NCSC
UK cyber agency warns AI ransomware will likely hit infrastructure
The NCSC says AI-powered malware is highly likely to feature in a ransomware attack on UK power stations, airports and hospitals by 2028.
The UK’s National Cyber Security Centre says AI-powered malware is highly likely to be part of a ransomware attack on British critical infrastructure by 2028, and that the most advanced AI tools already let low-skilled hackers run sophisticated attacks.
The NCSC, part of GCHQ, published its Annual Review 2026, “The State of the Cyber Nation,” on Nov. 3.
Hackers Are Expected to Target Power, Airports and Hospitals
Infosecurity Magazine reported that the review warns financially motivated hackers are highly likely to use AI-powered malware against UK power stations, airports and hospitals by 2028. It also says nation states including Russia and China will routinely use AI in their cyber activity.
The Register reported that the NCSC pointed to open source AI security tools built for researchers being repurposed for attacks, and said China “has likely played a role” in supplying them. The NCSC also called it “a realistic possibility” that an autonomous AI attacker “could self-replicate and conduct cyberattacks at will,” The Register reported.
The Review Says AI Exposed Old Weaknesses
“AI makes cyber attacks easier, faster and cheaper to execute, and at greater scale,” the review says. It adds that AI “did not create these cyber security weaknesses; it revealed them.”
Its guidance on frontier AI says the most advanced tools “make it easier, faster and cheaper for even low-skilled hackers to carry out sophisticated cyber attacks.” Agentic AI tools mean organizations need to understand what access those tools have to their systems and data.
NCSC Chief Executive Richard Horne spoke at the launch in London. He said the threat will be felt “by us all, whether you and your organization choose to harness it or not,” and warned of “a real prospect of an unprecedented rise in the number of cyber incidents,” Infosecurity Magazine reported.
Government Is Using Frontier Models to Find Flaws
The Government Cyber Coordination Centre, the AI Security Institute and other departments launched Project DROMOS in 2026 to use frontier AI models to find software vulnerabilities in government code. In selected government environments, participants used AI-assisted analysis to uncover “hundreds of potential security issues, including critical vulnerabilities,” according to the review. Humans reviewed the findings and weeded out false positives.
The government announced £60 million for the first phase of a national Cyber Shield and £70 million for a National Exposure and Real-Time Vulnerability Centre on Oct. 24, Infosecurity Magazine reported.
The NCSC believes AI will ultimately be a “net positive” for cyber security and calls it “the best opportunity we have to improve cyber security at scale.”
What It Means for the Labs
We think the labs’ products now appear on both sides of the NCSC’s account. The agency names frontier AI and agentic tools as the reason attacks are cheaper, and DROMOS used the same kind of frontier models to find hundreds of potential flaws in government code. Those findings still needed humans to review them and weed out false positives.