Cyberattacks, weapon development or use, and mass harm

50 of the world's largest companies we reviewed acknowledge the AI risk "Weapons & cyberattacks", including Meta, Alphabet (Google) and Microsoft.

Which companies acknowledge this risk?

• Meta: “Identifying catastrophic outcomes to prevent: Our framework identifies potential catastrophic outcomes related to cyber, chemical and biological risks that we strive to prevent.” (Our Approach to Frontier AI)
• Alphabet (Google): “Biosecurity: Risks of models assisting in the development, preparation and/or execution of a biological attack... An LLM that helps overcome these knowledge gaps... could significantly increase society's vulnerability to fatal attacks by malicious amateurs.” (Google Frontier Safety Framework (May 2024))
• Microsoft: “tracked high-risk capabilities," which include: Chemical, biological, radiological, and nuclear (CBRN) weapons. A model's ability to provide significant capability uplift to an actor seeking to develop and deploy a chemical, biological, radiological, or nuclear weapon.” (Microsoft: G7 Hiroshima AI Process (HAIP) Transparency Report)
• Amazon: “risks that would arise from the use of a model by malicious actors to compromise digital systems with the intent to cause harm... enable a moderately skilled actor... to discover new, high-value vulnerabilities and automate the development and exploitation of such vulnerabilities.” (Amazon's Frontier Model Safety Framework)
• IBM: “help in the planning and execution of a biological attack. Several test scenarios are mentioned such as using LLMs to identify biological agents and their relative chances of harm to human life.” (Foundation models: Opportunities, risks and mitigations)
• Mastercard: “Using AI, for example, a single scammer could deploy an army of bots to test defenses and search for weak points... and build malware that can adapt to a company's security systems.” (Securing Tomorrow: Preparing for an always-on, AI-powered future)
• SAP: “Intelligence gathering also extends to software by discovering new security flaws in code repositories. Increase in attack sophistication GenAI may enable adversaries to create personalized attacks at far less cost in time and effort.” (SAP Generative AI Cybersecurity Strategy)
• AMD: “As AI capabilities improve and are increasingly adopted, we may see more sophisticated threats created through the use of AI technology to launch more automated, targeted and coordinated cyberattacks. These attacks could be crafted with an AI tool to directly attack IT Systems with increased speed and/or efficiency than a human threat actor” (AMD 10-K Annual Report (FY2024))
• Goldman Sachs: “the use of AI by cybercriminals may increase the frequency and severity of cybersecurity attacks against us or our third-party vendors and clients.” (Goldman Sachs 2024 Form 10-K)
• Salesforce: “as AI technologies, including generative AI models, develop rapidly, threat actors are using these technologies to create new sophisticated attack methods that are increasingly automated, targeted and coordinated and more difficult to defend against.” (2025 Annual Report)
• Commonwealth Bank of Australia: “The Bank anticipates cyber attacks to persist and grow as adversaries use new technologies such as GenAI to exploit vulnerabilities, including third parties and cloud environments. These could lead to compromised customer data, critical systems disruptions and potential breaches of our obligations.” (2025 Annual Report - CommBank)
• American Express: “increasingly utilize advanced capabilities, including the integration of advanced forms of artificial intelligence ... which can increase the efficacy, severity, frequency and ease of execution of cyberattacks” (American Express 2024 Annual Report)
• Bank of America: “we expect to continue to experience cybersecurity incidents resulting in adverse impacts with increased frequency and severity due to the evolving threat environment including the increasing use of AI, such as generative AI and machine learning, for cybersecurity threat and cyberattack purposes” (2024 10-K - Bank of America Corporation)
• Cisco: “the emergence and maturation of AI capabilities has led to new and/or more effective methods of cyber attacks.” (Cisco 10-K 2025 Annual Report)
• Fortinet: “AI can be exploited by hackers and malicious actors to develop advanced cyberattacks, bypass security measures, and exploit system vulnerabilities.” (Fortinet 2024 Annual Report)
• Intel: “threat actors are leveraging emerging AI technologies to develop new hacking tools and attack vectors, exploit vulnerabilities, obscure their activities and increase the difficulty of threat attribution.” (Intel Annual Report 2024 - 10K)
• Intuit: “as technologies like AI develop rapidly, malicious third parties are using these technologies to create new sophisticated attack methods that are increasingly automated, targeted and coordinated and more difficult to defend against” (Intuit 2025 Annual Report)
• Palantir: “In addition, enhanced risk of cyberattacks could be a result of us or a third party incorporating the output of an AI tool, such as malicious code from an AI generated source code.” (2024 10-K Palantir)
• PNC Financial Services: “efforts by bad actors to engage in various types of cyber attacks and breaches... pose serious risks to our business and reputation... The effectiveness of these efforts may be enhanced using AI.” (PNC Financial Services 2025 Annual Report)
• Viking Holdings: “We expect that the sophistication of cyber-threats will continue to evolve as threat actors increase their use of AI and machine-learning technologies.” (Viking Holdings - 20-F Annual Report 2024)
• ABB: “Potential cyber incidents involving ABB or third parties due to global increase in sophisticated cyber attacks, AI-powered threats” (ABB Integrated Report 2024)
• Amgen: “attacks are growing in frequency, sophistication, and intensity... using techniques and tools-including artificial intelligence-that circumvent security controls, evade detection and remove forensic evidence.” (Amgen 2024 Annual Report Letter and 10-K)
• AppLovin: “Our use of AI technologies... may create additional cybersecurity risks or increase cybersecurity risks, including risks of security breaches and incidents... Further, AI technologies may be used in connection with certain cybersecurity attacks, resulting in heightened risks of security breaches and incidents.” (AppLovin Corporation 10K - FY24)
• ASML: “As technology like AI and quantum computing continues to evolve, these technologies could also be used for sophisticated cyber attempts or bypassing security measures.” (ASML - 2024 20-K Annual Report)
• AT&T: “the use of artificial intelligence and machine learning by cybercriminals may increase the frequency and severity of cybersecurity attacks against us or our suppliers, vendors and other service providers.” (AT&T INC. Form 10-K 2024 Annual Report)
• Ferrovial: “cyber threats are expected to accelerate globally in frequency and magnitude, with threat actors using sophisticated techniques, including artificial intelligence, to circumvent security controls, evade detection and remove forensic evidence.” (Ferrovial - 2024 Form 20-F Annual Report)
• FICO: “increased attention on and use of AI increases the risk of cyber-attacks and data breaches, which can occur more quickly and evolve more rapidly when AI is used.” (FICO 2025 Annual Report/Filing 10-K)
• GE Aerospace: “we expect cyberattacks will continue to accelerate ... as threat actors increasingly use artificial intelligence and other techniques to circumvent security controls, evade detection and remove forensic evidence.” (General Electric Form 10-K 2025 Annual Report)
• Glencore: “Given the accelerating pace at which AI is being used to create malware and deepfakes, there is a significant and growing threat to the security and authenticity of digital content” (2024 Annual Report - Glencore)
• HDFC Bank: “The landscape of cyber threats has undergone rapid and complex changes fueled by targeted attacks, the proliferation of Ransomware-as-a-Service ("RaaS") incidents, the utilization of AI and machine learning to orchestrate sophisticated attacks” (HDFC - Form 20-F 2025 Annual Report)
• Hilton Worldwide: “may continue to do so at an accelerating pace as criminals leverage generative artificial intelligence-based technologies and services. Breaches, thefts, losses or fraudulent uses of customer, employee or company data” (Hilton 2024 10-K Annual Report)
• HSBC: “One key area of focus is the increasing use of AI, which could be used to facilitate sophisticated cyber-attacks.” (HSBC 2024 Annual Report)
• Lam Research: “to the extent AI capabilities improve and are increasingly adopted, they may be used to identify vulnerabilities and to implement increasingly sophisticated cybersecurity attacks.” (Lam Research - 2024 Annual Report)
• Micron Technology: “The emergence and maturation of AI capabilities may also lead to new and/or more sophisticated methods of attack.” (Micron Form 10-K 2024)
• Nomura Research Institute: “conflicts ... have highlighted the use of AI technologies in international disputes and warfare-through cyberattacks ... and drone operations.” (NRI - ESG Databook 2025)
• NVIDIA: “Additionally, some actors are using AI technology to launch more automated, targeted and coordinated attacks.” (NVIDIA 2025 Annual Report and 10-K)
• Pepsico: “the rapid evolution and increased adoption of artificial intelligence technologies may increase our cybersecurity risks, including generative artificial intelligence augmenting threat actors' technological sophistication to enhance existing or create new malware.” (Pepsico 2025 10-K Annual Report)
• PPG Industries: “The techniques, tools and tactics used in cyber-attacks evolve rapidly, including from emerging technologies such as advanced automation or artificial intelligence and may be difficult to detect for periods of time.” (PPG Annual Report 2024)
• PSEG: “new types of cyberattacks... may be generated or enhanced through the use of Artificial Intelligence (AI) and/or cloud-based infrastructure.” (PSEG Annual Report 2024)
• QUALCOMM: “as AI continues to evolve, cyber-attackers could also use AI to develop malicious code” (Qualcomm 2025 Annual Report)
• ResMed: “Such cyberattacks increasingly exploit AI and machine-learning techniques-... to automated vulnerability discovery, adaptive malware and large-scale credential-stuffing campaigns” (ResMed 2025 Annual Report (10-K))
• ServiceNow: “as AI technologies continue to advance, threat actors can leverage these technologies to develop more sophisticated attack methods that are increasingly automated, targeted, coordinated and more difficult to defend against. The proliferation of these technologies could enable less skilled threat actors to initiate attacks and increase the frequency, scale and impact of security incidents.” (ServiceNow 2025 Form 10-K Annual Report)
• Shopify: “computer malware, viruses... scraping and general hacking continue to be prevalent in our industry and could be enhanced or facilitated by artificial intelligence” (Shopify Inc. Annual Report on Form 10-K (Fiscal Year 2025))
• Siemens: “Emerging and disruptive technologies like AI are crucial for innovation at Siemens... However, these technologies can also be exploited by cyber attackers for malicious purposes.” (Sustainability Report 2024)
• T-Mobile US: “We also expect that threat actors will continue to gain sophistication including in the use of tools and techniques (such as AI) that are specifically designed to circumvent security controls, evade detection, and obfuscate forensic evidence, making it more challenging for us to identify, investigate and recover from future cyberattacks in a timely and effective manner.” (T-Mobile Form 20-F 2024 Annual Report)
• T. Rowe Price: “we are exposed to risks arising from the use of AI technologies by bad actors... to facilitate cyberattacks. Generative AI, if used to perpetrate fraud or launch cyberattacks, could result in losses” (T. Rowe Price Group 2025 Annual Report (10-K, FY2025))
• TSMC: “as AI continues to evolve, cyber-attackers could also use AI to develop malicious codes” (TSMC Form 20-F 2024 Annual Report)
• UnitedHealth: “the techniques used to obtain unauthorized access, disable or degrade service, or sabotage systems change frequently and are increasing in sophistication, in part due to use of evolving AI/ML technologies (including generative AI), and ... we may be unable to anticipate these techniques and threats” (UnitedHealth Annual Report 2024 Form-10-K)
• Visa: “use of AI technologies by bad actors… [and] rapid integration of new technology such as GenAI are being used by threat actors to create sophisticated attacks that are increasingly automated, targeted and more difficult to defend against.” (Visa 2025 Annual report)
• Wells Fargo: “information security threats arising from the increased availability and use of AI to conduct attacks that can be difficult to detect” (Wells Fargo 2025 Annual Report)