The UK's National Cyber Security Centre now says it is "highly likely" that AI-powered malware will have been used in a ransomware attack on UK critical national infrastructure by 2028.
The assessment is in the NCSC's annual review, published on 3 November. The NCSC is part of GCHQ, and the UK's definition of critical national infrastructure covers energy, transport, defence, food, health and finance. The Guardian's report names power stations, airports and hospitals as the kind of facilities in scope.
What AI changes about ransomware
This isn't a new kind of attack. It's the existing ransomware playbook, made faster and cheaper. AI helps attackers:
- scout targets,
- locate weaknesses in IT networks,
- write malicious code.
The review also expects Russia and China to start using AI "routinely" in cyber-attacks.
"Tech on the cheap"
NCSC chief executive Richard Horne is due to warn in a speech that the UK faces a "real prospect of an unprecedented rise in the number of cyber incidents" in the coming months. His reason: AI is good at finding weaknesses that have been tolerated for far too long.
There's already an example. Last month AI helped uncover a critical flaw in PHP, the language behind almost 70% of the world's websites.
Horne will also cite the recent attacks on supermarket fridges in Europe, where hackers pushed temperatures above 50C, as a warning that organisations need to invest in resilience. On the cause, he is blunt: "For decades we have collectively got away with tech on the cheap."
He will also say British military communications networks face persistent, sustained daily attacks, with Russia among the perpetrators and campaigns deliberately kept below the threshold of armed conflict.
Defenders need the same tools
Alan Woodward, professor of cybersecurity at the University of Surrey, told the Guardian that AI can help defenders find and patch these flaws, but only if they get access before attackers do. OpenAI and Anthropic have already given some companies early access to their most capable models for that purpose.
Why this matters outside the UK
Nothing in the NCSC's threat model is specific to Britain. Every country runs old infrastructure software and carries the same backlog of known-but-unfixed weaknesses. For enterprises in India, I'd treat patch debt as the AI risk, rather than some future model capability. If AI makes finding old flaws cheap, the organisations with the longest list of old flaws are the ones exposed.
Source: AI-powered malware 'highly likely' to be used to hack UK infrastructure by 2028, The Guardian
