The intelligence agencies of Australia, the US, UK, Canada, and New Zealand dropped a joint advisory overnight that lands differently from the usual boilerplate threat bulletins. The Five Eyes aren't warning that frontier AI could eventually help attackers — they're saying the window before capable AI-assisted hacking becomes a real-world norm is now measured in months, and that defenders who are still calibrating their risk posture on last year's assumptions are already behind.

The advisory singles out three shifts that worry analysts most. First, AI models are compressing the time it takes to research a target organisation, find exploitable vulnerabilities, and write working payloads — work that previously took a skilled team days can increasingly be done in hours. Second, AI-generated phishing and social engineering is now polished enough that even technically literate users are being fooled. Third, the gap between nation-state attackers and well-resourced criminal groups is narrowing faster than expected, because both are drawing from the same frontier model capabilities.

The report, echoed closely by coverage in iTnews, is notable for its urgency. The phrase "must act now" isn't common language in Five Eyes publications, which tend toward careful hedging. That it made the headline suggests the agencies wanted the alarm to cut through.

For Australian organisations, the advisory has direct regulatory teeth. The Australian Signals Directorate sits inside the Five Eyes structure, meaning this isn't just allied intelligence forwarded for context — it's a co-authored assessment from Australia's own cyber agency. Under the SOCI Act, operators of critical infrastructure are already obligated to manage material cyber risks, and AI-augmented threat actors will increasingly qualify as exactly that. Boards that have treated AI-powered attacks as a future-state scenario should probably revisit that framing before their next risk committee meeting.

The timing is pointed. It drops on the same day OpenAI launched its "Daybreak" initiative — a package including GPT-5.5-Cyber and a "Patch the Planet" open-source vulnerability programme — essentially demonstrating both sides of the same coin: the same frontier model capability that defenders can use to find and fix bugs can be wielded offensively too.

What to watch: Whether this advisory triggers any mandatory reporting or guidance updates from the ASD or ACSC in the coming weeks. The Five Eyes don't typically co-sign urgent warnings without follow-on operational guidance in the pipeline. The other thing worth watching is whether we see the first confirmed, publicly attributed AI-assisted intrusion campaign in the next reporting cycle — that would shift this from a warning into a case study very quickly.