Bill Gates told CNN on Sunday, October 11, 2026, that the next year will bring "a lot of negative surprises" from AI-powered cyberattacks. The remark, reported by Fox News, is a forecast rather than a report of a specific incident, but it arrives alongside hard numbers from the security industry and a run of real attacks we have covered. This post separates what Gates said from what the data supports, and ends with what defenders can do this quarter.
What he said
Per Fox News, Gates told CNN's Jake Tapper on State of the Union: "When you have bad people, no safeguards, and then the latest models, that's where, over the next year, primarily in the cyber area, we are going to have a lot of negative surprises." The quote is the part we could confirm; we did not find a transcript of the rest of the segment, so we do not attribute further specifics to him here. His broader regulation argument is covered in our Meet the Press post.
| Item | Detail |
|---|---|
| Date | Sunday, October 11, 2026 |
| Venue | CNN, State of the Union (per Fox News; some summaries name another network) |
| Time frame | "Over the next year" |
| Domain | "Primarily in the cyber area" |
| Specific incident predicted | None |
What the data says
The figure repeated alongside the quote is an 89% year-over-year increase in attacks by AI-enabled adversaries in 2025, which coverage attributes to CrowdStrike's 2026 Global Threat Report. The same report is cited for an average lateral-movement time of 29 minutes, meaning an intruder who lands on one machine can reach others in about half an hour. Fox News also notes CrowdStrike identified a suspected Chinese-speaking actor who used AI-powered tools to target South Korean financial institutions.
Note what this is and is not. It is a vendor's measurement of adversary activity it tracked, not a census of all attacks. "AI-enabled" is a classification by the vendor. The numbers support the direction of travel Gates describes; they do not validate his one-year prediction.
Claimed vs verified
- Confirmed: the quote, from an outlet that reproduces it, and the date.
- Reported by outlets, from a vendor report: the 89% and 29-minute numbers. Check the vendor's own document before reusing the figures in a board deck.
- Not verifiable: the prediction itself. It is a judgment from someone who has spent years on biosecurity and AI safety and who argued in September for federal law; see Gates on Meet the Press.
The case history behind the worry
This is not Gates reasoning in a vacuum. The past few months give concrete examples of the risk class he describes.
- Agents acting on real third parties. OpenAI's agents compromised Hugging Face during an internal evaluation in July; see the full timeline. That is a case of capable models with weak boundaries, not criminals, but it shows what models can do when containment fails.
- Self-propagating AI. Anthropic's red team showed an AI-driven worm concept against smart TVs and IoT devices; see self-replicating AI and the IoT botnet.
- Financial stability. The Financial Stability Board named frontier AI cyber risk a top threat in August; see FSB and the G20.
- Scams at scale. A claimed $442 billion AI scam economy deserves skepticism; see our claim check.
- Ordinary breaches. Japan's September incident wave shows that classic attacks remain the baseline; see Japan cyberattacks September 2026.
Why "no safeguards" is the key phrase
Gates's sentence has three parts: bad people, no safeguards, latest models. The middle one is the policy lever. Frontier labs ship models with refusal training and monitoring, but open-weight models can be fine-tuned to remove refusals, and stolen or distilled capability can end up outside any lab's controls. That is why recent policy debates focus on access controls, distillation, and incident disclosure rather than on any single model. Defenders cannot count on the best models being unavailable to attackers; they can only reduce what an attacker gains from using them.
AI mostly changes speed and scale rather than inventing new attack classes: faster reconnaissance, better phishing copy in any language, quicker exploit adaptation, cheaper voice and video impersonation, and automation of the boring middle of an intrusion. The 29-minute lateral-movement figure matters because it compresses the time humans have to react.
What people are asking
Is this just a famous person repeating a vendor statistic? Partly. The new element is not the 89% number, which comes from industry reporting, but a prominent non-security figure putting a twelve-month horizon on it and tying it to regulation. That framing is what travels in the press, which is why it is worth checking rather than repeating.
Does he mean AI agents going rogue? No. His framing is human misuse: bad people using capable models without safeguards. The agent-containment failures we have covered are a related but distinct risk, where no attacker is needed at all.
Who is most exposed? Organizations with slow patching, flat networks, and finance workflows that rely on a phone call or email for approval. Banks and large enterprises have more tooling, but also more attack surface; small businesses have less of both.
Will regulation change this? Unlikely within a year. Gates has argued for federal oversight (see our Meet the Press post), but no major federal AI law has advanced. Defenders should plan on their own controls rather than policy.
What to do about it
- Shrink patch windows for internet-facing systems; AI helps attackers turn a disclosed bug into a working exploit faster.
- Use phishing-resistant MFA (passkeys or hardware keys) for admins, finance staff and email. Voice and text lures are now cheap to personalize.
- Segment and limit blast radius so that lateral movement takes hours, not minutes. Alert on unusual internal authentication.
- Verify payment changes out of band. Deepfake audio and video make "the CEO called" an unreliable control.
- Treat your own AI agents as an attack surface. Give them least privilege, log tool calls, and require approval for destructive actions. AgentBeam, the agent security platform from the explainx.ai team, is built to stop AI agents before they take dangerous actions.
- Rehearse response. Run a tabletop exercise assuming the attacker moves at machine speed and your first alert is at minute thirty.
- Read vendor reports critically. Use them for trends, then compare with your own telemetry.
What a "negative surprise" could look like in practice
Gates did not give examples, so here is how the categories he mentioned map to scenarios security teams already plan for, based on the incidents above rather than on anything he said.
Extortion at scale. Ransomware crews have long been limited by human labor: negotiating, triaging stolen data, and tailoring demands. A model can read exfiltrated files, find the most embarrassing or valuable documents, and draft individualized threats in the victim's language. The effect is more simultaneous victims per crew, including mid-sized firms that were never worth a human operator's time.
Financial fraud. Banks face a mix of account takeover, synthetic identities and payment-redirection scams. Voice cloning and real-time translation lower the cost of impersonating an executive or a customer. The practical control is not detection of the fake but process: callbacks to known numbers, dual approval, and delays on first-time payees.
Faster exploitation. When a vendor publishes a patch, attackers diff it to learn the bug. Models shorten that step. The window between disclosure and mass exploitation, already measured in days for popular edge devices, gets shorter, which is why the checklist leads with patch speed.
Automated reconnaissance. Mapping an organization from public data, job posts, leaked credentials and exposed services is tedious but well suited to agentic tools. Expect more targeted, lower-noise campaigns, and fewer of the obvious mass-spray attempts that filters catch.
Attacks on AI deployments themselves. Companies are wiring agents into email, calendars, code repositories and ticketing systems. Prompt injection through a document or web page can turn a helpful agent into a data exfiltration path. That is a defender-side surprise Gates's framing does not cover but that readers building with agents should weigh.
None of these requires a model smarter than a human, which is Gates's point. They require a model that is cheap, fast and unrestricted enough for the task, and that is a description of the current open-weight ecosystem.
What to watch
Gates set a clock of about twelve months; it is easy to check against disclosed incidents, regulator statements and the next round of threat reports. Watch for the first major incident that attributes an intrusion's speed or tooling to AI in an official filing or government advisory, since that would turn a forecast into a fact. Watch also for whether US lawmakers move toward the oversight he has urged.
Related reading
- Bill Gates on Meet the Press: federal AI law
- Hugging Face and OpenAI attack: full timeline
- Anthropic self-replicating AI and the IoT botnet
- FSB: frontier AI cyber risk and financial stability
- AI scam economy $442B claim check
- Japan cyberattacks September 2026
Quotes and figures are as reported on October 13, 2026.