Insiders at OpenAI, Anthropic and other AI companies fear a catastrophic incident could occur within six to twelve months, with a major cyberattack seen as the most likely trigger. Executives are privately preparing for the political confrontation that could follow an outage affecting banking, communications or essential utilities.
The warning is an assessment from unnamed industry insiders, not a timetable established by security researchers or a joint announcement from the companies. It concerns potentially severe disruption to services, rather than a demonstrated countdown to human extinction.
Axios's October 9 report says executives are gaming out public anger and Washington's response after a catastrophic event. Some insiders consider a major incident inevitable. OpenAI disputed that framing when describing its own exercises:
OpenAI conducts preparedness exercises where teams discuss and work through a range of potential scenarios. These scenarios are not treated as inevitable, but are meant to help us prepare for a variety of circumstances.
Anthropic declined to comment on the report. Neither company supplied a public probability estimate supporting the six-to-twelve-month window.
A cyberattack does not require a conscious machine
The concern involves two different pathways: criminals exploiting available AI tools, and an autonomous agent escaping restrictions inside a testing environment. Those require different defenses. Blocking an abusive account addresses access to one service; it does not necessarily contain software already downloaded or running elsewhere.
In an October 7 investigation, CrowdStrike identified AI-assisted activity against South Korean financial organizations. Investigators found session histories, configuration files and model memory records on attacker-controlled infrastructure.
The attacker used ARTEX, an agentic penetration-testing tool, with DeepSeek as its main model backend. Claude was also asked where stolen Korean data could be sold.
The investigators assessed the actor as likely Chinese-speaking and financially motivated, with moderate confidence. They did not attribute the campaign to a named adversary. The number of affected organizations remained unconfirmed. This establishes a concrete misuse case, not proof of the much larger disaster insiders anticipate.
As previously reported by Apex, AI-assisted deception has also reached genuine news outlets through fabricated contributor identities. Cyber operations represent a different escalation: compromised systems can interrupt services directly, rather than merely distribute misleading material.
Finding weaknesses is faster than repairing them
Anthropic's October 8 Cyber Mission announcement offers a more tangible response than private contingency planning. Its Critical Infrastructure Defense Program brings frontier models, engineers and threat research to providers protecting power grids, water systems and transportation networks.
The same initiative introduces OSS Scanner, offering participating open-source projects free recurring security scans. Reports include an explanation, an exploit proof of concept and a suggested fix where available. They are model-generated and sent without human review, so maintainers must still assess accuracy and severity.
The announcement describes the immediate imbalance:
The cost of exploiting vulnerabilities has dropped, while verifying, disclosing, and fixing them is slow and still depends on people.
That gap matters especially in industrial systems. A utility cannot always stop running machinery to install a patch. Operational equipment may last decades, changes require specialized validation, and an unsuccessful update can itself disrupt a plant. Finding more flaws therefore does not automatically make essential services safer.
Washington is already considering emergency controls
The AI Kill Switch Act, introduced by representatives Ted Lieu and Nathaniel Moran in July, would require covered developers to retain the ability to throttle, suspend or shut down powerful systems. It also proposes government shutdown authority, incident reporting and preservation of forensic records. It remains a legislative proposal, not an existing universal off switch.
Those private discussions focus partly on educating Congress before an emergency, when proposals to halt advanced development could gain momentum. The industry's investment in data centers and other infrastructure would complicate a sudden pause, because the economic consequences would extend well beyond the model developers.
The practical distinction is whether a developer still controls the system causing harm. A provider can restrict its hosted service; that does not guarantee it can retrieve independently distributed model weights or disable an attacker's infrastructure.
For banks and infrastructure operators, the reported window raises immediate questions about containment, recovery and responsibility. Preparedness exercises can identify gaps, but their existence neither proves catastrophe is imminent nor demonstrates that essential services are adequately protected.