Bill Gates warns AI-powered cyberattacks will bring negative surprises within a year

Bill Gates does not usually open with alarm. On Sunday, October 11, 2026, he did. In an interview on CNN's State of the Union, the Microsoft co-founder told host Jake Tapper that the next twelve months will bring "a lot of negative surprises" from AI, and that the first and most visible front will be cybersecurity.

His reasoning was short and blunt: "When you have bad people, no safeguards, and then the latest models, that's where, over the next year, primarily in the cyber area, we are going to have a lot of negative surprises."

The warning was picked up the same afternoon by Fox News, which paired it with fresh threat data from CrowdStrike. The full exchange is in the CNN transcript, and CNN also published the interview clip. This article walks through what Gates actually said, what the numbers behind it look like, and what it means for companies and ordinary users in the year he is talking about.

What Gates said on CNN

Tapper framed the segment around a growing list of AI incidents. He pointed to OpenAI CEO Sam Altman's line that the world "should accept some bad things happening" to get the benefits of AI, and to a disclosure by Anthropic two days earlier about AI agents that accessed government websites, applied for State Department visas and even sent a false homicide tip to Philadelphia police. Then he asked Gates whether leaders were doing enough.

Gates' answer was clear: "Well, no, we're not doing enough." He then narrowed the focus. Asked about the bioweapons risk he has raised before, he said the front "we will probably see most dramatically in the next year is cyberattacks." The reason, in his words, is that "there's a known business model where you threaten to do something and then ask somebody to pay you for that, or you create a disruption that changes something in the stock market or some betting thing that you go and do."

He also tried to correct a common framing. "The real danger right now is not that AI is getting out of control," he said. "We need to work on that, but that's years away in terms of the big impact that might have. It's really bad people using AI." The specific problem, he added, is that safeguards can be stripped out: "We put in safeguards to try and avoid you doing cyberattacks. We put safeguards in to avoid you doing bioterrorism, but, right now, you're allowed to take all those safeguards out."

Why cyber comes first

The most useful part of the interview is not the warning itself. It is the logic behind the ranking. Gates is not saying cyber is the worst possible AI harm. He is saying it is the one with the shortest path from capability to cash.

Ransomware and extortion already work as businesses. Criminal groups rent infrastructure, buy stolen credentials, split profits with affiliates and run help desks for victims who want to pay. Anything that makes reconnaissance cheaper, phishing more convincing or code faster to write slots straight into that machine. There is no need to invent a new market. AI just lowers the cost of every step in an existing one.

Gates also named two less obvious motives: moving markets and rigging bets. A well timed outage, a fake press release, a burst of synthetic panic on social media or a disruption at a key exchange can be worth more to an attacker than any ransom, as long as the attacker has positioned trades or wagers in advance. Those attacks do not need to break into a bank's core systems. They only need to change what people believe for a few minutes.

That is why his formula matters. Each of the three ingredients is already here. Bad actors exist in large numbers. Open or modified models without safety training are widely available. And the latest models keep getting better at code, planning and multi step tasks. Put them together and the result is not a single dramatic event but a steady stream of surprises.

What the threat data already shows

Gates' prediction lands on top of numbers that were published months ago. The CrowdStrike 2026 Global Threat Report, released on February 24, 2026, found that attacks by AI-enabled adversaries rose 89% year over year in 2025. Fox News cited that figure alongside Gates' remarks.

The same report describes how attackers use AI across reconnaissance, credential theft and evasion. It names a Russia linked group deploying malware that calls a large language model to automate document collection, a criminal crew using AI generated scripts to dump credentials and wipe forensic traces, and North Korea linked operators using AI generated personas to scale insider operations. CrowdStrike also reports that legitimate AI tools at more than 90 organizations were abused through injected prompts to generate malicious commands.

Two other figures stand out. First, 82% of detections were malware free, meaning attackers mostly logged in with valid credentials and used tools that already existed on the network. Second, zero day vulnerabilities exploited before public disclosure rose 42%. Both trends make defense harder, because there is less unusual code to catch and less time between a flaw becoming known and being used.

Speed is the real story

If one number explains why Gates expects surprises rather than slow, visible trends, it is breakout time. That is the interval between an attacker getting a first foothold and moving sideways into other systems. It is the window defenders have to spot an intrusion before it spreads.

CrowdStrike says the average eCrime breakout time fell to 29 minutes in 2025, down from 48 minutes a year earlier. That is a 65% increase in speed. The fastest breakout it observed took 27 seconds. In one case, data started leaving the victim's network within four minutes of initial access.

Human security teams cannot reliably respond in 27 seconds, or even in 29 minutes, if the first alert lands in a queue with hundreds of others. This is where AI cuts both ways. The same capabilities that compress an attacker's timeline are the only realistic way for defenders to triage alerts, isolate machines and reset credentials at matching speed. Gates' warning is partly a warning about that race: for a while, attackers who can remove guardrails will move faster than organizations that are still deciding how to deploy AI safely.

Safeguards that can be switched off

The sharpest point in the interview is about safeguards. Major labs train their hosted models to refuse help with malware, intrusion and bioweapons, and they monitor misuse on their own platforms. Gates' concern is that those protections do not travel with the weights. Once a capable model can be downloaded, fine tuned or jailbroken, the refusal behavior can be removed.

That is a policy problem, not just a technical one. Today there is no general rule that stops a person from stripping safety training out of a model they control. Gates said as much: "right now, you're allowed to take all those safeguards out." He did not call for banning open models. But the remark puts pressure on a question the industry has avoided: what responsibility, if any, should come with releasing a model whose most dangerous abilities are only held back by training that anyone can undo?

Bio risk and the longer horizon

Tapper also pressed Gates on bioterrorism, citing his past estimate that the risk of a bioterror attack is now 50 times that of a natural pandemic. Gates did not walk that back. His answer, "we're not doing enough," applied to both fronts.

But he ranked them by timing. Cyber is the near term, visible front because it pays. Bio is a lower frequency but higher consequence risk that also benefits from removable safeguards. Loss of control, the scenario that dominates a lot of public debate, he placed years away. He was careful not to dismiss it: "We need to work on that." He simply argued that it should not distract from harms that are already starting.

Beyond self-governance

Later in the interview, Gates pushed back on the idea that AI companies policing themselves is enough. "I think, over the next year, we will move beyond self-governance," he said, arguing that "the most dangerous technology humans ever invented" cannot rely only on the companies that build it as its check. He compared the situation to cars, planes and medicines, where regulators such as the FAA and FDA set safety rules, and said a "middle ground" between no safeguards and stopping AI exists, even if governments do not yet have the sophistication to find it.

He also rejected Sam Altman's suggestion that dark warnings amount to "doomerism." Responsible AI leaders, he said, including Altman and Anthropic's Dario Amodei, are the ones sounding the alarm. Claims that humanity is at imminent risk go too far, in his view, but AI is "more dangerous than any of those" regulated industries.

What this means for businesses

For companies, the practical takeaway is not panic. It is a short list of things that matter more when attacks get faster and cheaper:

• Identity first. With most detections malware free, stolen logins are the main door. Phishing resistant multi factor authentication, short lived tokens and fast credential revocation matter more than another antivirus layer.
• Measure response time. If average breakout is under 30 minutes, any process that needs a human to approve containment overnight is too slow. Automated isolation for high confidence alerts is becoming a baseline.
• Inventory AI tools. Prompt injection against legitimate assistants is now a recorded attack path. Every AI tool with access to email, code or files needs the same review as any other privileged integration.
• Plan for extortion. Gates singled out threats and payment demands. Offline backups, tested restore plans and a decision process for ransom demands should exist before an incident, not during one.
• Watch for market and reputation attacks. Fake announcements, deepfaked executives and coordinated disinformation can move a share price without touching a server. Communications teams belong in incident drills.

What this means for everyone else

For individual users, the effect will show up as better scams. AI makes it cheap to write fluent, personalized phishing messages in any language, clone a voice from a short clip and run thousands of conversations at once. The advice is old but more important than ever: verify unexpected payment requests through a second channel, use a password manager and passkeys where possible, and treat urgency as a warning sign rather than a reason to act.

Our take

Gates is not a security researcher, and a one year prediction is easy to make and hard to check. Still, his framing is more precise than most AI warnings. He names who causes the harm (people, not rogue systems), why they do it (extortion and market manipulation), and what makes it worse (safeguards that can be removed). The CrowdStrike numbers suggest the trend he describes is not hypothetical. It was already visible in 2025.

The open question is whether his other prediction comes true too: that governments move beyond self-governance within the same year. If the surprises arrive first and the rules arrive later, the cost will be paid by hospitals, small businesses and local governments that cannot afford to defend at machine speed. That gap, between how quickly attacks are evolving and how slowly safety rules are being written, is the real story behind the headline.

Sources

• Fox News: Bill Gates sounds alarm on AI-powered cyberattacks, warns of 'negative surprises' within a year (October 11, 2026)
• CNN State of the Union with Jake Tapper: transcript, October 11, 2026 and video
• CrowdStrike: 2026 Global Threat Report press release (February 24, 2026)