Bridging the Evidence Gap on AI Misuse in Cyberspace

A document published only a few weeks ago: no retrospective is possible, and it would be dishonest to fake one. This entry says three things.

The shift it makes. The debate on AI and cybersecurity has long focused on capability: what a frontier model is able to do, as measured in the lab. The white paper argues that the governance question is no longer that one, but rather one of observed use: how these models are actually being misused, by whom, and at what scale. This shift from the potential to the observed looks modest; it changes what would need to be measured, and therefore what would need to be built to measure it.

The finding that justifies it. No single organisation holds a complete view of AI-assisted cyber threats. Vendors see their own models misused, security providers see their clients attacked, investigative services see the cases that reach the courts: three partial angles that nothing aggregates. The white paper was produced with Microsoft, INTERPOL, the Google Threat Intelligence Group, Orange Cyberdefense, Wavestone, the Cloud Security Alliance, WithSecure, the Cyber Threat Alliance, the Frontier Model Forum, the GPAI Policy Lab, CeSIA, the Luxembourg House of Cybersecurity and the Oxford Martin AI Governance Initiative: the composition is itself the argument.

The test, and it has a date attached. INTAiC has announced the publication of a first AI-cyber threat index at the Paris Peace Forum on 10 and 11 November 2026. That is the test: if this index exists, if it aggregates data its members did not previously share, and if it is renewed the following year, the white paper will have served its purpose. If not, it will remain a shared observation without an instrument, the ordinary fate of this kind of text.

I am stating this criterion now, four months ahead of the deadline, precisely so that I cannot give myself the freedom to redefine it afterwards.