US CISA weighs AI cyber fix

The United States — Cybersecurity and Infrastructure Security Agency (CISA) is considering a significant reduction in the deadline for government agencies to fix critical IT system vulnerabilities, from two weeks to three days. This proposal is driven by growing concerns that advanced artificial intelligence tools, such as Anthropic's Mythos and OpenAI's GPT-5.4-Cyber, can enable hackers to identify and exploit software flaws much faster, sometimes within hours. Nick Andersen, acting chief of CISA, and Sean Cairncross, the U.S. national cyber director, are discussing these changes. While experts like Stéphen Boyer of BitSight support the need for faster action, others like Kecia Hoyt of Flashpoint and John Hammond of Huntress (company) raise concerns about the feasibility and strain on resources, particularly for CISA, which has faced budget cuts. The banking industry is also scrambling to understand and respond to the dangers posed by these new AI technologies, and CISA's new deadlines could serve as a model for state, local governments, and businesses.