What happened
The Australian Signals Directorate (ASD) published its annual cyber‑threat report on 27 Oct 2026, stating that advanced AI models are now being used by state‑sponsored and criminal actors to locate software flaws and launch larger‑scale attacks. The agency recorded a 20 % increase in incidents handled and an 80 % increase in warnings about potentially malicious activity compared with the prior year. Recent examples include a PHP security flaw discovered with an OpenAI model that forced government websites offline, and a hack that altered supermarket fridge temperatures in France. Threat actors linked to China, Russia and North Korea are highlighted as primary users of AI‑enhanced techniques, targeting both public services and private enterprises.
Why it matters for trust and compliance
- The surge underscores the need for documented AI‑model risk management and continuous monitoring, which map to AI‑governance objectives in the NIST AI RMF and provide defensible evidence for auditors.
- Map AI‑risk assessments to existing control objectives to demonstrate governance across frameworks.
- Collect and retain evidence of model testing, data provenance, and mitigation actions for audit readiness.
Who is affected
Government agencies Critical infrastructure operators Private enterprises
Recommended actions
- Integrate AI risk assessments into your control framework and document mitigation steps.