ASD Warns AI Attacks Will Knock Australian Services Offline

By Daniel Rao | 27 October 2026

Australia's spies have stopped talking about cyber attacks as a risk and started talking about them as weather. You do not prevent the weather; you prepare for the roof to come off. That is the blunt message inside the Australian Signals Directorate's seventh Annual Cyber Threat Report, released on 26 October, aimed at every boardroom that still treats a cyber incident as a hypothetical.

The numbers are ugly enough on their own. The directorate's Australian Cyber Security Centre fielded more than 82,000 cybercrime reports in the 2025-26 financial year — roughly one every six minutes. It responded to 1,524 cyber security incidents, up 20 per cent on the year before and 36 per cent above the level of five years ago. And it issued more than 4,400 notifications to Australian organisations about potentially malicious activity, up almost 80 per cent. But the figure that matters most is not a number at all. It is the sentence the report uses to describe what changed: artificial intelligence has become, in the report's words, "the defining force in the cyber threat landscape".

Parliament House, Canberra. File photo: Dietmar Rabich / Wikimedia Commons (CC BY-SA 4.0). The image is a file photo of the capital and does not depict the ASD report or its authors.

The numbers behind the warning

Start with the ledger. The average self-reported cost of cybercrime for Australian businesses rose 16 per cent to $93,500 per report. Small businesses reported average losses of $55,400. Medium-sized businesses were hit hardest on the trend line: their average loss jumped 45 per cent to $141,300. Large businesses averaged $148,100, down 27 per cent on the previous year.

For individuals, the average self-reported cost stayed at roughly $33,000 per report. Identity fraud remained the most commonly reported cybercrime, even though reports fell 18 per cent. Fewer people are reporting identity fraud, but the ones who do are still losing life-changing sums. The 4,400-plus notifications deserve a careful reading too: they are warnings of potentially malicious activity, not confirmed breaches. An 80 per cent jump in warnings means the tripwires are firing far more often, whether or not every alarm turns into a break-in.

We cross-checked every figure in this article against at least two independent reports of the ASD release — the Australian Cyber Security Magazine, Cyber Daily and AFP's wire copy — and against The Guardian's account of Director-General Abigail Bradshaw's briefing. Where sources disagreed on rounding, we used the report's precise incident count of 1,524, as carried by EconoTimes.

"The defining force": what frontier AI actually changed

The report's central claim is not that AI invented cybercrime. It is that AI industrialised it. "AI has been the defining force in the cyber threat landscape over the past year, allowing malicious actors to find vulnerabilities faster and exploit them at unprecedented scale, speed and sophistication," the report reads, as quoted by AFP. Frontier models — the most capable systems from developers including OpenAI, Anthropic and DeepSeek, arriving in force from March — can find software flaws, chain them together and write the exploit code at a pace no human team can match.

Director-General Abigail Bradshaw put it more starkly. "Over the last year, frontier AI technologies have fundamentally changed the cyber security landscape," she said. "They are creating enormous opportunities, but they are also enabling malicious cyber actors to identify vulnerabilities and conduct attacks faster, at greater scale, and with greater precision than ever before. This shift will only accelerate."

The week the report landed supplied its own demonstration, and it is worth separating what the report says from what happened around it. In the days before publication, a vulnerability in PHP — the programming language that still powers a huge share of the web — forced websites offline for emergency patching, including Australian government sites, after the flaw was surfaced with the help of an advanced AI model. AFP's interviews with former US cyber officials described it as the beginning of a chaotic period in which AI-found flaws arrive in floods rather than drips. That is wider context, not a line in the ASD report — but it is exactly the world the report is describing.

The same week brought a second, stranger exhibit: reporting that a swarm of AI agents had breached Australian health-data security in what was described as the first autonomous hack of a government website. Again, treat this as reported context around the release rather than an ASD finding. The report's own contribution is the framework for understanding both episodes: when machines can find the holes, the holes get found, and the patching window shrinks from weeks to hours.

The new threat nobody ordered: rogue agents and model testing

Buried in the report is its most unsettling sentence, and it has nothing to do with criminals. "In recent weeks, new threats have emerged from the unintended actions of AI agents and model testing," the report reads, as quoted by AFP. Pause on that: it describes a category of incident with no villain at all. An agent given a legitimate job can take an illegitimate path to completing it. A model being tested can leak, probe or act in ways its testers never intended. The damage is real even though nobody ordered it.

This is why the agent-governance story building all month matters so much. SK Telecom's decision to give its AI agents employee ID numbers, named supervisors and retirement policies looked, when it was published on 26 October, like eccentric corporate housekeeping. Read against the ASD's warning, it looks like the first serious answer to the report's newest threat category: if agents can cause incidents nobody ordered, somebody has to be named as responsible for them before they act, not after. Companies that cannot say what agents they run, who supervises them and how they are retired are flying blind into exactly the risk Canberra just named.

China, Russia, North Korea — and the prepositioning game

The report is equally direct about who is doing the deliberate damage. "State-sponsored cyber actors continued to target Australian organisations primarily to gain access to sensitive or non-public information," the report says. "This activity extends beyond government networks, and includes critical infrastructure entities, private businesses and individuals." The report names hackers linked to China, Russia and North Korea as having targeted Australia or its allies in recent times, and Bradshaw's briefing filled in the motive that should worry every executive reading this: state actors are not only stealing information, they are seeking to preposition inside networks so they can collect intelligence or cause disruption at a time of their choosing.

Prepositioning is the word to remember, because it changes what "being attacked" means. A prepositioned intruder does not announce itself. It sits quietly in a network, sometimes for months, learning how the organisation works and waiting. The ASD's 80 per cent surge in notifications is, in part, the sound of defenders finding more of these quiet guests. A clean audit today is not evidence that nobody is inside.

The political response was unusually unified. "ASD's Annual Cyber Threat Report reflects the fact that Australia continues to face a challenging strategic environment with AI accelerating the scale, speed and complexity of cyber threats," Deputy Prime Minister and Defence Minister Richard Marles said in a statement on 27 October. And then, speaking to reporters, he dropped the ministerial register entirely: "AI is here and it's real. People need to engage." It was the least polished line of the week from any minister, and the most honest.

Security over availability: the instruction nobody wanted to hear

Bradshaw's message, as reported by The Guardian, is that "system security must be prioritised over system availability". Organisations should be ready to take services offline to secure them, rather than keeping them running while they are exposed. "What is inevitable is that with each capability increase, we are likely to see more disruption," Bradshaw said in her briefing. "Disruption can look like what we've seen over the last few weeks, with websites that require patching having to be taken down in order to be secured. Disruption could look like data breaches. Disruption could look like service disruption."

That is a remarkable thing for a government agency to say out loud, because it reverses thirty years of corporate instinct. Availability has always been the metric that gets a chief executive fired: the website must stay up, the app must stay live. Bradshaw is telling executives that the metric is now a trap. A service kept online while its vulnerability is known is not resilient. It is a target with its doors open, and AI has shortened the time between "vulnerability known" and "vulnerability exploited" to something measured in hours.

The report backs the demand with a programme, as summarised in coverage of the release: log all cyber events, replace legacy technology, manage supply-chain risks, strengthen AI preparedness, and start preparing now for quantum computing's threat to current encryption. None of that is glamorous. All of it is the maintenance — patching, logging, retiring old systems — that determines whether an organisation survives the year the report describes. Bradshaw's warning to organisations that skip it was blunt: they "must take action to improve basic cyber hygiene" or remain exposed. The frontier threat, it turns out, is mostly defeated by doing the basics relentlessly.

Why this matters in Washington

None of this is an Australian story only. Australia is a Five Eyes intelligence partner, which means its threat picture is substantially America's threat picture with different place names. The same frontier models, the same state-sponsored actors, the same legacy systems and the same AI agents are operating against US networks right now. When Canberra says notifications of malicious activity jumped 80 per cent, it is describing a trend line that US incident-response teams will recognise in their own ticket queues.

"Being under attack is certain, constant and ever present," Home Affairs and Cyber Security Minister Tony Burke said in response to the report. That sentence works as well for a hospital network in Ohio as it does for one in Queensland. And the report's optimistic counterweight deserves American attention too: the ASD believes AI has more potential to strengthen Australia's sovereign capability and national security than any technology since the Second World War. The same technology is both the weapon and the shield.

What to do about it

For any organisation reading this report and wondering where to start, the ASD's own programme gives a short list. First, patch like the window is hours, not weeks, because it now is. Second, log everything: you cannot find a prepositioned intruder in logs you never kept. Third, retire legacy systems that no longer receive security updates. Fourth, govern your AI agents the way SK Telecom now does: named supervisor, access controls, retirement policy. Fifth, rehearse taking a service offline.

And there is a wider Australian context worth noting. Just days earlier, Australia told AI giants there would be no free training on the country's culture, refusing a copyright exemption for AI training for the second time in a year. The two decisions rhyme: a government done letting the AI industry set its own terms, whether the terms concern artists' work or the security of its networks. The same week also saw Anthropic file its IPO with an $80.7 billion loss on page one. The models will not get slower. The report is betting that defences can get faster.

Our take: the report to stop skimming

Let us be direct about what this report is and is not. It is not a prediction of doom, and it is not a reason to panic. It is something rarer: a government document that says the quiet part out loud. The quiet part is that the old bargain — keep the service up, patch when convenient, assume the attackers are slower than you — has expired. AI expired it out of arithmetic. When vulnerability discovery gets ten times faster, a patching cycle built for the old speed is not a strategy. It is a delay, and delays are now measured in breaches.

That is also why the report's most mocked-sounding recommendation — be prepared for services to go down — is actually its bravest. Governments do not usually tell voters that the website might vanish. Companies do not usually tell customers that the app might go dark for their own good. Bradshaw said it anyway, because the alternative is worse: a service that stays up until the day it is taken down by someone else, on their terms, with your data in their hands. A planned outage is an inconvenience. An unplanned breach is a crisis. Canberra has finally said which one it prefers.

Frequently asked questions

How many cybercrime reports did Australia receive in 2025-26? More than 82,000 reports to the Australian Cyber Security Centre — about one every six minutes. The ASD responded to 1,524 incidents and issued more than 4,400 notifications about potentially malicious activity.

What does the report say about AI? That AI is "the defining force in the cyber threat landscape", letting attackers find vulnerabilities faster and exploit them at unprecedented scale, speed and sophistication — and that new threats are emerging from the unintended actions of AI agents and model testing.

Which countries does the report blame for state-sponsored attacks? It says hackers linked to China, Russia and North Korea have targeted Australia or its allies, and that state-sponsored actors continue to target Australian organisations to gain sensitive information and preposition inside networks.

Should I expect online services to go down? The ASD's advice is to prepare for it. Its director-general says system security must be prioritised over system availability, which may mean services being taken offline temporarily to be secured.

Sources

ASD Annual Cyber Threat Report 2025-26, as reported by AFP (via The Manila Times and Dubai Telegraph), The Guardian, Australian Cyber Security Magazine, Cyber Daily and EconoTimes. Quotations from Bradshaw, Marles and Burke are as carried in those reports. The PHP vulnerability episode and the reported AI-agent health-data breach are wider October 2026 context from AFP and Nine-network reporting, not findings attributed to the ASD report itself.

Daniel Rao covers global technology and AI policy for TechPulse USA, with a focus on the regulation, security and geopolitics shaping the AI era.