In just three months, AI-security has leaped from a niche concern to an industrial-scale risk, while Public-sector-productivity projections loom large but deserve skepticism. This piece revisits Google’s threat intelligence findings and the Ada Lovelace Institute’s cautions in 2026, translating the headlines into practical insight.
AI-security Realities in 2026
Criminal groups and state-linked actors are embracing commercial large language models—Gemini, Claude, and OpenAI tools—to refine and scale up attacks. The Google threat intelligence team notes that these models excel at coding and rapid experimentation, which makes them powerful for exploiting vulnerabilities across software stacks. The same report highlights zero-day vulnerabilities being discovered by AI-assisted exploration. Mythos, a model from Anthropic, reportedly claimed broad, dangerous capabilities and prompted industry-wide defensive action. Yet Mythos is not the only AI actor in play; some groups use LLMs not merely for inspiration but as a workbench, enabling testing of operations, persistence, and malware improvements.
OpenClaw, an AI tool that allowed users to delegate large tasks to an AI agent, shows how quickly the balance tilts toward automation in both offense and defense. Security researchers like Steven Murdoch note that AI can help defenders too, but the dual-use nature means the landscape will continue to evolve as attackers learn. The takeaway is not panic but pragmatism: AI-security is now an ongoing arms race where speed, scale, and rapid prototyping give notable advantages to disciplined adversaries.
In this context, the idea that AI vulnerability work will someday arrive is outdated. Threat actors are already leveraging LLMs to speed up operations and push toward mass exploitation if a single zero-day proves viable. The tone here remains steady: invest in resilient software, robust patching, and continuous monitoring that keeps pace with AI-enabled experimentation instead of waiting for a crisis to force action.
The Ada Lovelace Institute (ALI) cautions against assuming AI will deliver multibillion-pound Public-sector-productivity boosts for the public sector. Government estimates of annual gains — for example, £45bn — reflect broad expectations rather than proven outcomes. The ALI argues that most studies focus on time savings or cost reductions, not the end results people experience, such as better services or improved worker well-being. This gap matters because policy choices depend on the strength of the evidence behind the numbers, not on headline promises.
Additionally, ALI’s critique points to methodological limitations: projections may rest on untested assumptions, and real-world results can diverge across departments, tasks, and geographies. When leaders cite AI as a silver bullet, they should also acknowledge uncertainty and broaden sources of evidence. The report recommends reframing research to reflect uncertainty, measuring impact from the start, and pursuing long-term studies that cover years rather than weeks. In short, Public-sector-productivity benefits from AI require careful, transparent evaluation and a willingness to adapt as data accumulates.
The report’s recommendations include: encouraging future studies to reflect uncertainty over the impact of the technology; ensuring government departments measure the impact of AI programmes “from the start”; and supporting longer-term studies that measure productivity gains over years rather than weeks. In short, Public-sector-productivity benefits from AI require careful, transparent evaluation and a willingness to adapt as data accumulates.
AI-security and Public-sector-productivity in practice
What does this mean for organizations planning risk maps or budgets? For AI-security, shift from a purely reactive stance to a proactive approach: assume attackers use AI-assisted tooling, invest in secure development lifecycles, adopt supply-chain vetting, and deploy behavioral analytics to spot anomalies beyond signatures. For Public-sector-productivity, build pilots with clear outcome metrics, capture worker welfare and service outcomes, and ensure projected savings translate into tangible improvements for citizens. The synergy is simple: stronger security preserves data integrity to measure outcomes; better public services reduce incentives for attackers and bolster confidence in AI deployments.
Practically, institutions should adopt a balanced portfolio: invest in AI-driven security improvements while funding rigorous impact studies of AI programs. Focus on outcomes, not just savings. When procurement teams push for headline numbers, researchers should insist on robust, long-horizon studies with uncertainty and scenario analyses. Keep the conversation grounded in evidence, while leaving room for experimentation as technology evolves.
Finally, this piece invites readers to engage with both the risks and the potential. If AI-enabled hacking continues to mature, defenders must keep pace. If AI can deliver measurable improvements in public services, governance and evaluation frameworks must be ready to capture those gains accurately. Share your thoughts in the comments to help shape the roadmap for AI-security and Public-sector-productivity in 2026.
Original article attribution: Original Google Threat Intelligence report. Thank you to Google for the original source material.