UK cyber agency warns AI malware could hit critical infrastructure by 2028
The national cyber agency says AI will help attackers, while Russia and China are expected to use it routinely in cyber-attacks.
Key points
- The NCSC says malicious AI software could very probably be deployed in a ransomware attack on UK critical national infrastructure by 2028.
- Critical infrastructure covers energy, transport, defence, food, health and finance.
- The warning appears in the NCSC's annual review, which also says Russia and China will routinely use AI in cyber-attacks.
- AI could help attackers scout targets, find network weaknesses and write malicious code.
- NCSC chief executive Richard Horne will issue a public warning in a speech on Tuesday.
According to The Guardian, the UK’s National Cyber Security Centre (NCSC) has cautioned that malicious software driven by artificial intelligence could very probably be deployed against vital national systems such as power plants, airports and hospitals before 2028. Those facilities belong to what the country calls critical national infrastructure.
The NCSC is part of the GCHQ spy agency. Its yearly assessment says AI will probably make it possible for criminals to launch a ransomware attack on this infrastructure before 2028. The UK classification takes in energy and transport, defence, food supplies, healthcare and financial services.
How the threat could develop
Ransomware involves breaking into a victim’s computer network, scrambling files with custom malware and then asking for cryptocurrency to restore access and return stolen data. Criminal groups based largely in former Soviet states are known for this method. Royal Mail, the outsourcing company Capita and several public bodies, including councils, have all been UK victims.
The NCSC said AI could make these attacks easier. Tools of this kind could assist offenders in identifying targets, spotting flaws in computer networks and producing harmful code. The agency also expects Russia and China to use AI routinely in cyber-attacks.
Warnings from the NCSC chief
Richard Horne, the NCSC’s chief executive, will speak publicly on Tuesday alongside the review. He is expected to argue that AI may trigger a surge of cyber-attacks in the near future. He will warn of a real chance of record-breaking numbers of incidents in the months ahead.
Horne is also expected to say that AI can expose flaws in computer systems that organisations have left unaddressed for too long. He pointed to a recent case in which AI helped locate a serious bug in PHP, a programming language that nearly 70% of websites worldwide depend on.
Horne will add that British military communications networks face daily, ongoing assaults. He is expected to name Russia as one of the parties involved. The campaigns are designed to stay short of open war, he will say, as Moscow pushes what he describes as hybrid warfare.
Why the story matters
Defence secretary Wes Streeting said at the Be Ready launch that Britain must plan for attacks on everyday infrastructure by Russia or other hostile governments. The government had earlier urged people in Britain to keep as much as nine litres of bottled water and food for three days at home, so households can cope with weather, cyber or other serious emergencies.
Alan Woodward, who teaches cybersecurity at Surrey University, said the NCSC’s message makes clear that governments and businesses need access to leading-edge AI. He said AI can help people find and fix flaws, but attackers will act first if defenders lack access. So far, OpenAI and Anthropic, two leading AI developers, have given selected organisations early use of their strongest systems to spot major software faults.
Horne will also point to recent hacks of supermarket fridges in Europe, where hackers pushed temperatures above 50C. He said companies and bodies must put substantial funds into resilience against cyber threats, noting that for years the sector relied on low-cost technology.
Frequently asked questions
What did the UK cyber agency warn about?
The National Cyber Security Centre said AI-powered malware is highly likely to be used in a ransomware attack on UK critical national infrastructure by 2028. The warning appeared in its annual review.
Which sectors does UK critical national infrastructure cover?
The UK definition takes in energy and transport, defence, food supplies, healthcare and financial services. It includes facilities such as power stations, airports and hospitals.
Why is AI expected to increase cyber threats?
According to the NCSC, AI can help attackers scout targets, find weaknesses in IT networks and write malicious code. The agency also expects Russia and China to use AI routinely in cyber-attacks.
Sources
This article was written with the help of AI from reports by the outlets listed above. See our Editorial Policy. Spotted a mistake? Tell us.