Five Eyes says "months, not years." CISA says three days.

On 22 June the Five Eyes intelligence alliance issued a joint statement putting a timeline on frontier AI cyber risk: "months, not years." The same advisory carried an operational consequence. CISA, the US federal cyber agency, cut its patch deadline for serious vulnerabilities on federal civilian networks to three days, citing AI-augmented threats. The interesting document here is not the warning. It is the patch window.

What was actually said. The joint statement — signed by CISA in the US, NCSC in the UK, ASD in Australia, GCSB in New Zealand and CSE in Canada — warned that frontier models are "months, not years" away from materially transforming offensive cyber capabilities.¹ Reuters described the advisory as intentionally broad, repeating standard cybersecurity hygiene guidance but reframing it as newly urgent.¹ The Guardian reported that the "months, not years" formulation drew on Anthropic's Project Fetch Phase 2 threat modelling, and that Anthropic's Mythos model and OpenAI's GPT-5.5-Cyber disclosures were the proximate catalysts.²

No adversary was named. No attack vector was disclosed. No capability benchmark was published. This is a calibrated public alarm, not an intelligence release.

What Five Eyes joint statements usually look like. They are anodyne. They warn about a class of activity, name a rough actor category (state-affiliated, criminal, unspecified), and recommend hygiene. They rarely commit to a timeline in months. The 2019-era quantum advisories used "coming years." Ransomware advisories tend to describe "ongoing" or "increasing" threats. A dated horizon in a joint statement is a deliberate act, and it commits five agencies to a shared internal assessment that the horizon is defensible. Five Eyes statements are a policy instrument first and an intelligence product second. This one is doing more work than usual.

The three-day rule is the real document. CISA's Binding Operational Directive framework governs how quickly Federal Civilian Executive Branch (FCEB) agencies, the non-defence, non-intelligence parts of the US federal government, must remediate known-exploited vulnerabilities. The previous cadence on critical items ran to two weeks. Cutting that window to three days is not a communications choice. It is an operational assessment that the exploitation window has compressed enough that the old cadence fails.

Three days is inside the window most large organisations need to test a patch, stage it, and roll it into production without breaking something else. CISA is telling federal defenders that the trade-off has moved: the risk of a slow rollout now exceeds the risk of a broken rollout. That is a specific claim about attacker cadence. It says the interval between vulnerability disclosure and reliable exploitation is now short enough that human-speed patch cycles are the bottleneck.

This is inference economics, applied to offense. The frame usually reaches for the defender side: cheaper inference means cheaper agents, cheaper agents replace seats, seat pricing compresses. The offensive version of the same argument is that cheaper, faster model calls collapse the cost of reconnaissance, exploit generation, and adaptation. A vulnerability that used to take a skilled operator a week to weaponise reliably now takes an agent overnight, at a marginal cost measured in dollars. CISA's three days is what that looks like when a defender agency prices it into policy.

I would not over-read the specifics. The advisory does not disclose measurements, and the "months" phrasing is politically functional in a way that a benchmark would not be. It sets a horizon short enough to compel action and long enough to avoid immediate falsification. But the patch window is a different kind of statement. Directives cost the issuing agency something when they don't hold. Three days will be measured against real incident data within the year.

The market signal for the labs. The Guardian's reporting made the substrate visible: Anthropic's Project Fetch Phase 2 threat modelling was the analytical underlay for the timeline claim.² That is an unusual position for a private lab to occupy in a sovereign advisory. It validates the RSP (Responsible Scaling Policy, Anthropic's staged capability-and-safeguards framework) as a category of document that governments will cite, and it puts OpenAI's cyber-eval disclosures in the same reference class.

The implicit reference class is more interesting than the named one. Labs that have published structured cyber-capability evaluations are now inside the government-cited baseline. Labs that have not — Meta on the Llama side, DeepSeek, Qwen, and the long tail of open-weight releases — are outside it. That is not yet a procurement rule. But it is the shape of one. Enterprise buyers, federal procurement officers, and cyber insurers all take advisories like this as reference documents; the absence of a comparable eval framework becomes something a security review has to explain.

Whether this hardens into durable competitive advantage depends on how easily the frame is replicated. A published cyber-eval regime is not a moat; it is a document. Meta could ship one. So could the Chinese labs, though the political economy makes that harder. The interesting question is whether the Five Eyes advisory calcifies a specific methodology, Anthropic's, effectively, as the reference standard, or whether it triggers a proliferation of parallel frameworks that dilute the signal.

What the advisory does not cover. CISA's directive binds FCEB agencies. It does not bind state governments, hospitals, school districts, utilities, small businesses, or the majority of critical infrastructure operators, which are private. Those defenders face the same threat environment on longer patch cycles, with smaller security teams, and without the compliance infrastructure to move on a three-day window. The advisory is federal in scope and general in threat model, which is a structural mismatch. It is the GDPR pattern in reverse: the rule applies to a narrow perimeter, the threat it describes applies everywhere.

What to watch. Three signals would sharpen the map. First, whether other major cyber agencies, ENISA in the EU, JPCERT in Japan, adopt comparable patch cadences, which would generalise the CISA directive into an international baseline. Second, whether Meta, or any open-weight lab, publishes a cyber-eval framework designed to sit alongside the Anthropic and OpenAI disclosures. Third, whether cyber insurance underwriters begin pricing the presence or absence of a lab-published cyber-eval into policy terms for enterprises deploying those models. The insurance layer is where the safety-as-market-position frame either holds or dissolves.

The warning was the headline. The three-day window is the document.

Footnotes

¶