official (UK National Cyber Security Centre assessment and press release), press (AP), Nov 3
UK cyber agency says an AI ransomware attack on critical infrastructure is likely by 2028
A two-year warning from GCHQ's cyber arm.
Key facts
- Judgment
- Highly likely that AI-powered malware will have been used in a ransomware attack on UK critical national infrastructure between now and 2028 (NCSC)
- States
- Highly likely that Russia, China and other states will routinely use AI cyber tools by 2028 (NCSC)
- Weak spots
- Attackers are likely to aim AI tools at known flaws in legacy infrastructure technology and at new AI deployments inside it (NCSC)
- Report
- State of the Cyber Nation, published Nov 3 by the NCSC, part of GCHQ (NCSC)
- Funding
- 60 million pounds for a national Cyber Shield and 70 million pounds for a new vulnerability centre, announced last week (NCSC)
Vulnerabilities that have been tolerated for far too long
NCSC chief Richard Horne, via AP
Note
Britain's National Cyber Security Centre said on Tuesday, Nov 3, that it is highly likely AI-powered malware will be used in a ransomware attack on UK critical national infrastructure between now and 2028.
The judgment comes from the agency's State of the Cyber Nation report. It also says Russia, China and other states will highly likely use AI cyber tools routinely by 2028, and that many systems will remain open to AI tools that find and exploit weaknesses.
NCSC chief Richard Horne said AI will allow vulnerabilities that have been tolerated for far too long to be found and exploited at a scale that was once unimaginable, AP reports.
The report sets out three scenarios and says they are not predictions. The agency said the prospect for surprise is high.
Why it matters
It is the UK government's own forecast, and it says defensive AI in critical infrastructure lags behind offensive use, the NCSC says.
Sources
- NCSC: Artificial intelligence and cyber intrusion (Nov 3 2026)
- NCSC: Cyber chief says UK facing AI-powered attacks on critical infrastructure within two years (Nov 3 2026)
- AP: UK warned of AI cyberattacks on critical infrastructure by 2028 (Nov 3 2026)
Primary + secondary attribution as listed.
Doom Signals desk · About · Contact · Corrections. Spotted an error? Write the desk; fixes go on the public log.