This is a risk assessment, not an announcement that such an attack has already occurred. The paper explores three plausible scenarios, ranging from slower offensive development to capabilities spreading faster than defences.
The agency expects AI to accelerate vulnerability discovery and exploitation of ageing systems. Its annual review also stresses that successful attacks continue to exploit familiar weaknesses: missing patches, poorly protected systems and equipment exposed to the internet. For organisations, its documented priority remains strengthening these protections and preparing for incidents.