ESSAY: Offensive AI in Months — The Five Eyes Alarm That Changes Everything

June 22, 2026 — a joint warning that breaks from the usual register

On June 22, 2026, something unusual occurred in the Western intelligence world. The cybersecurity agencies of the Five Eyes — the CISA (United States), the NSA (United States), the NCSC (United Kingdom), the CCCS (Canada), the ACSC (Australia), and the NCSC-NZ (New Zealand) — published a joint advisory that breaks with the usual restraint of such documents. Their central conclusion: frontier AI models will reshape offensive cyber capabilities "in months, not years." This is not a cautious warning for a distant future. It is an alert for right now.

The advisory explicitly names four actors: China, Russia, Iran, and North Korea — the same four nations that analysts call the Axis of Disorder. According to the Five Eyes, these four regimes are the primary potential beneficiaries of this revolution in offensive cyber capabilities. And the window for Western democracies to adapt their defenses before these capabilities are fully operational with the adversary is measured in months, not decades.

Why this advisory is different from previous ones — urgency as signal

The intelligence agencies regularly publish advisories on cyber threats. What distinguishes the June 22 advisory is its explicit language of urgency. The phrase "in months, not years" is not a diplomatic or nuanced formulation. It is a statement that says: we have detected something materializing now. This shift in register — from abstract warning to concrete alert — deserves attention and analysis of what motivates it.

The answer, in part, comes from Google itself: the company revealed that AI had been used to discover a zero-day vulnerability and weaponize it into an operational cyber weapon. This is no longer theoretical. It is no longer experimental. AI is already being used in the vulnerability exploitation cycle, radically shortening the time between discovering a flaw and weaponizing it. The Five Eyes are not talking about the future. They are describing a present that is accelerating.

When the world's most cautious intelligence agencies write "in months, not years," one should stop and listen. That kind of phrasing in an official intelligence document is not rhetorical excess. It is a deliberate decision to convey an urgency that standard formulations would fail to communicate. I take it at its word. And it concerns me deeply.

Automated vulnerability discovery — the most fundamental change

The discovery of software vulnerabilities has long been a human process, slow and costly: teams of specialized researchers spend weeks or months analyzing code, testing configurations, and identifying exploitable flaws. This cost in time and human expertise was a genuine barrier for adversary actors. AI changes this equation fundamentally: models trained on millions of lines of code can identify vulnerability patterns in hours that human researchers would have taken weeks to find.

The Google example — using AI to discover a zero-day flaw and turn it into an operational weapon — is the proof of concept that the Five Eyes observed and that motivated their alert. If a Western company can do this in defensive-offensive mode, the intelligence services of China, Russia, Iran, and North Korea can do the same with the same tools. Access to large language models is not reserved for democracies. And Beijing has been actively developing its own models for years.

Personalized phishing attacks — when AI crafts undetectable lures

Another domain where AI's impact on offensive cyberwar is already measurable: the generation of phishing content. Traditional phishing attacks are often detectable by their linguistic imperfections, their lack of personalization, their spelling errors. Generative AI now allows the production of lures indistinguishable from legitimate emails, perfectly tailored to the target's profile, in any language, at a scale and speed impossible for human operators. The group GREYVIBE, documented by WithSecure, is already using ChatGPT and Gemini to generate its phishing campaigns against Ukraine.

This capacity for mass personalization is one of the most troubling developments the Five Eyes flag. It means that existing phishing detection tools — which rely heavily on syntactic and stylistic filters — are progressively becoming ineffective. The new challenge for defensive cybersecurity is to develop detection methods that work against AI-generated lures, which is a fundamentally harder technical problem than filtering poorly written emails.

GREYVIBE uses ChatGPT to phish Ukrainians. Silicon Valley AI is being used against a democracy fighting for its survival. I'm not saying this to accuse OpenAI — the problem is structural, not the affair of a single company. But this reality says something uncomfortable about the dual nature of these technologies. The AI helping a doctor diagnose a tumor is the same type of system generating the lures for the next Russian cyberespionage campaign.

China leading the race — a national strategy for military AI

Among the four actors named by the Five Eyes, China is the one with the greatest resources and most coherent strategy for integrating AI into its offensive cyber capabilities. The Made in China 2025 plan and its successors explicitly include the development of AI capabilities for military and intelligence use. Major Chinese tech companies — Baidu, Alibaba, Tencent — are legally required to cooperate with national security services. And China invests billions of dollars in AI research each year.

The UNC6508 campaign, revealed by Google on June 15, illustrates the sophistication already achieved: a China-linked group maintained invisible presence in North American military-medical networks for more than a year, deploying malware whose characteristics suggest the use of behavioral adaptation techniques that resemble AI-based methods. This is not yet a certainty — technical attribution remains complex — but it is consistent with the profile of an actor progressively integrating AI into its operations.

Russia — reduced resources but tactical creativity

Russia is in a different position. The economic sanctions imposed since 2022 reduce its access to the technological components necessary for AI development in compute terms. Its capacity to develop frontier models is inferior to that of China or the United States. But Russia has shown, with groups like GREYVIBE or Void Blizzard, a capacity to use existing tools — including Western models like ChatGPT and Gemini — creatively and effectively to amplify its operations.

This approach — using adversaries' tools against their own interests — is characteristic of Russian hybrid warfare doctrine. It does not require developing a proprietary frontier AI model. It requires creative operators capable of using available tools to maximize operational impact with limited resources. And in this domain, Russia has demonstrated a capacity for rapid tactical adaptation that neither sanctions nor technology access restrictions have managed to eliminate.

Russia uses ChatGPT against Ukraine. That sentence contains a profound and troubling irony. Systems developed in Silicon Valley, designed to help, inform, and create, are being hijacked by agents of a regime that bombs Ukrainian cities. This is not a failure of OpenAI specifically. It is a collective failure of democracies to think through the adversarial uses of their own technologies before deploying them at scale.

Defensive capabilities are not built in weeks

The phrase "in months" in the Five Eyes advisory may be the most alarming signal in the document. Because building defensive capabilities adapted to an AI-based cyber threat — detectors for AI-generated code, next-generation behavioral analytics systems, protection of language models against hijacking — requires years of research, development, and deployment. If adversaries will have AI-based offensive capabilities in months, and if our defenses require years to adapt, the defensive gap is real and immediate.

This is not pessimism. It is a structural reality that Western governments and cybersecurity companies must address urgently. Companies like CrowdStrike, Palo Alto Networks, and the cybersecurity divisions of Microsoft, Google, and Amazon are working on AI-based detection solutions. But the delay between laboratory development and operational deployment across thousands of organizations is measured in quarters, not days. And it is this delay that the Five Eyes are seeking to compress through their alert.

What organizations must do now — without waiting for governments to act

Faced with the urgency flagged by the Five Eyes, organizations with security responsibilities cannot wait for government directives. Measures that can be taken immediately: audit and update all existing detection solutions, strengthen multi-factor authentication protocols, segment networks to limit an attacker's lateral movement, and intensively train personnel on new AI-generated phishing methods. None of these measures are new. But their urgency is multiplied tenfold by the Five Eyes alert.

For organizations managing sensitive data linked to defense, military research, or critical infrastructure, the June 22 advisory should trigger an immediate review of their security posture. Not in six months. Now. Because "months" is the timeline the Five Eyes give for adversary capabilities to be fully operational. And some of those capabilities — like GREYVIBE using generative AI against Ukraine — already are. The window is not yet closed. But it is closing.

Governments publish advisories. Organizations read those advisories, note that they are concerning, and resume activities. That cycle must change. "Months" is not the time for a lengthy institutional reform. It is the time for concrete, immediate action. And if organizations wait for their governments to tell them exactly what to do, they will arrive too late. Cybersecurity is not managed by waiting for instructions. It is practiced in anticipation.

GREYVIBE and others — what the war in Ukraine teaches us about weaponized AI

Since 2022, the war in Ukraine has been the global laboratory of cyberwar and new military technologies. Ukrainian drones integrating AI to counter Russian GPS jamming, automated reconnaissance systems, real-time analysis tools for enemy positions — Ukraine innovates at a speed forced by necessity. But the conflict also reveals AI use on the Russian side: the group GREYVIBE, documented by WithSecure, uses tools like ChatGPT, Gemini, and Ideogram to generate malicious content, obfuscation code, and visual lures in its attacks against Ukraine.

This use of generative AI in active cyberespionage operations represents a qualitative step in the evolution of the threat. GREYVIBE is not merely a group of hackers using AI tools: it is an operational model that demonstrates how AI can be integrated into every phase of a cyber operation — from the generation of the initial lure to the creation of malicious code, through to malware obfuscation to evade detection. This operational model is one that the Five Eyes expect to see replicated and amplified by other actors in the coming months.

Ukrainian AI-equipped drones — the offensive technology that forces defense to adapt

If Ukraine is an AI experimentation laboratory in cyberwar, it is also one for the integration of AI into conventional weapons systems. Ukrainian drones equipped with AI for autonomous navigation when GPS is jammed represent exactly the type of disruptive military technological innovation that the Five Eyes advisories highlight. AI is not only changing cyberwar — it is changing the very nature of kinetic warfare, making precision strikes possible at distances and in conditions that conventional systems could not achieve.

The convergence of AI in both cyberwar AND conventional warfare is what makes the Five Eyes alert particularly serious. This is not a threat in a single domain. It is a systemic transformation of the nature of conflict, simultaneously affecting physical battlefields, computer networks, influence operations, and intelligence capabilities. And this transformation is unfolding right now, in real time, in the servers and on the battlefields of Ukraine.

Ukraine is the laboratory of the future of war. And that future is already here, in GREYVIBE's lines of code, in the navigation algorithms of drones, in the AI models generating the next phishing lures. The West has the chance to learn in real time from what is happening in Ukraine. The question is whether it will transform those lessons into defensive adaptations fast enough. Or whether we'll once again realize we were behind when it's too late.

Democracies facing the dilemma — regulate without disarming

The Five Eyes alert highlights a fundamental dilemma for Western democracies: how to regulate the military use of AI without creating competitive disadvantages against adversaries who have no intention of submitting to these regulations? Democracies have traditions of ethical governance of military technologies — treaties, conventions, international norms. These traditions are strengths, not weaknesses. But they create constraints that China, Russia, Iran, and North Korea do not impose on themselves.

The response to this dilemma cannot be to abandon all ethical governance of military AI. That would mean abandoning what distinguishes us from our adversaries. But it cannot be to impose unilateral constraints that leave our adversaries advancing freely in a space where we have tied our own hands. The solution lies in intelligent, coordinated governance: norms that apply among democracies, combined with pressure mechanisms on non-cooperative actors, and a robust defensive capability that does not depend on adversaries' goodwill.

The UN, NATO, and international institutions — can they keep pace with AI?

International institutions have historically operated at a pace incompatible with the speed of technological evolution. The UN has been debating a regulatory framework for Lethal Autonomous Weapons Systems (LAWS) for years without reaching consensus. NATO adopted "responsible AI principles" in 2021 — an important text but without binding mechanisms. These institutions are not capable, in their current form, of producing binding norms on military AI at the speed of months suggested by the Five Eyes.

This does not mean they are useless. Multilateral processes have a signaling and legitimation value that unilateral actions lack. But in the immediate term, the response to the urgency flagged by the Five Eyes will come through ad hoc coalitions of like-minded democracies — as is the case for support to Ukraine. Specific, agile alliances capable of acting quickly on defensive and offensive AI governance, without waiting for a global consensus that will not come.

The UN is not going to solve the military AI problem in a few months. That is a reality the Five Eyes know, which is why they publish direct advisories to governments and organizations rather than waiting for a Security Council resolution. Military AI governance, in the months ahead, will be built outside the major institutions. In coalitions of the willing. Like so many other things since February 24, 2022.

Investing in AI-based cyber defense — a priority that can no longer be deferred

The Five Eyes advisory is, ultimately, a call to invest. Invest in research on detecting AI-generated attacks. Invest in training cybersecurity personnel in new adversarial methods. Invest in public-private partnerships that allow tech companies to share their findings on new threats. And invest in the resilience of critical infrastructure — energy, transport, communications networks — against attacks that could exploit vulnerabilities discovered and weaponized by AI in hours.

These investments have a cost. But they also carry a cost-benefit ratio that hesitant governments should calculate seriously: the cost of a successful attack on critical infrastructure — a power plant, a water distribution network, a healthcare system — is incomparable to the cost of protecting it. The Five Eyes alert is not an abstract hypothesis. It is grounded in real incidents, identified groups, and documented capabilities. The risk is real. The response must be equally so.

Democratic solidarity as a strategic response

The joint advisory of the six agencies of the Five Eyes is itself a demonstration of what democratic solidarity can produce: a shared analysis, a common language, a coordinated signal. This coordination must expand and deepen. The threat respects no national borders — Ukraine, Belgium, Canada, and the United States are all targeted by the same actors with the same tools. The response must match this reality: not national first, but collective and coordinated from the outset.

Supporting Ukraine in its war against Russia also means supporting the democracy on the front lines of this transformation of cyberwar. The lessons learned on Ukrainian battlefields — about drones, offensive AI, coordinated cyberattacks — are strategic intelligence that benefits the entire alliance. Sharing these lessons, funding Ukrainian technological innovation, and integrating Ukraine into cyber intelligence-sharing circles are strategic investments in the collective security of all democracies.

Six intelligence agencies from five countries publish together an advisory saying the threat is months away. That is remarkable. And it is a demonstration that democratic solidarity works when practiced with conviction. The same solidarity that delivers weapons to Ukraine, that imposes sanctions on Russia, that shares threat intelligence — this solidarity is our only viable response to a threat that has neither borders nor scruples.

AI lowers the cost of entry into cyberwar — and broadens the circle of adversaries

One of the deepest implications of the AI revolution in cyberwar is what experts call the democratization of advanced cyber threat. Previously, launching a sophisticated cyber operation against high-value targets required considerable resources: teams of highly specialized engineers, years of tool development, a state-level budget. AI fundamentally changes this equation: a small team can now accomplish what required an army. And a second-tier state actor can now deploy capabilities that were previously reserved for superpowers.

Iran and North Korea, explicitly named in the Five Eyes advisory, are the most direct beneficiaries of this democratization. Both countries have active offensive cyber capabilities but are limited by their technological and human resources. AI could rapidly close these gaps, allowing them to automate vulnerability discovery, generate sophisticated lures, and deploy complex malware without requiring the teams of hundreds of specialists that China and Russia maintain. This is a qualitatively new threat that current defenses were not designed to counter.

The AI paradox — a technology developed by democracies used against them

There is a profound paradox at the heart of this situation: the frontier AI technologies fueling this cyberwar revolution were developed, largely, in Western democracies. OpenAI, Google DeepMind, Anthropic are American companies. The technologies they produce — accessible through APIs and open platforms — are available to anyone with a computer and an internet connection. Including the operators of GREYVIBE, Void Blizzard's hackers, and the Chinese military intelligence services.

This paradox has no simple solution. Closing access to these technologies for adversary actors is technically difficult and economically costly for the companies developing them. Doing nothing is strategically unacceptable. The middle path — technical guardrails, usage audits, targeted geographic restrictions — is the only pragmatic response. But it requires a coordination between governments and tech companies that no one has yet managed to achieve at the speed the threat demands.

Democracies created the technologies their adversaries are now using against them. There is something in this observation that resembles a tragedy. But it is also an opportunity: since we built these technologies, we understand how they work, and we can design the appropriate defenses. The problem is speed. The adversary adapts at the speed of AI. We adapt at the speed of institutional processes. And these two speeds are not compatible.

"Months" — and now what

The Five Eyes advisory of June 22, 2026 marks a turning point. Not because the threat of AI in cyberwar was unknown — security experts had been discussing it for years. But because the formulation "in months, not years" transforms an abstract threat into an operational urgency. It says: this is no longer the time for long-term planning. It is the time for immediate action. And for governments, organizations, and citizens who had not yet integrated this reality into their priorities, this signal cannot be ignored.

The question now is simple: will Western democracies respond at the speed of the threat? Will they invest, coordinate, and act in the weeks and months ahead with the urgency that the situation demands? Or will this advisory, like so many before it, be read, noted, and set aside while waiting for the next incident to create the urgency that words were not enough to create? I am a skeptical optimist. I hope for the first option. I fear it will be the second.

What Ukraine proves to us, once again

There is one democracy that does not have the luxury of waiting. Ukraine has lived under Russian cyber assault since 2014. It has learned to adapt its defenses in real time, to transform every attack into a lesson, to innovate under conditions that no Western country has had to face in this way. Groups like GREYVIBE target Ukraine because it is on the front line. And Ukraine resists, innovates, and shares its lessons with its allies.

If Western democracies take the Five Eyes alert seriously — if they invest, coordinate, and act with the speed the threat demands — they can build the defenses necessary to face offensive AI within the timeframe. It is not easy. It is not free. But it is necessary. As Zelensky has said, again and again, in the face of a threat that does not pause: the only option is to resist. And resistance starts with being ready.

The Five Eyes said time is pressing. Ukraine has been resisting for years under attacks that already use AI. And Western democracies are still debating their cybersecurity budgets. In that dissonance, there is something deeply troubling. The threat does not adjust to the rhythm of our parliamentary debates. It adjusts to its own logic, which is that of maximally exploiting our slowness. And that is the real message of June 22, 2026.

By Maxime Marquette, columnist

Editorial stance

I am not a journalist but a columnist and analyst. My expertise lies in observing and analysing the geopolitical, economic and strategic dynamics that shape our world. My work is to take political strategies apart, to understand global economic movements, to put the decisions of international actors in context and to offer analytical perspectives on the changes that are redefining our societies.

I do not claim the cold objectivity of traditional journalism, which stops at reporting facts. I claim analytical clarity, rigorous interpretation and a deep understanding of the complex issues that concern us all. My role is to give meaning to the facts, to place them in their historical and strategic context, and to offer a critical reading of events.

Method and sources

This text keeps the basic distinction between verified facts and interpretive analysis. The rule never changes: a factual claim is published only when a verifiable source supports it, and the sources this article actually used are listed under Sources, never here.

Primary source families used by the publication, when the story has them: official statements from governments and international institutions, public statements by political leaders, reports from intergovernmental organisations, dispatches from recognised international news agencies.

Secondary source families: specialised publications, internationally recognised news media, analyses from established research institutions, reports from industry organisations.

When an article cites statistical, economic or geopolitical data, it comes from the institutions that produce it (intergovernmental organisations, central banks, national statistics offices), and the exact institution is named under Sources.

Nature of the analysis

The analyses, interpretations and perspectives in the analytical sections of this article are a critical, contextual synthesis based on the information available, the trends observed and the expert comments cited in the sources consulted.

My role is to interpret these facts, to set them in the context of today's geopolitical and economic dynamics, and to give them a coherent meaning within the larger story of the changes shaping our time. These analyses reflect expertise built through continuous observation of international affairs and an understanding of the strategic mechanisms that drive global actors.

This article describes a documented state of affairs on its publication date, not a prediction: later developments may shift its outlook. No update is promised in advance; when an article is corrected or completed, the change is dated in the text.