A joint Harvard-RAND study warns that current AI systems are approaching the capability threshold to operate as fully autonomous offensive cyber weapons.
The report, titled 'The Coming Storm: AI-Enabled Cyber Operations,' analyses the progression of AI capabilities in the context of offensive cybersecurity and concludes that 'the technical barriers to autonomous cyber weapons are eroding faster than defensive measures can adapt.'
Key findings include: current AI models can already identify vulnerabilities in software at superhuman speed, generate novel exploit code, and adapt attack strategies in real-time based on defensive responses.
The missing capability — which researchers estimate could be achieved within 2-4 years — is the ability to chain these skills together autonomously: scanning a target, identifying vulnerabilities, generating exploits, executing attacks, and adapting to defences, all without human guidance.
The report recommends urgent international negotiations on AI cyber weapon controls, analogous to existing frameworks for chemical and biological weapons. However, the authors acknowledge that enforcement would be extremely difficult given the dual-use nature of AI technology.