Frontier AI Models V Cybersecurity: Finding A Path Past The Hype

What’s been going on?

• Since April, a thriving ecosystem of frontier AI models has rapidly emerged, released by companies like Anthropic, Google, X, Alibaba, and OpenAI. 
• These frontier AI models include Fable 5 and Mythos 5, Grok 4.5, GPT 5.6, Gemini 3.5, and Qwen 3 which are now in use, with differing levels of public availability. 
• Beyond their efficiency and business benefit, these models usher in the potential for ‘expert hacking at scale’, where software bugs causing security vulnerabilities can be found and exploited by malicious actors almost immediately. 
• In short, these tools can locate, string and provide rapid and wide-scale exploitation of existing software vulnerabilities. This will compress the identity to exploit timeline from weeks to minutes. 
• Taken collectively, these tools amplify the speed of cyber-attacks, compress timeframes for defensive measures, and require a re-evaluation of cyber preparedness, governance and plans (e.g. business continuity and cyber incident response plans).
• The cyber risks created by AI frontier models are no longer hypothetical. There is increasing public access to frontier AI models and concern that, notwithstanding access control restrictions and guardrails, these models will eventually “break-out” or be replicated by those with nefarious purposes. 
• In the context of these risks, the Australian Signals Directorate, Australian Prudential Regulation Authority and Australian Securities and Investments Commission have all published advisories. 

What does this mean for me? 

• Importantly, this does not require a ‘knee jerk’ re-prioritisation of cybersecurity measures. Organisations need to act with urgency and focus, but there is no need to panic.
• Your organisation will need to revisit and strengthen its cyber resilience (something that should be done constantly in any respect as part of good cyber hygiene practice). 
• Frontier AI models are changing some existing assumptions in cyber defence, particularly in relation to the speed of exploitation of vulnerabilities, requiring organisations to act faster to identify and patch those vulnerabilities in advance. 
• Frontier AI models have a dual use: models that can find and exploit vulnerabilities can equally find and patch them. We are in a cyber race with our adversaries. 
• As software vendors identify legacy vulnerabilities, they will release a larger number of patches which will need to be implemented. 

What should I do?

• It should not take the emergence of frontier AI models to motivate a revisit of your organisation’s current cyber posture. It’s timely for management and boards to undertake a risk-aligned review of cybersecurity resilience and readiness measures, with frontier AI models front of mind. 
• Regulators expect boards (in line with their duties as directors) to maintain, at a minimum, sufficient understanding and literacy with respect to AI and cyber security to set strategic direction and provide effective challenge and oversight, including being responsible for setting risk appetite and overseeing risk management. 
• Do not run the wrong race or get distracted by the hype at the expense of good cyber hygiene. At this point in time, most of our adversaries are still attacking us with traditional techniques, including coming through the front door with compromised credentials or social engineering. 

To ensure your organisation is prepared, you should consider: 

The content of this article is intended to provide a general guide to the subject matter. Specialist advice should be sought about your specific circumstances.