The U.S., U.K., Canada, Australia, and New Zealand-the Five Eyes intelligence alliance-warned in a joint statement that AI-powered cyberattacks capable of causing widespread damage are only months away. The alert followed a temporary U.S. government restriction on access to Anthropic's Fable 5 and Mythos 5 models after a jailbreak exposed offensive cybersecurity capabilities. Those restrictions lifted on July 1, but the episode underscores why identity management is the critical factor in preventing large-scale AI-enabled breaches.
The Five Eyes wrote: "Cyber risk can no longer be treated as a purely technical issue. This is a core business risk and leadership responsibility." Frances Zelazny, General Manager of New Market Initiatives at Prove, has long sounded the same alarm. "We must figure out how to manage identity and its far-reaching effects," she said.
Eliminate phishable credentials now
Many government systems still rely on passwords, one-time passcodes, and push notifications-all of which AI tools can bypass. Zelazny calls it a "five-alarm crisis" that some of these methods are still legally required even after standards bodies labeled them insecure. "The scary part is that in some cases we are legally mandating them, even though our own standards bodies have deemed them insecure," she said. The immediate priority is removing phishable factors from authentication stacks and adopting layered defenses such as privacy-preserving biometrics tied to trusted devices and continuous identity signals.
The rise of non-human identities and agentic AI
Non-human identities already outnumber human ones, and agentic AI is turning them into autonomous actors that make decisions and initiate transactions at machine speed. Every AI agent needs a governance framework that verifies who authorized it, what it is allowed to do, and whether it remains within scope. The recent Christina Chapman case-sentenced to over eight years for helping North Korean IT workers use stolen identities to gain employment at more than 300 U.S. organizations-shows how synthetic identities and generative AI can walk through standard verification gaps. CrowdStrike's 2025 Threat Hunting Report recorded more than 320 such incidents in 12 months, a 220% increase year-over-year.
The Circle of Identity: continuous and verifiable
Zelazny advocates for a persistent, biometric-anchored identity model she calls the Circle of Identity. When identity is verified at enrollment and that verification becomes the reference point for device provisioning, account recovery, and high-risk transactions, the gaps fraudsters exploit shrink dramatically. "Most attacks happen in the gaps between verification events," she said. A closed Circle of Identity links the original verification to every subsequent interaction, preventing account takeovers and impersonation. For agencies adopting AI agents and digital credentials, this approach ensures that agents are governed by confidently verified humans.
Why this matters for government professionals
Government IT and security leaders face a narrowing window. The authentication methods still in use were not designed for AI-driven threats. Begin by auditing every step that relies on phishable credentials and replace them with verifiable, continuous identity checks. Establish governance for non-human and agentic identities that includes binding tokens to human authorization. Training teams on AI for Government and enrolling analysts in an AI Learning Path for Cybersecurity Analysts can build the skills to recognize and respond to AI-enabled intrusions. The Five Eyes warning is not speculative-it is a call to prepare now.
Your membership also unlocks:
