AI and the Evolving Cyber Threat Landscape: What States Need to Know

Overview

AI capabilities are advancing rapidly and are already reshaping cybersecurity, both offensively and defensively. Recent breakthroughs in frontier AI, including the emergence of highly capable models, have raised urgent questions. Who controls these capabilities? Can they be weaponized against critical infrastructure at scale? And can international norms keep pace with a technology that is evolving faster than any previous generation of cyber tools? These developments are unfolding at precisely the moment the Global Mechanism is laying its normative foundations.

In this session, organized by OXIL Research and co-hosted by the Permanent Missions of Latvia and Estonia to the UN, Member States and multi-stakeholder participants heard from experts on the latest AI capabilities and their implications for the cyber threat landscape and for discussions within the Global Mechanism. Questions explored included:

• How are frontier AI capabilities changing what is possible in offensive and defensive cyber operations, and what does that mean for critical infrastructure protection?
• Are defenders keeping pace with attackers, or is AI shifting the balance of power in cyberspace?
• What should governments understand about these developments, and in which capacities should they invest to strengthen implementation of the relevant norms and accountability within the Global Mechanism?
• What role can cyber diplomacy play in addressing the risks posed by frontier AI capabilities?

Key Takeaways

Ten key takeaways from the technical briefing delivered by Drew Bagley, Chief Privacy and Public Policy Officer at CrowdStrike:

1. Frontier AI is fundamentally transforming the cyber threat landscape by increasing speed, scale, and complexity. This shift means AI is now a structural driver of cyber risk rather than a peripheral tool, as AI-enabled attacks grow (an 89% increase in attacks by AI-enabled adversaries) while security teams struggle with overwhelming alert volumes and mounting complexity (60% of security teams have ignored alerts due to bandwidth that turned out to be critical). Many institutions still lack systematic approaches to generative AI risks, leaving them exposed as AI systems, tools, and workflows are embedded across core business operations.
2. Frontier AI models are creating a more dangerous offensive environment by autonomously discovering and exploiting vulnerabilities. Highly capable models now support automated identification and exploitation of software weaknesses, moving AI from a support function to a direct multiplier of intrusion capabilities. This evolution allows actors to scale offensive operations more rapidly and with less dependence on human operator speed or expertise.
3. The window between vulnerability disclosure and exploitation is collapsing, eroding traditional defensive timelines. The historical gap between discovering a vulnerability and its exploitation is shrinking (the fastest adversary breakout time in 2025 was 27 seconds), undermining the effectiveness of slow patching cycles, periodic reviews, and reactive security practices. In this compressed environment, frontier AI does not simply increase incident volume; it makes delayed decisions and responses significantly more costly for States, critical infrastructure operators, and private-sector organizations.
4. AI now constitutes a dual threat, as attackers both use AI and target AI systems themselves. On one axis, threat actors employ AI across the cyber kill chain to enhance social engineering, information operations, and technical intrusions. On the other axis, rapid organizational adoption of AI creates new attack surfaces across models, tools, data pipelines, and the broader digital supply chain. This dual dynamic shifts the focus from isolated misuse of AI tools toward systemic insecurity arising from the rapid and sometimes ungoverned deployment of AI capabilities.
5. AI is being integrated directly into technical intrusion and malware operations across the kill chain. AI can generate scripts for post-exploitation activities such as credential dumping, augment malware with advanced reconnaissance and selective exfiltration capabilities, and support exploration of novel tactics during live operations. Looking ahead, concerns include adversaries leveraging victims' own AI tools against them and the prospect of agentic AI systems that can autonomously execute complex chains of malicious actions.
6. Legacy security approaches are increasingly inadequate because they are fragmented, posture-based, and too static for AI-driven threats. Traditional frameworks centred on asset discovery, single-layer firewalls, compliance-oriented governance, and data loss prevention struggle to keep pace with dynamic AI-enabled operations. While governance and point controls remain essential, effective defence now requires continuous runtime visibility, integrated coverage across endpoints, SaaS, and cloud, and action-oriented capabilities that can intervene in real time.
7. Security practice must pivot toward continuous AI detection and response (AIDR) across the full AI estate. This entails achieving end-to-end visibility and control over data, models, prompts, agents, identities, infrastructure, and interaction layers, coupled with governance and detection mechanisms for risks such as prompt injection, jailbreaks, agent hijacking, rogue agents, and sensitive data exfiltration. Securing AI thus becomes a lifecycle challenge, demanding integrated design, deployment, monitoring, and response rather than one-off compliance checks.
8. AI represents the next distinct security category following previous computing shifts, and requires dedicated capabilities and doctrine. Drawing on earlier transitions from network security to endpoint and cloud security, AIDR is a separate domain rather than a mere extension of existing controls. Institutions that treat AI simply as another IT feature risk underestimating the need for specialized tools, skills, and operating models tailored to AI systems and agentic behaviours.
9. Agents pose a particularly significant operational and security challenge because they can act across multiple systems and interfaces. Computer-use agents operating at endpoints may interact with identity, data, files, settings, shell, and browser environments, and connect to cloud platforms and SaaS applications. This broad scope of action raises both opportunities and risks, as misconfigured or compromised agents could have a systemic impact, making agent governance, permissions management, and monitoring critical priorities for security teams.
10. States have a central role in shaping governance, resilience, and crisis response to AI-enabled cyber threats. The Global Mechanism should work to develop norms for AI-enabled cybersecurity, enhance cyber resilience through shared threat intelligence, support cybersecurity capacity building for States adopting AI, and promote secure development and deployment of frontier systems. Coordinated responses to AI-driven cyber crises, strengthened protection of critical infrastructure, effective public-private engagement, and AI-enabled defensive innovation are other key areas for multilateral action.