Australia's cyber agency calls AI an 'unprecedented' threat in annual report

Australia's cyber security agency on Tuesday warned that artificial intelligence poses an "unprecedented" threat as foreign governments and criminals use it to hack networks and critical infrastructure, according to AFP via France 24. The warning comes in the Australian Signals Directorate's (ASD) annual cyber threat report.

The report says AI is helping attackers find and exploit weaknesses faster. It affects government bodies, critical infrastructure operators, businesses and individuals.

What the report says

The ASD said AI could bring large benefits if used for good, and that it used some AI tools to compile the report itself, AFP reported. But recent months showed AI helping criminals and state-sponsored hackers attack at "greater scale than ever before", the directorate said.

The report calls AI the defining force in the cyber threat landscape over the past year. It says the technology lets malicious actors find vulnerabilities faster and exploit them at unprecedented scale, speed and sophistication, according to the same AFP report.

The ASD added that the activity "extends beyond government networks" to critical infrastructure, private businesses and individuals, per AFP's copy on Yahoo News.

The numbers

Australian Cyber Security Magazine, which summarised the 2025-26 report, gave these figures:

• The Australian Cyber Security Centre (ACSC) received more than 82,000 cybercrime reports in the financial year. That is one every six minutes.
• It responded to more than 1,500 cyber security incidents, up more than 20% on the previous year.
• It issued more than 4,400 notifications to Australian organisations about potentially malicious activity, up almost 80%.
• It handled 139 ransomware incidents, broadly in line with the prior year.

AFP described the 4,400 figure as warnings about potentially malicious activity over the past year. The magazine said the annual figures reflect both malicious activity and changes in reporting and detection.

Cost to businesses and individuals

The magazine reported that the average self-reported cost of cybercrime for businesses rose 16% to $93,500 per report. Small businesses averaged $55,400 in losses. Medium-sized businesses averaged $141,300, up 45%.

Large businesses reported $148,100 on average, down 27%. For individuals, the average stayed near $33,000 per report.

Identity fraud remained the most commonly reported cybercrime, although reports fell 18%, the magazine said.

Who is being targeted

Government bodies accounted for the largest share of reported incidents, according to the magazine's summary. Federal agencies made up 32% and state and local governments 16%.

Healthcare and social assistance was the most frequent non-government reporter at 7%. Manufacturing entered the top ten reporting sectors and recorded the largest increase in incident reports.

How AI changes the threat

The report says AI lowers technical barriers to cybercrime, per the magazine. Attackers can automate reconnaissance, find vulnerabilities and write more convincing phishing and impersonation messages.

It also flags risks from organisations building AI systems and autonomous agents into their processes. In his foreword, Defence Minister Richard Marles pointed to threats arising from the unintended behaviour of AI agents and model testing, the magazine said.

The report also describes a growing overlap between espionage, sabotage and financially motivated crime. That makes it harder to tell criminal activity from state-directed operations.

Marles urges action

Marles said Australia could not ignore the AI revolution. "There's no turning the clock back in relation to that," he told reporters, according to AFP. He said malicious actors were using AI to find vulnerabilities in systems.

He urged Australians to update their computers and "harden their systems", AFP reported.

Old weaknesses still matter

The report says familiar problems still drive many successful compromises, the magazine reported. These include unpatched vulnerabilities, social engineering, stolen credentials and interconnected supply chains.

It notes that attackers exploited a vulnerability first identified in 2008. Publicly reported common vulnerabilities and exposures rose 30% over the financial year.

What happens next

The ACSC recommends multifactor authentication or passkeys, stronger account security and prompt reporting of suspicious activity, according to the magazine. It says organisations should move beyond basic compliance towards operational resilience. That includes incident preparedness, network visibility, vulnerability management and recovery plans.

The full Annual Cyber Threat Report 2025-26 is published by the Australian Cyber Security Centre. The report did not set out new legal requirements in the coverage reviewed.