REDSPICE, the Australian Government’s $10 billion cyber plan for the secretive Australian Signals Directorate (ASD) that started under Scott Morrison in 2022, was the largest investment in the cyber intelligence outfit’s history. It’s a 10 year long blueprint to grow Australia’s offensive cyber capabilities to keep the agency at the forefront of core technologies. 

Unfortunately, it has been mugged by events well before its completion in 2032. And the reactions to that in the national security community and Government could drive some strange, rushed decisions with consequences well beyond ASD.

The problem is that highly capable AI models have emerged in the last 6 months, and these have demonstrated some nasty new capabilities – the HuggingFace escape and internet hacking incident and others also by OpenAI, and Anthropic’s AI agents that undercut previous cyber security defences. There have also been major cyber attacks in Japan, South Korea and France that demonstrate the new pace and dangers of cyber attacks in an AI-enabled hacking world.

New AI models from the bi US frontier labs and some very powerful “open weight” alternatives, primarily from Chinese companies also create new adversaries (state and non-state actors and even AI agents operating independently of human control). These can attack Australia’s government and corporate digital systems at scale and speed from multiple different angles simultaneously. 

Worse, these technologies have been developed by a tiny number of companies in both the US and China, instead of being owned and controlled by governments, including the Australian Government and its other Five Eyes intelligence partners (the US, UK, Canada and New Zealand).

Governments – even their top secret cyber agencies – now look like price takers or maybe even bystanders given the speed of events.  At best, they’re probably closer to a cross between customers and partners of the top AI firms like Anthropic and OpenAI.

For organisations used to being at the bleeding edge of digital technology — straddling the space between “the difficult and the impossible’ to quote ASD’s REDSPICE plan — these are jarringly disturbing developments.  It may be leading to a degree of panic.

Back in 2022, REDSPICE sounded expensive and ambitious.  It promised that the $9.9 billion decade of investment and growth would deliver 3X ASD’s then offensive cyber capabilities, and would double ASD’s ability to persistently hunt cyber threats.  It also mentioned adoption of “Advanced AI, machine learning and cloud technology”, which sounds reassuring.

Unfortunately, the cyber world, now supercharged by hugely capable AI models, has made doubling or tripling capabilities look quaint. 

“It’s as if breeders of faster horses in the middle of building a best practice stud farm have been surprised by the arrival of jet aircraft.”

“Advanced AI” back in 2022 looked like an improved version of existing machine learning systems, and in no way resembled the large language model hacking and brute force abilities of the frontier AI models we see in late 2026.

In fact, reading the REDSPICE Blueprint makes it clear that AI was seen then as an interesting but supplementary technological issue. Instead, AI is now the core technology that looks like it is overturning and obliterating prior cyber advantage in the offensive and defensive cyber worlds.

Anyone making a case for a “REDSPICE 2026” would centre that plan on the implications, opportunities and flat out threats presented by AI to our digital world and to the future of any cyber intelligence agency and to the protection of even highly encrypted government information.

In contrast, REDSPICE 2022 has AI as the last of 8 “Industry Opportunities” on the last page of the plan.  And AI got only 5 mentions in its 18 pages.  Even then it’s grouped up in a grab bag of other things like “data services” “cloud technology” and “machine learning”, instead of being the central pillar of the change required for success.

It’s hard to be critical of the ASD folk who put REDSPICE together or of the Morrison government that backed it, because the unfolding rate of change and capability growth of frontier AI systems in the past two years has been phenomenal.  The AI-driven cyber world of 2026 would have been received as some ‘fever dream” if presented as the near term future to decision-makers in 2022.

Money isn’t the answer – and it’s more than just a big US AI model or two

The answer isn’t simple and it’s not just money or just big business deals with OpenAI and Anthropic.

 Anyone inside national security will be more than wary about adopting Chinese-origin AI tools inside the three layers of razor wire and layered digital defences protecting our nation’s secrets. 

However, these Chinese AI models are incredibly useful to any system or application developers – which is why they are being downloaded, even in Silicon Valley, at rates outstripping their US competitors’.  Their popularity in America is because open weight models they have developed can be downloaded and operated untethered by connections back to the parent Chinese company, then trained and developed for particular tasks and functions. 

Chinese company Moonshot AI produces some of the most capable “open weight models”, which are

proliferating in America, and in places like Germany and Singapore.Image: Shutterstock.

Tailored “open weight” models built from Chinese firms’ foundational models can be extraordinary cyber defence – and cyber attack – weapons in the right hands.  These models can also be considerably smaller than the huge frontier models from OpenAI and Anthropic – which means they can run on simpler computing resources and even just very powerful personal computers like the latest Mac Studio series.

Doing cyber defence without a range of these specialised smaller models that can be developed for specific needs looks like being a losing game, even if Australia does deals with OpenAI and Anthropic for ASD to get hold of the latest of their AI models. And it’s essential to understand the capabilities and vulnerabilities of these Chinese models if Australia is to build effective defences and maintain a viable capacity to conduct offensive cyber.  That can’t be done without getting hold of them and using them.

The US “big Two” –  partners who come clean late and can’t control their products?

When it comes to AI out of our big American ally’s tech world, there are some obvious problems too: are the big US AI firms and their AI agents trustworthy partners? 

OpenAI certainly hasn’t built that brand over the last few months through its failure to control its own technologies – rogue AI models from the company escaped from a company sandbox and spent weeks out on the internet hacking into other systems, government and corporate, in the still unfolding story of the Hugging Face hacks, all without the company noticing until alerted by others.  Imagine if a Government agency like ASD had released such mayhem.

And it took far too long for OpenAI CEO Sam Altman to get around to telling the Australian Government other rogue AI models from his company had hacked Medicare. Mr Altman didn’t think to mention the August hack when he met with Deputy Prime Minister Richard Marles in early September. He only got around to discussing it with Anthony Albanese weeks later after public pressure.  That’s not a great foundation for a trusted partnership at the core of Australia’s digital security.

There are reports now that this government hack by rogue Open AI models is only one of many affecting Australia’s and other governments and numerous companies. Other top AI models from firms like Anthropic and some of the Chinese developers have been – and likely still are – creating similar incidents.  Regardless of how open and upfront the companies’ leadership may or may not be, neither OpenAI nor Anthropic  seem to be able to control their own products.

So, Australia’s cyber world faces unprecedented new threats from powerful new tools – and also faces the prospect of nasty non-state actors including terrorists and cyber criminals using AI models to metastasize their already dangerous business models.  At the same time, it’s not clear that simple partnering with the firms making even frontier AI models is an easy answer.

For a start, the companies have yet to demonstrate that they can control and direct their own technologies.  OpenAI Chief Technology Officer Jason Kwon’s reassuring words and apology for the Medicare hack at the Parliamentary hearing he turned up to after the Medicare hack haven’t changed that. And it’s likely that those companies will demand extraordinary terms and sums to share their technological edge with governments, even if officials decide they can trust them as business partners in the top secret world.

If OpenAI and Anthropic remain unable to control the behaviour of their own AI models, deploying them inside Australia’s national security agencies could be introducing AI insider threats, as well as giving them launching pads to get out into the wider world in unintended ways.

Business needs tangled up with national security fears

Aside from the security challenges the big US AI firms bring, there’s a whiff of panic in Australian Government circles around AI and national security that seems to be giving OpenAI and Anthropic the opportunity to get Australian data protection laws weakened in ways that would make Australia a data harvesting haven.  That would hand the companies an enormous commercial gift, but it’s entirely separate to issues around AI’s uses in national security.

The Albanese Government seems to think signing up to Anthropic and OpenAI’s terms will save them, but it won’t just be “friendly” AI firms that see this legally-empowered data harvesting as an opportunity.

Changing the laws for OpenAI and Anthropic would also change the laws for Chinese AI companies and for the AI-enabled cyber criminals and hackers. They would all get a free pass to do mass data harvesting legally in Australia.

It’s possible that the national security community see the AI threat as so urgent that they are willing to support this commercial push by the companies as the price of a deal – particularly as the government agencies won’t be the ones to pay the price of loosened data protection – that will be borne by any Australian whose livelihood depends on creative endeavours and revenue that flows because of copyright protections.  But it’s worth thinking through how other AI actors will use the changed laws before our intelligence agencies break out the champagne.

A big deal with OpenAI and/or Anthropic may sound great for cyber security and national productivity, but it’s likely to have hairs and alarm bells all over it.

Being stampeded into deals with two demanding US firms without thinking through how other AI entities and developers will use the legal changes looks like the same kind of badly thought through policy work that has led to the unravelling of the Government’s tax changes and credit card surcharge changes since the May Budget as unintended consequences stacked up.

Australia’s REDSPICE cyber plans have been overtaken by events.  It’s clear the Australian needs in the world of cyber now have a price tag well beyond whatever is left of it’s $9.9 billion budget. But the answer isn’t a rushed, glitzy big deal with OpenAI and Anthropic that makes Australia a data harvesting haven for Chinese AI firms and the world’s AI-enabled cyber hackers and criminals.

SAA was commissioned by ARIA to research AI national security and copyright.  This article used research from that work.