UK agency says AI-powered malware likely to target critical infrastructure by 2028
The National Cyber Security Centre (NCSC), part of GCHQ, warned in its annual review that AI‑powered malware is "highly likely" to be used in ransomware attacks on the United Kingdom’s critical national infrastructure – including power stations, airports and hospitals – sometime between now and 2028. The agency also said Russia and China are expected to employ AI routinely in cyber‑attacks.
Key points
- NCSC warns AI-powered malware is highly likely to be used in ransomware attacks on UK critical infrastructure by 2028.
- The agency says Russia and China will start using AI routinely in cyber‑attacks, and cites recent AI‑found PHP vulnerability.
- Experts note that leading AI firms like OpenAI and Anthropic are giving some companies advanced model access to help find IT flaws.
The NCSC chief executive Richard Horne will stress in an upcoming speech that AI can expose long‑standing IT weaknesses, citing a recent AI‑discovered flaw in PHP that affects roughly 70% of websites. Experts such as Surrey University professor Alan Woodward echoed the warning, noting that while AI can help organisations patch vulnerabilities, the same tools are being handed to some companies by leading AI firms like OpenAI and Anthropic to stay ahead of malicious actors.
The review comes as the UK government urges households to prepare for emergencies, and highlights recent incidents such as cyber‑tampering with supermarket fridges in Europe, underscoring the need for stronger cyber resilience across public and private sectors.
AI-powered malware ‘highly likely’ to be used to hack UK infrastructure by 2028
The Guardian AI · 3 November 2026
Loading the full article…
This text was published by The Guardian AI and written by Dan Milmo Global technology editor. It is reproduced here with attribution so you can read it in full; the rights remain with the publisher. Read it at the source ↗
The headline, key points and digest above were generated by Digest AI's editorial model from the linked sources. Automated summaries can contain errors: the sources are the record. Spotted a mistake? Tell us. Published by Martin K., who runs Digest AI and handles corrections.
More in Policy & Regulation
All →- The New York Times and other publishers sue Brave Software for allegedly scraping content and selling it to AI companies · 4 src
- Anthropic warns it is close to recursive self‑improvement · 1 src
- OpenAI highlights 20 briefs backing AI training as fair use in copyright case · 1 src
- OpenAI plans post-midterm PR blitz to rebrand data centers as 'AI compute campuses' · 11 src
- Senator Warren demands Nvidia board answers over reported spy ties to Jensen Huang · 1 src
Comments
via GitHub Discussions