Will an AI system autonomously cause a major breach of US personal data held by an organization other than its operator before 2028?