Dear Editor,
Morley’s article about the threats to government and other organisations by modern agentic AI is a timely warning of the cybersecurity threat posed by AI[1]. Much of the all-pervasive hype about AI’s potential benefits, including in healthcare, has been generally seen through rose-tinted spectacles.
However, every rose has its thorn and in 2026, the world seems to have woken up to the fact that AI can pose not only a significant cybersecurity threat to large organisations as described by Morley, but also, possibly, an existential threat to humanity[2].
The various unplanned, unexpected hacks of external websites and organisations by agentic AI has made it obvious that contemporary AI is clearly capable of penetrating the IT infrastructure of large companies and in Australia’s case, a number of government websites[3].
One infers that were it not for the e-mail from OpenAI to the Australian government about this hack, they would have been none the wiser. This is, or should be, surprising. Not only could Open AI’s agentic AI infiltrate various Australian government websites, but it did so apparently undetected, over a period of time.
Morley is surprisingly optimistic in the face of the rapidly evolving AI threat landscape when she says “The existence of these threats does not mean catastrophe is inevitable”.
Earlier this month, the UK’s minister for AI warned that it was “likely, if not inevitable” that UK government cyberdefences would be breached by agentic AI in the future[4]. Ironically, the AI minister said that the British government would deploy “advanced AI” to counter the rising threat from AI in cyberspace.
In essence, we are in an arms race between offensive and defensive AI systems.
This contest was confirmed by the Director General of MI5, Sir Ken McCallum, in his recent “Annual Threat Update”, in which he described the increasing threat from AI, not just in the cybersecurity arena[5]. In response, Sir Ken announced that MI5, the UK's domestic intelligence service, was establishing an AI Threat Assessment Centre to assess the risks posed by AI-based threats to the UK.
Most, if not all NHS Trusts will be acutely aware of the changing cybersecurity threat environment. What is new is the rapid pace of change and the emergence of new, more capable threats due to the advances in AI in general and the use of AI by bad actors. A key word in Morley’s article was “relentless”. Current agentic AI are relentless in the pursuit of the tasks given to them by humans.
Well-organised cyber-criminals, or state-backed hackers might give up if they fail to compromise a target’s network, modern agentic AI will not. This is a new kind of enemy. It does not tire, it does not get disheartened, it keeps going until the mission is complete by whatever means are necessary.
There is absolutely no room for complacency in the face of these AI cybersecurity threats. We must heed the warnings from Australia and our own Government’s national advisors and enact appropriate countermeasures.
References:
1. Morley J. Threats posed by AI require proactive mitigation. BMJ 2026395:e101022 doi: https://doi.org/10.1136/bmj-2026-101022
2. Gerken T. Anthropic researcher believes more than 10% chance ‘AI could kill all humans’. BBC News 9th September 2026. https://www.bbc.co.uk/news/articles/ckgwy1k42w4o
3. Wilson C. Health data attack the ‘first’ government hack by autonomous AI, researchers say. ABC Australia 24th September 2026. https://www.abc.net.au/news/2026-09-24/openai-agents-plotted-to-access-d...
4. Cress L, Cieslak M. AI Minister warns ‘likely’ UK’s cyberdefences will be breached. BBC News 12th October 2026. https://www.bbc.co.uk/news/articles/cr78pe09y05xo
5. Gardner F, Goldsmith A. MI5 Chief warns of threats to UK from Russia, Iran and AI. BBC News 13th October 2026. https://www.bbc.co.uk/news/articles/c60rl5vwpk02o
We must not underestimate the cybersecurity risks posed by agentic AI