UK cyber agency says AI-powered attack on critical infrastructure likely by 2028

The UK's National Cyber Security Centre (NCSC) has assessed that an AI-powered cyberattack on the country's critical national infrastructure (CNI) is likely by 2028. The NCSC, the UK's state cybersecurity body, issued the assessment on Tuesday, according to Reuters; The Guardian reports it was published in the NCSC's annual review.

The Guardian quoted the NCSC as saying: "It is … highly likely that between now and 2028, AI-powered malware will have been used in a ransomware attack on UK CNI." A Reuters summary refers more generally to "an AI-powered cyberattack" in "the next two years" and does not specify ransomware.

Context

According to The Guardian, the warning appeared in the NCSC's annual review. The Guardian describes the NCSC as part of the GCHQ intelligence agency. The review warned that Russia and China will start using AI "routinely" in cyber-attacks, according to The Guardian. According to Reuters, the NCSC said China was likely the best equipped to conduct AI-powered operations against UK critical infrastructure.

The Guardian reports that the NCSC said AI will help attackers scout targets, find weaknesses in IT networks and write malicious code. According to The Guardian, the UK defines CNI to include energy, transport, defence, food, health and finance. Past UK ransomware victims include Royal Mail, the outsourcing firm Capita and councils, The Guardian reports.

What each side says

NCSC chief executive Richard Horne was scheduled to give a speech on Tuesday, according to The Guardian, which previewed it in advance. In his prepared remarks, as previewed, Horne was to say: "In the coming months, we face a real prospect of an unprecedented rise in the number of cyber incidents." He was also to say that British military communications networks face daily "persistent" and "sustained" attacks, with Russia among the perpetrators. The Guardian's preview also cites attacks in Europe in which hackers raised supermarket fridge temperatures to more than 50C.

Alan Woodward, professor of cybersecurity at Surrey University, said the warning underlines the need for access to cutting-edge AI. The Guardian quoted him as saying: "AI can help people find these flaws and patch them, but if we don’t get the access the bad guys will beat them to it."

According to The Guardian, Wes Streeting, whom it describes as the defence secretary, said at last month's launch of the government's "Be Ready" campaign that Britain needed to prepare for "state-sponsored terrorism" targeting everyday infrastructure.

What the reports do not say

The reports do not explain the evidence or methodology behind the NCSC assessment. They do not explain why China is considered best equipped. The reports do not confirm that Horne's speech was delivered as previewed. They do not include responses from the Russian or Chinese governments. Vocemundi reviewed only a summary of the Reuters report.

Analysis

The assessment places AI at the centre of the UK's official cyber threat picture. The reports leave open how the NCSC reached its judgement. One scenario is that operators of energy, transport and health systems increase spending on cyber resilience, as Horne's previewed remarks urge. Another is wider debate over who gets access to advanced AI tools that can find software flaws, a point Woodward raises. The difference between The Guardian's ransomware-specific wording and the broader Reuters framing may matter for how the risk is understood. Responses from Russia and China, named in the reports, are not included.

Produced by the Vocemundi newsroom with AI assistance.