Key facts
- The NCSC said it was highly likely AI-powered malware would be used in a ransomware attack on Britain's critical infrastructure by 2028.
- Horne was due to say China and Russia would routinely use AI in cyber operations by 2028.
- The NCSC said Britain's exposure stems from doing IT on the cheap, not from AI creating new attack methods.
- The NCSC said a government pilot, Project Ex, found hundreds of potential security issues including critical vulnerabilities.
- Horne was due to say Russia is making sustained attempts to penetrate UK military networks and Iran is conducting malicious cyber operations globally.
Britain's National Cyber Security Centre said on November 3, 2026 that it was highly likely a ransomware attack involving AI-powered malware would hit the country's critical infrastructure by 2028. In its annual report, the agency also warned that China and Russia would routinely use AI in their cyber operations by that date.
The warning was set to be delivered in a speech by NCSC chief executive Richard Horne, who was due to say Britain faces the real prospect of an unprecedented rise in the number of cyber incidents in the coming months. Horne attributed the risk not to AI inventing new attack methods but to vulnerabilities that had been tolerated for too long being discovered and exploited at a scale once unimaginable.
The report said AI did not create the weaknesses but exposed years of technical debt and a failure to implement basic protections. It said even hacks linked to state-sponsored actors were often carried out through internet-facing applications and by exploiting vulnerabilities for which patches were available but not deployed in time.
Horne was due to criticize business practices that left systems exposed, saying organizations had got away with doing tech on the cheap for decades. He was expected to warn that executives who failed to act would have to explain to investors, shareholders, employees, customers and suppliers when food is not on shelves, lights are not on and businesses have gone under.
The report said the government had begun testing frontier AI systems to find weaknesses in its own networks. One initiative, Project Ex, started as a four-week pilot and was expanded into live government environments, where it found hundreds of potential security issues including critical vulnerabilities. The agency planned to look beyond government systems with £70 million ($93 million) in funding.
Horne was also due to say that Russia was making sustained attempts to penetrate UK military networks and that Iran was carrying out malicious cyber operations globally, including against the UK and individuals seen as a threat. He was expected to say China highly likely has the intent and is best positioned to use AI for operations against Britain's critical national infrastructure. Moscow, Beijing and Tehran have repeatedly denied similar accusations of malevolent cyber actions in the past.
The report and speech followed hacking attacks on supermarkets across Europe that exposed vulnerabilities in IT systems. The warning also followed a June alert from the Five Eyes intelligence alliance, which said AI would fundamentally transform offensive and defensive cyber capabilities and that the timeline was months, not years.