Generative Artificial Intelligence (GenAI) reached 53% population adoption within three years of mainstream release — faster than the personal computer or the internet, according to Stanford HAI's (Human-Centered Artificial Intelligence) 2026 AI Index. Organisational adoption hit 88%. The economic value of GenAI tools to U.S. consumers reached $172 billion annually, with median value per user tripling between 2025 and 2026. Coding benchmarks tell a similar acceleration story: AI performance on SWE-bench Verified (a standard test of software engineering ability on real GitHub issues) rose from 60% to near 100% in a single year.
Two numbers run against the optimistic narrative. First, the scores measuring how openly AI companies disclose their models' training data, capabilities, and risks — tracked by the Foundation Model Transparency Index (FMTI) — fell from 58 to 40, meaning the most powerful models are now substantially less auditable than last year's. Second, documented AI incidents rose from 233 in 2024 to 362 in 2025 — a 55% increase — driven by deepfake fraud, autonomous system failures, and data poisoning events.
Every major operating system (OS) and web browser reportedly contains exploitable vulnerabilities that a single AI model — Anthropic's Mythos Preview — was able to identify in what appears to be the most comprehensive AI-assisted security scan attempted to date. The scope is what separates this from prior AI security research: past tools found vulnerabilities in specific named targets; Mythos apparently surveyed the entire landscape simultaneously.
The findings prompted U.S. Treasury Secretary Bessent and Federal Reserve Chair Powell to convene an emergency meeting with Wall Street chief executives, and Anthropic committed $100 million in AI credits to help defenders patch critical systems before vulnerabilities could be widely exploited. Anthropic's response — restrict the large language model (LLM) to vetted defenders only, under Project Glasswing — reflects one answer to the dual-use problem: control who can access the capability. OpenAI has reached the opposite conclusion with GPT‑5.4‑Cyber, released under the Trusted Access for Cyber (TAC) program: verify the identity of who is asking, then release the capability under tiered access. Neither approach eliminates misuse risk; they differ in where they place the burden of control.