# UK agency says AI-powered malware likely to target critical infrastructure by 2028

Digest AI · Policy & Regulation · published 2026-11-03T00:01:32Z

Canonical: https://digestai.news/story/uk-agency-says-ai-powered-malware-likely-to-target-critical-infrastruc

## Summary

The National Cyber Security Centre (NCSC), part of GCHQ, warned in its annual review that AI‑powered malware is "highly likely" to be used in ransomware attacks on the United Kingdom’s critical national infrastructure – including power stations, airports and hospitals – sometime between now and 2028. The agency also said Russia and China are expected to employ AI routinely in cyber‑attacks.

The NCSC chief executive Richard Horne will stress in an upcoming speech that AI can expose long‑standing IT weaknesses, citing a recent AI‑discovered flaw in PHP that affects roughly 70% of websites. Experts such as Surrey University professor Alan Woodward echoed the warning, noting that while AI can help organisations patch vulnerabilities, the same tools are being handed to some companies by leading AI firms like OpenAI and Anthropic to stay ahead of malicious actors.

The review comes as the UK government urges households to prepare for emergencies, and highlights recent incidents such as cyber‑tampering with supermarket fridges in Europe, underscoring the need for stronger cyber resilience across public and private sectors.

## Key points

- NCSC warns AI-powered malware is highly likely to be used in ransomware attacks on UK critical infrastructure by 2028.
- The agency says Russia and China will start using AI routinely in cyber‑attacks, and cites recent AI‑found PHP vulnerability.
- Experts note that leading AI firms like OpenAI and Anthropic are giving some companies advanced model access to help find IT flaws.

## Why it matters

AI‑enhanced ransomware could disrupt essential services, raising national security stakes and prompting urgent investment in cyber resilience across public and private sectors.

## Sources

1. [AI-powered malware ‘highly likely’ to be used to hack UK infrastructure by 2028](https://theguardian.com/technology/2026/nov/03/ai-powered-malware-artificial-intelligence-hacking-critical-uk-infrastructure) (The Guardian AI, 2026-11-03)

## Cite

Digest AI, "UK agency says AI-powered malware likely to target critical infrastructure by 2028", 3 November 2026, https://digestai.news/story/uk-agency-says-ai-powered-malware-likely-to-target-critical-infrastruc

---

Written by Digest AI's editorial model from the linked sources; the sources are the record. Headlines, digests and key points are written by Digest AI and may be quoted with a link to the story page. Linked articles belong to their publishers. Terms: https://digestai.news/terms#reuse
JSON: https://digestai.news/story/uk-agency-says-ai-powered-malware-likely-to-target-critical-infrastruc.json