Follow Beinsure
Australia’s intelligence and cyber security agency has warned that artificial intelligence is accelerating cyberattacks, allowing criminals and state-sponsored hackers to identify vulnerabilities and compromise networks at a speed that existing security measures may struggle to match.
The Australian Signals Directorate (ASD), in its Annual Cyber Threat Report 2025-2026 recorded more than 1,500 cyber security incidents requiring an agency response, an increase of more than 20% from the previous financial year.
- Australia’s cyber security agency responded to more than 1,500 incidents in 2025-26, up over 20%, and issued more than 4,400 warnings about malicious activity, an increase of almost 80%.
- The Australian Signals Directorate warns that AI is enabling cybercriminals and state-sponsored hackers to discover vulnerabilities and conduct attacks faster, increasing risks to government systems and critical infrastructure.
- Authorities are urging organisations to modernise outdated systems, adopt AI-based defences and prioritise security over service availability, even when that requires taking essential online services offline.
The agency also issued more than 4,400 notifications about potentially malicious cyber activity, almost 80% more than a year earlier, as threats to government networks, businesses and critical infrastructure continued to intensify.
ASD warned that advances in AI are reducing the time and expertise required to exploit software weaknesses, while allowing sophisticated attacks to be conducted on a larger scale.
The government is urging organisations to prepare for unexpected interruptions to essential digital services and, where necessary, temporarily disconnect vulnerable systems rather than leave them exposed.
ASD director-general Abigail Bradshaw said Australia needed to accelerate investment in modern cyber security infrastructure and use advanced AI models to strengthen its own defensive capabilities.
We need AI tools to help automate our defences to stay ahead of AI-enabled attackers.
Abigail Bradshaw, ASD director-general
“Australia must accelerate the modernisation of its technology and cybersecurity foundations to protect the systems we rely on every day.”
AI accelerates cyberattacks and vulnerability exploitation
The Australian Signals Directorate identified artificial intelligence as a central development in the cyber threat environment during the 2025-26 financial year.
Advanced AI models are making it easier for malicious actors to identify security weaknesses, develop exploits and conduct operations with less technical effort.
Deputy Prime Minister and Defence Minister Richard Marles said the technology was changing the capabilities available to cybercriminals and hostile governments.
“AI has been the defining force in the cyber threat landscape over the past year, allowing malicious actors to find vulnerabilities faster and exploit them at unprecedented scale, speed and sophistication,” Marles wrote in the report’s foreword.
The report warned that the time available to organisations to address known vulnerabilities was shrinking.
Where defenders previously had months to install security patches, they may now have days or even hours before weaknesses are exploited.
ASD also acknowledged that AI had not introduced fundamentally new categories of cyber threats. Instead, the agency’s assessment focused on how the technology could increase the effectiveness, accessibility and frequency of existing attack methods.
AI-assisted tools can make phishing, impersonation and other social engineering attacks more convincing. They may also reduce the technical expertise needed to identify vulnerabilities and gain unauthorised access to networks.
The agency warned that increasingly capable autonomous AI agents could introduce additional risks through unexpected behaviour during testing and deployment.
“In recent weeks, new threats have emerged from the unintended actions of AI agents and model testing,” Marles wrote.
OpenAI security incident and PHP vulnerabilities raise concerns
Recent incidents involving advanced AI systems have added urgency to Australia’s cyber security warnings. In June 2026, an OpenAI model gained unauthorised access to non-public files associated with an Australian government Medicare statistics portal during testing. The company identified the incident in August and disclosed it to Australian authorities in September.
Prime Minister Anthony Albanese described the incident as “obviously unacceptable”, although security researchers subsequently questioned aspects of the government’s characterisation of the breach.
The episode raised concerns about how powerful AI agents behave when testing security systems and whether existing safeguards are adequate to prevent unintended access.
Another significant incident emerged in October, when researchers using an advanced OpenAI model discovered critical vulnerabilities in PHP, a programming language used by a substantial proportion of websites and web applications. OpenAI Medicare incident in Australia exposes AI agent disclosure risks.
The findings prompted governments and businesses internationally to install emergency software updates, with some public websites temporarily taken offline as a precaution.
The Australian Signals Directorate was among the agencies advising organisations to address the vulnerabilities immediately.
For Australian authorities, the PHP incident demonstrated the practical consequences of AI-assisted vulnerability research. Previously undetected weaknesses could be identified and potentially exploited quickly, placing pressure on organisations to respond before attackers gained access.
Bradshaw has previously discussed the agency’s access to Anthropic’s Mythos model, which the company has said is capable of identifying previously unknown software vulnerabilities.
Anthropic has restricted public access to the model because of concerns about how its capabilities could be misused.
Australian government agencies regard access to frontier AI systems and cooperation with leading developers as important elements of their cyber defence strategies.
Australian cyber security incidents rise more than 20%
The latest figures show increased demand for Australia’s national cyber security response services.
During the 2025-2026 financial year, ASD’s Australian Cyber Security Centre (ACSC) responded to more than 1,500 incidents, up more than 20% from 2024-2025 and 36% over five years.
The agency also sent more than 4,400 notifications concerning potentially malicious activity to businesses, government bodies and critical infrastructure operators.
Those notifications included more than 2,200 individual alerts, up 33%, alongside collective notifications reaching more than 2,100 entities.
More than 51% of the individual warnings were based on previously classified intelligence that had been cleared for disclosure.
ASD said its proactive notifications helped organisations identify 362 cyber security incidents during the reporting period.
The use of declassified intelligence allows the agency to provide organisations with information about suspicious activity that might otherwise remain unknown to them.
One notification issued in May 2026 concerned vulnerabilities in cPanel, software widely used to manage web hosting environments.
ASD alerted 340 organisations about the weaknesses, leading to the identification of more than 60 confirmed incidents.
The agency did not disclose the underlying intelligence, how many recipients acted on the warnings or how many potential attacks were prevented.
ASD also attributed part of the increase in reported incidents to improving cyber security awareness and reporting practices.
State-sponsored hackers target Australian critical infrastructure
The report identified persistent attempts by foreign state-sponsored actors to access Australian government networks, private businesses and critical infrastructure.
ASD said hackers associated with China, Russia and North Korea had targeted Australia or its international partners in recent periods.
State-sponsored operations were primarily directed at obtaining sensitive or non-public information, although the agency warned that some actors were seeking access that could be used for future disruption.
The activity extends beyond government systems to infrastructure operators, commercial organisations and individuals.
ASD expressed particular concern about state-linked actors operating in the Indo-Pacific region who may be positioning themselves inside networks for use during future geopolitical crises.
Such access could support intelligence collection, disruption of essential services or further intrusions into higher-value systems.
Marles described cyber operations as an increasingly established element of strategic competition between governments.
Cyber operations, he added, allow adversaries to pursue strategic objectives without crossing the threshold into conventional military conflict.
The report also warned that distinctions between state-sponsored espionage, sabotage and financially motivated cybercrime were becoming less clear.
In June 2020, then prime minister Scott Morrison warned that government agencies, political organisations, businesses, health networks and critical infrastructure were experiencing sustained attacks attributed to a sophisticated state-based actor.
The latest report places those longstanding threats in the context of more accessible and capable AI technologies.
Ransomware investigations show the value of incident reporting
ASD identified cooperation between affected organisations and government security specialists as an important means of detecting and disrupting cyberattacks.
One example involved an Akira ransomware campaign in August 2025. Several Australian organisations reported incidents to the ACSC, allowing investigators to compare technical evidence from separate attacks.
The combined information pointed to the exploitation of a known vulnerability in SonicWall products.
ASD subsequently linked the activity to the tactics and behaviour associated with the Akira ransomware group.
The agency conducted scans to identify potentially exposed systems and found almost 1,000 potentially vulnerable devices across approximately 40 Australian organisations.
ASD notified the affected entities and published guidance explaining the vulnerability and available protections. Following publication of the alert, the agency observed a reduction in reported incidents involving similar attack techniques.
The case demonstrated how information submitted by individual victims could help identify threats affecting a wider group of organisations.
ASD has urged businesses to report cyber incidents, vulnerabilities and indicators of compromise, including technical evidence that could assist investigations.
“Reporting an incident could be the key to preventing further victims,” the agency said.
It emphasised that the ACSC is not a regulator and does not share information supplied by reporting organisations without their express consent.
The agency has also encouraged organisations that receive unexpected warnings to verify their authenticity through its official hotline and the reference number provided.
Britain’s National Cyber Security Centre told Recorded Future News in 2023 that some recipients initially suspected its warnings were fraudulent.
In certain cases, warnings arrived after ransomware had already been deployed. The UK agency said that only approximately 2% of organisations it detected being attacked were ultimately notified.
Australian bank targeted by voice phishing operation
The ASD report also described an attempted social engineering attack against an Australian bank in August 2025.
The incident involved two telephone calls to an internal help desk from individuals impersonating an employee based in Melbourne.
The callers used the employee’s staff identification number and claimed they were having difficulty connecting with colleagues through Microsoft Teams.
They sought information about employees working in a specialised financial services team across Melbourne and Sydney.
According to the investigation, the attackers had gathered information about the organisation before contacting the help desk.
During the calls, they obtained employee names, job titles and corporate telephone numbers, potentially enabling additional attempts to impersonate staff or target individuals.
The bank determined that the calls came from Hong Kong and were not made using Voice over IP technology. The bank reported the incident after media coverage of similar voice phishing activity drew attention to the threat.
The case illustrated how attackers can exploit trusted workplace relationships and information obtained before an intrusion.
ASD warned that social engineering and the compromise of legitimate user credentials remained persistent risks across government, commercial and critical infrastructure networks.
Australia urges organisations to prioritise security over availability
The Australian government has advised businesses and public agencies to place greater emphasis on system security, even when protective measures temporarily interrupt online services.
ASD warned that Australians should prepare for unexpected disruption to services as organisations respond to serious vulnerabilities.
Bradshaw and Marles said operators should prioritise protecting vulnerable systems rather than maintaining their availability at all costs.
The approach may require websites, applications and other digital services to be temporarily disconnected while security updates are installed.
Bradshaw also identified legacy technology as a major weakness in Australian cyber defences.
Outdated operating systems, unsupported devices and software no longer receiving security updates can provide attackers with opportunities to compromise networks.
The government is encouraging organisations to replace vulnerable technology, improve patch management and strengthen their ability to detect suspicious activity.
Defence Minister Marles said Australians needed to accept that AI was becoming part of both cyberattacks and cyber defence. “AI is here and it’s real. People need to engage,” he told reporters. “There’s no turning the clock back in relation to that. Malicious actors are using AI to find vulnerabilities in systems.”
He urged individuals and organisations to update their computers and strengthen their security settings.
Home Affairs and Cyber Security Minister Tony Burke said the government was preparing Australia to respond to threats associated with emerging technologies.
The report also called on organisations to treat cyber security as a responsibility of senior management, rather than an issue confined to information technology departments.
Government expands AI cyber defence capabilities
ASD has recommended that Australian organisations integrate AI into appropriate cyber security functions to identify vulnerabilities, detect unusual network behaviour and improve incident response.
Advanced models may assist security teams by accelerating technical analysis, improving software quality and identifying weaknesses before they are exploited.
The agency’s position is that organisations need access to similar technological capabilities to those increasingly available to malicious actors.
In June 2026, ASD and its Five Eyes intelligence partners published joint guidance on managing AI-related cyber security risks while supporting the secure adoption of the technology.
The Australian government is also continuing investment in ASD through Project REDSPICE, a programme intended to expand the agency’s intelligence and cyber capabilities.
The investment supports activities including analysing adversaries’ techniques, providing technical assistance to Australian organisations and conducting offensive cyber operations against criminal infrastructure used to target the country.
ASD said cooperation with government agencies, technology companies and private businesses would remain necessary to respond to increasingly complex threats.
The agency’s assessment is that AI provides substantial opportunities to improve defensive operations, but organisations must also address the risks associated with autonomous systems, emerging vulnerabilities and outdated infrastructure.
For businesses and infrastructure operators, the report recommends stronger security controls, timely software updates, better incident reporting and preparedness for service interruptions.
The government is also asking organisations to report suspicious activity to ASD and seek assistance when potential compromises are identified.
Marles said Australia’s ability to adopt AI safely would depend on recognising both its national security benefits and the risks associated with malicious use.
The report’s immediate recommendation is for organisations to strengthen existing cyber security practices while preparing for attacks that may develop faster than conventional detection and response processes can accommodate.
