Security agencies warn: AI is becoming a tool for cyberattacks and national security threats

Full text

For years, the artificial intelligence industry operated under a philosophy of rapid innovation. Whilst this benefits sectors like healthcare, the initial wave of optimism surrounding generative models is giving way to a challenging reality. Numerous national security agencies and research bodies are issuing warnings regarding the potential for these models to be weaponized.

At the heart of this warning is the realization that large language models do more than process text - they democratize technical knowledge and act as decision makers rather than tools. In the wrong hands, this capability can be applied to malicious cyber operations and the subversion of critical digital infrastructure.

Historically, executing sophisticated cyberattacks required years of specialized technical expertise in exploit development and network intrusion. Today, artificial intelligence bridges the knowledge gap for individuals who lack formal training but possess malicious intent.

Recent assessments by international security bodies, such as the Organization for the Prohibition of Chemical Weapons, highlight that the emergence of data driven molecular design models means that those with limited expertise can bypass monitoring from regulatory frameworks.

New frontier AI models such as Mythos could theoretically identify alternate synthetic pathways to design toxic chemicals using ordinary laboratory reagents.

Within enterprise environments, the exposure of software supply chains and cloud infrastructure also remains an acute vulnerability. Third party applications account for a high percentage of emerging security risks, and modern enterprise operations rely on a web of digital service providers and data aggregators that were barely visible a short time ago.

Every vendor represents a potential point of entry, and a single compromised credential at a small third party service provider can grant an attacker the freedom of lateral movement within a corporate or government network.

Current public skepticism is a response to the lack of transparency in how these frontier models are trained, monitored, and integrated. Companies developing models have a responsibility to ensure that their innovations do not compromise the stability of public systems.

This requires a commitment to the responsible deployment of these tools, prioritizing national security and architectural resilience over speed to market. The industry must move away from generic statements and focus on explicit, verifiable security practices.

A new framework for technological visibility

Organizations must adopt a rigorous approach to machine visibility and network defense. Traditional perimeter focused security tools are insufficient - defensive structures must shift toward continuous internal monitoring.

This means analyzing east west traffic within an organization network to scrutinize communications between systems and understand normal data flow patterns. Anomalies must become immediately apparent so security operations teams can act before an intrusion escalates.

Response times must also collapse. The traditional multi week window that attackers enjoy gives automated threats too much leeway to cause damage. Modern network detection and response platforms shrink attacker dwell times by identifying suspicious machine behavior in real time.

Because systems prefer structured layouts and consistent schemas, defender tools must leverage network telemetry to track how these models interact with internal data stores. Security teams need to see exactly how data is being processed, ensuring that unauthorized models are not mapping corporate assets.

Governments are responding to this reality with updated legislation, such as the strengthening of national cybersecurity laws in the UK. These updates expand the scope of statutory regulations to include essential digital service providers, managed service providers, and data centers.

Tougher penalties raise the cost of non compliance, and mandatory incident reporting requires organizations to alert regulators within tight windows, often 24 hours. These legislative changes acknowledge what technical experts have warned about for years - that cybersecurity breaches on critical infrastructure are a national security threat.

Breaches and automated attempts at exploitation are inevitable. The industry must treat advanced software infrastructure with the same level of caution as critical physical assets. In a world where automated systems can orchestrate complex network intrusions, the move towards more comprehensive security measures is essential.

We've featured the best endpoint protection software.

This article was produced as part of TechRadar Pro Perspectives , our channel to feature the best and brightest minds in the technology industry today.

The views expressed here are those of the author and are not necessarily those of TechRadarPro or Future plc. If you are interested in contributing find out more here: https://www.techradar.com/pro/perspectives-how-to-submit