Estimated reading time: 5 minutes · Last updated:
A 103-page report from the House Committee on Homeland Security, chaired by Rep. Andrew Garbarino (R-Bayport), warns that advances in artificial intelligence create new national security risks for the United States. The document says AI can assist defenders but also let malicious actors scale reconnaissance, social manipulation and software exploitation. The report frames those dangers against 25 years of change since Sept. 11, 2001, and stresses the need for sustained vigilance as models grow more capable of multistep or partly autonomous operations.
This no-fail mission requires persistent vigilance and adaptation to keep pace with the contemporary threat environment.
Rep. Andrew Garbarino
Key takeaways
- Report length and author: The Committee on Homeland Security produced a 103-page report chaired by Rep. Andrew Garbarino (R-Bayport).
- Core warning about AI: The committee warns AI can improve reconnaissance, facilitate social engineering, accelerate vulnerability research, and generate or modify malicious code.
- Lone-actor risk: The report highlights rising concern about lone-actor plots and says AI lowers the skill and resource threshold for complex attacks.
- CISA staffing concern: Rep. Bennie Thompson notes the Trump Administration’s fiscal 2027 budget plan proposes removing 900 positions from the Cybersecurity and Infrastructure Security Agency (CISA).
Table of contents
- Key takeaways
- What Garbarino’s committee identifies as the AI threat
- Why lone actors and automation matter in the report
- Defensive uses and the policy gap the committee flags
- How the report reframes homeland security priorities
- Case for and against stronger action
- What to be careful about
- Frequently asked questions
What Garbarino’s committee identifies as the AI threat
The Committee on Homeland Security frames artificial intelligence as a dual-use technology: it strengthens defenders while offering new tools to adversaries. The report lists concrete ways models can be misused, including speeding up discovery of software flaws, producing or adapting malicious code, automating reconnaissance tasks and enabling more persuasive social-engineering campaigns. Those capabilities, the committee says, allow operations to run with greater speed and at larger scale than before.
The document situates those risks against a longer arc of change: it notes how actors and technologies have evolved in the 25 years since Sept. 11, 2001, and argues that each advance in capability shifts how security agencies must prioritise and respond. The committee therefore treats AI as an amplifier of established cyber and physical vulnerabilities rather than a wholly new category of threat.
Why lone actors and automation matter in the report
A pronounced focus of the report is the growing risk from lone-actor or 'lone-wolf' plots. The committee says such individuals, acting without direction from an organised group, now face fewer technical and logistical barriers because AI can automate complex steps that once required teams or specialised skills. That shift prompts a change from organization-centric counterterrorism to approaches that emphasise behaviour-centric prevention.
The report also warns that as advanced models execute multistep tasks with less human direction, the line between a tool that assists a human and a system that performs much of an operation autonomously will blur. That narrowing, the committee argues, raises both detection and attribution challenges for U.S. security agencies.
Defensive uses and the policy gap the committee flags
The report does not treat AI as only a danger. It recognises the technology's value for defenders: analysing large datasets, prioritising vulnerabilities and automating routine tasks so staff can focus on complex incidents. Still, the committee stresses that defensive gains do not remove the need for staffing, funding and organisational capacity to act on AI-driven findings.
Political context appears in the committee’s assessment and in responses: Rep. Bennie Thompson of Mississippi, the committee’s top Democrat, criticized proposed reductions in staff and program budgets at the Cybersecurity and Infrastructure Security Agency and cited the Trump Administration’s fiscal 2027 proposal to eliminate 900 positions. Thompson warned those cuts risk creating gaps at a time when adversaries are using evolving tools.
How the report reframes homeland security priorities
Across its 103 pages, the committee urges persistent vigilance and adaptation. The preface, attributed to Rep. Garbarino, frames homeland security as a 'no-fail mission' that must keep pace with a shifting threat environment. That language underlines the report’s judgement that capability improvements alone — in either offence or defence — are insufficient without sustained organisational readiness.
Practically, the committee’s analysis points to three priorities: improve detection and attribution of AI-enabled activity, invest in personnel and tools that can act on AI-driven insights, and adjust prevention strategies to account for individual actors empowered by automation. The report stops short of laying out a single legislative package in the text excerpted by this coverage, instead presenting a problem set for policymakers to address.
Case for and against stronger action
The case for
- Improved detection and automated analysis can multiply defensive capacity if paired with personnel who act on findings.
- Naming the risks in a 103-page committee report creates a policy docket that lawmakers can follow with targeted legislation and funding requests.
The case against
- Proposed cuts to CISA staffing could reduce the agency’s ability to investigate and respond to AI-enabled incidents, weakening resilience.
- If AI tools continue to lower technical barriers, prevention and attribution may lag capability, producing persistent operational gaps.
What to be careful about
- AI-enabled reconnaissance makes it faster to map targets across communications, transport and critical infrastructure.
- Automated generation or adaptation of malicious code accelerates vulnerability exploitation and shortens defenders’ response windows.
- AI-assisted social engineering can increase the scale and credibility of scams and influence operations, complicating detection.
- Staffing reductions at CISA could limit the federal response capacity the committee deems necessary to act on new AI-driven threats.
The bottom line
The committee’s 103-page assessment treats AI as both a defensive tool and a multiplier for adversaries. It emphasizes lone-actor risks, automated multistep operations and the potential erosion of federal capacity, and lays out a practical agenda: bolster detection and attribution, adequately fund agencies that act on AI-driven insights, and adapt prevention strategies for actors empowered by automation. Absent those steps, the committee says the United States risks facing faster, cheaper and harder-to-attribute attacks.
What to watch
- Watch for any legislative proposals the House Homeland Security Committee may introduce in response to the report; no date has been set.
- Watch for congressional appropriations or CISA briefings that address the proposed removal of 900 CISA positions; no date has been set.
- Watch for publication of the committee’s full report text and any annexes or technical appendices; no date has been set.
Frequently asked questions
Who produced the report and how long is it?
The report was produced by the House Committee on Homeland Security, chaired by Rep. Andrew Garbarino (R-Bayport), and runs 103 pages.
What AI-enabled threats does the committee identify?
The committee identifies several misuse cases: improving reconnaissance, facilitating social engineering, accelerating vulnerability research and generating or modifying malicious code.
What political concerns did Democrats raise in response?
Rep. Bennie Thompson of Mississippi criticised personnel and program cuts at CISA and cited the Trump Administration’s fiscal 2027 proposal to remove 900 positions, saying those cuts create security gaps.
Related reading
