open as a gateway for attackers. The report's advice lines up with that message: prioritise security over keeping every system available, remove or isolate exposed legacy systems, rotate cloud credentials, extend logging, and use AI defensively to detect and block attacks. Basic cyber hygiene, including multi-factor authentication or passkeys, remains the first line of defence. For ordinary users, the advice is the same in miniature: keep devices updated, turn on multi-factor authentication, and treat unexpected messages and login prompts with suspicion. The attackers may now be AI-assisted, but the defences that slow them down are still largely human habits.
Sources
- The Straits Times (AFP) - https://www.straitstimes.com/asia/australianz/australia-warns-of-unprecedented-ai-threat - The Manila Times (AFP) - https://www.manilatimes.net/2026/10/27/world/asia-oceania/australia-warns-of-unprecedented-ai-threat/2454541 - Particle News - https://particle.news/story/asd-says-frontier-ai-has-reshaped-australias-cyber-threats - Free Malaysia Today (AFP) - https://www.freemalaysiatoday.com/category/world/2026/10/27/australia-warns-of-unprecedented-ai-threat