The Australian Signals Directorate (ASD) is due to release its annual assessment of cyber threats on Tuesday, revealing that breakthroughs in AI have contributed to an 80 per cent jump in attacks on businesses and government agencies. The report, to be officially published on Tuesday, shows that the nature and speed of attacks have changed sharply since the emergence of so-called frontier AI models such as Anthropic's Mythos.
Frontier AI, which delivers complex problem-solving and advanced scientific modelling, has also been used by malicious actors to identify vulnerabilities in computer software. The technology recently uncovered a flaw in the programming language PHP that forced numerous websites offline for patching, including the Australian Bureau of Statistics.
ASD Director-General Abigail Bradshaw said AI enables both faster defensive action and more dangerous attacks. "They are creating enormous opportunities, but they are also enabling malicious cyber actors to identify vulnerabilities and conduct attacks faster, at a greater scale and with greater precision than ever before. This shift will only accelerate," she said. Ms Bradshaw urged organisations to quickly update their cyber protections, even if it meant temporarily shutting down online presence. "System security must be prioritised over system availability in order to deal with increased vulnerability discovery by AI models."
David Bradbury, deputy chairman of the Australian Prudential Regulation Authority, told The Australian Financial Review's Super and Wealth Summit on Monday that the risk posed by cyberattacks kept him awake at night. "It's important and central that we're ensuring that members' best interests are being observed, but when you're talking about things like a cyberattack that might be amplified by AI, driven by foreign actors; something like this could actually start to clean out people's accounts," he said.
Australia's superannuation funds hold more than $4.5 trillion in assets across at least 25 million accounts. In the 2025-26 financial year, the ASD notified companies and agencies more than 4400 times of potentially malicious cyber activity, an 80 per cent jump on the previous year. The agency responded to more than 1500 incidents, received over 82,000 cybercrime reports (one every six minutes), and blocked access to more than 564 million malicious website domains.
The cost of attacks continues to rise, climbing 16 per cent to an average $93,500 for self-reported cases, with medium-sized businesses seeing a 45 per cent jump to $141,300. Many businesses still rely on legacy software and hardware that cannot be updated to deal with sophisticated attacks.
State-sponsored actors, largely from China and Russia, remain a key concern, seeking to gain access to sensitive information. Defence Minister Richard Marles said in a statement: "AI is reshaping the online landscape, enabling cybercriminals and state-sponsored actors to launch faster, more sophisticated and scalable attacks. To stay ahead, Australians must enhance their cyber defences while harnessing AI's benefits."
The ASD maintains contact with major AI developers to stay abreast of technology and risk developments, some of which shape the warnings it delivers.