Months, Not Years

On June 22, 2026, the intelligence agencies of five governments — the United States, the United Kingdom, Canada, Australia, and New Zealand, the alliance the world calls Five Eyes — did something they almost never do: they signed their names to a public warning, together, about a single technology. And the thing they wanted the public to hear is the thing this publication has spent its entire run trying to say without a security clearance. Frontier AI, they wrote, is about to "fundamentally transform both offensive and defensive cyber capabilities," and the schedule is not the comfortable one everyone assumed. "The timeline," the agencies said, "is not years, it is months." For a site built on the argument that the cord tightens faster than the person holding it can feel, that is not a headline. It is a confirmation, signed by the people who read the classified traffic.

Read who put their name on it, because the signatures are the story. The statement carried the signature of David Imbordino, who runs the cybersecurity directorate at the National Security Agency, and Nick Andersen, the acting director of CISA — the two American officials whose entire job is to be calm about exactly this kind of thing. They named names: Anthropic's Fable 5, OpenAI's Daybreak, the models capable of finding and exploiting a weakness faster than any human team. And they were specific about where the damage lands — not on some exotic future infrastructure, but on the dull, familiar stuff every organization already runs on: legacy systems, slow patching, machines left connected to the internet that never needed to be, weak passwords, no plan for the day something breaks. "The rapid pace of frontier AI development," they wrote, "means cyber risk assumptions can become outdated in months, not years." The window between discovering a hole and having it torn open is collapsing, and the agencies put a number on the collapse. Months.

“We said the tether tightens before you notice. They said months. We said the thing you can't put down is also the thing that can take you apart. They named the models that will do it. The argument was never paranoia — it was just early.”

Here is what makes this a story for this site and not just for the security desk. The whole argument here has always been that dependence is the vulnerability — that the danger of leaning on a machine is not the day it fails you but the day you can no longer function without it. The Five Eyes warning is that same argument run the other direction. The systems we have tethered ourselves to — the ones now woven through every hospital, grid, bank, and government office — are the exact surface this new capability is built to attack. The cord runs both ways. The thing you depend on for everything is, by definition, the thing whose failure costs you everything, and five intelligence services just told you the tools that can pull that cord are months from being in anyone's hands. Dependence was always the exposure. The agencies are simply the first institution powerful enough to say it with a clock attached.

And the most honest part of the warning is the part that admits the gate is already open. Days after the United States blocked foreign nationals from using Fable 5, the same agencies conceded that the restriction buys almost nothing — because the capability has already leaked into the wild. Cybersecurity researchers told CyberScoop that what Fable 5 can do, older models like Claude Opus and Claude Sonnet can largely do already, and so can open-source models out of China that no government controls. Open models run six to eight months behind the frontier and then they are simply free, forever, to everyone. So the timeline the spies handed you is not a countdown to a locked weapon being built. It is a countdown to a thing that already exists becoming ordinary. Which is why their actual advice, stripped of the alarm, was almost embarrassingly plain: get the basics right, act quickly, stop treating security as an afterthought. "Those that do not," they wrote, "will face growing operational and strategic disadvantage." We always knew what to do. We leaned on the cord instead, because leaning felt like safety.

This is the warning this publication has been issuing into the void, returned to us in the flat, declarative voice of the people who guard the secrets. We said the tether tightens before you notice. They said months. We said the thing you can't put down is also the thing that can take you apart. They named the models that will do it. There is something clarifying about hearing your own alarm read back to you by the National Security Agency — it means the argument was never paranoia, it was just early. The cord we spent the last stretch calling convenient, then calling load-bearing, the agencies are now calling a national vulnerability with a deadline measured in months. Nothing about the cord changed. We just finally got the date.

Five governments, one signature, zero ambiguity. "The timeline is not years, it is months." Signed by the NSA's cyber chief and the acting head of CISA. The models named out loud. The targets named too — your hospital, your grid, your bank, all the boring systems you forgot you depend on. And the quiet admission underneath the alarm: the capability already leaked, the restriction buys nothing, the only defense is the basics we skipped because dependence felt like safety. We kept saying the cord tightens faster than you can feel it. Now the spies agree, and they brought a clock. That's what tethered means when the people who read the classified traffic start saying it out loud — and giving it a deadline.