June and September polls from Epoch AI/Ipsos show no detectable increase in the share of US adults experiencing cyber incidents. In September, about 45% reported at least one incident in the past 12 months, such as an account break-in or a data leak, compared to 46% in June.
| Survey wave | Field dates | Incident in past 12 months | Share of US adults (%) | 90% CI lower bound (%) | 90% CI upper bound (%) | Respondents (unweighted) |
|---|---|---|---|---|---|---|
| June 2026 | June 12-14, 2026 | 32.2 | 29.8 | 34.7 | 1,021 | |
| June 2026 | June 12-14, 2026 | 19.8 | 17.8 | 22.0 | 1,021 | |
| June 2026 | June 12-14, 2026 | 7.8 | 6.5 | 9.3 | 1,021 | |
| June 2026 | June 12-14, 2026 | 7.9 | 6.6 | 9.4 | 1,021 | |
| June 2026 | June 12-14, 2026 | 5.7 | 4.6 | 7.1 | 1,021 | |
| June 2026 | June 12-14, 2026 | 2.1 | 1.5 | 3.0 | 1,021 | |
| June 2026 | June 12-14, 2026 | Any of these incidents | 46.2 | 43.6 | 48.8 | 1,021 |
| June 2026 | June 12-14, 2026 | None of these | 45.3 | 42.7 | 47.9 | 1,021 |
| June 2026 | June 12-14, 2026 | Not sure | 7.5 | 6.2 | 9.0 | 1,021 |
| September 2026 | September 18-20, 2026 | 32.1 | 29.7 | 34.6 | 1,024 | |
| September 2026 | September 18-20, 2026 | 18.2 | 16.3 | 20.3 | 1,024 | |
| September 2026 | September 18-20, 2026 | 6.1 | 4.9 | 7.5 | 1,024 | |
| September 2026 | September 18-20, 2026 | 6.0 | 4.9 | 7.4 | 1,024 | |
| September 2026 | September 18-20, 2026 | 5.0 | 3.9 | 6.2 | 1,024 | |
| September 2026 | September 18-20, 2026 | 0.9 | 0.5 | 1.6 | 1,024 | |
| September 2026 | September 18-20, 2026 | Any of these incidents | 44.6 | 42.0 | 47.2 | 1,024 |
| September 2026 | September 18-20, 2026 | None of these | 45.4 | 42.8 | 48.1 | 1,024 |
| September 2026 | September 18-20, 2026 | Not sure | 8.7 | 7.3 | 10.3 | 1,024 |
This period followed the limited release of Claude Mythos Preview in April, with AI cybersecurity capabilities continuing to advance over the summer. Our initial poll ran June 12–14, just days after Anthropic publicly released Claude Fable 5 and gave a group of vetted partners limited access to Claude Mythos 5. By September, increasingly capable open-weight models were also available.
Epoch's work is free to use, distribute, and reproduce provided the source and authors are credited under the Creative Commons BY license.
Learn more about this graph
In this analysis, we examine the change between two poll waves in the share of US adults who report having experienced at least one cyber incident in the previous 12 months. We find no change for incidents in aggregate, and no specific incident type rose in a way we can reliably statistically detect. The share reporting any incident changed from 46% (90% CI: 44% to 49%) in June to 45% (42% to 47%) in September.
We also find no detectable change among respondents who report frequent AI use. Among them, the share changed from 53% (90% CI: 48% to 59%) to 51% (45% to 57%).
Other indicators and publicized incidents suggest increasing AI cyber capabilities may be affecting measurable security outcomes. We previously documented a sharp increase in serious vulnerability disclosures in June, followed by a further increase in July. The incident involving OpenAI models hacking Hugging Face is one documented example of what frontier models can do offensively capabilities.
In addition to closed models, cyber capabilities among open-weight models have increased as well. Among these, the US Center for AI Standards and Innovation (CAISI) assessed the open-frontier model GLM-5.3 as having similar cyber capabilities to US frontier models around the time of the Fable 5 release.
Our polling examines a different outcome: whether a larger share of ordinary Americans report experiencing cyber incidents.
Data
The data are responses to a single question fielded on Ipsos’ KnowledgePanel Omnibus, a probability-based online panel that uses address-based sampling to choose respondents. We use two waves of the same question to compute the change. The June question was fielded June 12–14, 2026, with 1,021 respondents. The September question was fielded September 18–20, 2026, with 1,024 respondents. All estimates are weighted to be representative of the adult US population.
Both waves used the same multi-select question: “In the past 12 months, have any of the following happened to you? Please select all that apply.” Respondents could choose any of six incidents, “None of these”, or “Not sure”:
- Someone got into one of your online accounts without your permission
- Your personal information was leaked or stolen in a hack of a company, app, or website
- One of your devices was infected with a virus, malware, or spyware
- You were locked out of your files or device and asked to pay to get them back
- A service you depend on stopped working because it was attacked. Examples: bank app, medical portal, government website
- You received a spam message, call, or video that was unusually convincing or seemed personally aimed at you
Analysis
We calculate the share reporting “Any of these incidents” as the share selecting at least one of the six experiences. Each person is counted only once in this combined measure, even if they selected several experiences. The individual incident shares can therefore sum to more than the combined share.
We exclude “Not sure” and “None of these” responses from the graph to make interpretation easier. These responses account for approximately 8% in June and 9% in September for “Not sure”, and 45% in both months for “None of these”. Respondents who selected either of these options could not select any other options.
All estimates are weighted to represent US adults aged 18 and over. We report 90% Wilson confidence intervals for each estimate computed on Kish’s effective sample size to account for unequal weighting.
We repeat the comparison for respondents who report frequent AI use (n = 233 in June, 215 in September). Frequent AI use comes from an Ipsos KnowledgePanel profile question, “How often do you use or interact with artificial intelligence (AI) tools (chatbots, recommendation systems, etc.)?”, and counts respondents who answered “Daily” or “Weekly”.
Assumptions and limitations
Each wave polls a random sample of respondents rather than tracking the same individuals, so the results reflect population-level changes rather than changes within the same people, although 40 respondents participated in both waves by chance.
We focus on the overall change in incidents for this analysis. However, when looking at individual incident types, smaller changes may go undetected due to lack of statistical power. The analysis also does not identify incidents caused by AI, and is not able to estimate the counterfactual effect of particular model releases. Both waves ask about incidents in the preceding 12 months, so their recall windows overlap.
As with all polls, non-respondents may differ from respondents in ways that the weighting does not correct for. Cyber incidents are self-reported and may be affected by recall error or misclassification.
Download this data
Explore this data
Tracking how employed Americans use AI at work, across demographics.
Related insights
