Technology news and discussion on TalkFuse.
UK cyber chief warns AI malware could target critical infrastructure by 2028
Developing story first seen 58 minutes ago
The National Cyber Security Centre says AI-powered malware is highly likely to be used in a ransomware attack on UK critical infrastructure by 2028. Its warning matters because essential services could face attacks that are faster and easier to scale, while the UK’s defences are not keeping pace.
In its annual State of the Cyber Nation report, the NCSC says China, Russia and other states are highly likely to use AI routinely for geopolitical aims by 2028. It points to preventable weaknesses, including unpatched software and poor password protection, and urges organisations to make security a basic requirement. Critical infrastructure includes energy, transport, defence and emergency services.
- Sources
- 2
- Outlets
- 2
- Left · Centre · Right
- 1 · 0 · 1
In short
- AI malware is highly likely to hit UK critical infrastructure by 2028.
- The NCSC says the UK is not resilient enough.
- Organisations are urged to fix basic security weaknesses.
How this story developed
- 26 minutes ago The UK’s cyber chief has now described the country’s resilience as inadequate, while reiterating that hostile states are likely to use AI routinely for geopolitical purposes and that critical services face a high risk of AI-powered ransomware before 2028.
- 33 minutes ago The National Cyber Security Centre warned that AI-driven malware would probably be used in a ransomware attack on UK critical infrastructure by 2028, citing basic security gaps such as unpatched software and weak passwords.
Full account
The National Cyber Security Centre (NCSC) says it is highly likely that AI-powered malware will be used in a ransomware attack on UK critical national infrastructure by 2028. Its warning appears in the agency’s annual review. The NCSC, part of GCHQ, also expects China, Russia and other states to use AI routinely in cyber operations to pursue geopolitical aims.
The agency says AI could help attackers work faster and at greater scale by identifying weaknesses in computer networks, surveying potential targets and producing malicious code. In a speech accompanying the review, NCSC chief executive Richard Horne is expected to warn that the UK’s ability to withstand cyber attacks is not keeping pace with the threat. He says many organisations remain exposed through weaknesses such as unpatched software and poor password protection, which have been allowed to persist.
Critical national infrastructure includes services and facilities across sectors such as energy, transport, defence, health, food and finance. Ransomware attacks typically lock or encrypt victims’ files and demand payment to restore access, sometimes alongside threats to disclose stolen data. UK victims have included Royal Mail, Capita and public bodies. The reports also cite recent cyber incidents affecting businesses and services, including an attack that disrupted Jaguar Land Rover’s vehicle production.
Horne’s message is that AI has not necessarily created new ways to attack systems; it can make long-standing vulnerabilities easier to find and exploit. He is expected to call on organisations to act urgently, framing cyber security as a choice between building national resilience and facing attacks that could become more frequent, severe and costly. The NCSC’s forecast is a warning about likelihood, rather than a claim that such an attack has already occurred or is certain to happen.
Where outlets differ
From the full account, which is AI-written from the sources:
Source 1 gives greater prominence to Horne’s call for urgent action and describes a broad threat to UK infrastructure, while Source 2 leads with examples such as power stations, airports and hospitals and explains how ransomware works.
Source 1 mentions international incidents involving Binance and refrigeration systems in Europe, as well as Jaguar Land Rover. Source 2 instead highlights UK ransomware victims and refers to a recent AI-assisted discovery of a weakness in PHP.
Source 2 adds the government’s Be Ready campaign and comments from Defence Secretary Wes Streeting and cybersecurity academic Alan Woodward. Those points do not appear in Source 1.
Both reports give the NCSC’s 2028 assessment, but Source 1 foregrounds the prospect of hostile states using AI to pursue geopolitical goals; Source 2 focuses more on AI’s practical uses in cyber attacks.
Left-leaning outlets 1
Only here: powered, highly, likely, used, hack
Right-leaning outlets 1
Only here: cyber, chief, warns, target, critical
Every side used: malware, infrastructure
Headline columns compared word for word; nothing in them is AI-written.
Steelman: both sides, in good faith
The strongest fair case each way — we don't pick a winner.
The case for
Treating the warning seriously is prudent because essential services depend on interconnected systems, and AI could help attackers find weaknesses or scale ransomware more quickly. Fixing known vulnerabilities and improving basic security now may reduce the risk of disruption to public services and the economy.
The case against
Warnings about future threats should be proportionate to the evidence: AI may change how attacks are carried out, but it does not by itself show that a major incident is imminent or that every organisation needs costly new measures. Focusing heavily on speculative scenarios could divert limited resources from established risks and practical security improvements.
Explained simply
The National Cyber Security Centre (NCSC) is the part of GCHQ that helps protect the UK from cyber attacks. Critical infrastructure means services the country relies on, including energy, transport, defence and emergency services.
Ransomware is malicious software that locks or disrupts access to systems, often to demand money. AI could help attackers create or adapt such software more quickly, while weaknesses such as outdated software and poor passwords can make organisations easier to target.
The NCSC also assesses how states such as China and Russia may use AI for political aims. Its warning concerns the ability of attacks to spread or be carried out at greater scale, and the challenge of keeping essential services’ defences up to date.
Coverage · 2 sources
Bias meters
From 2 rated sources.
AI Asia Cybersecurity Europe Technology UK World
Read the full article at the source →
Originally published by Daily Mail as “UK could face AI-powered cyberattacks on critical infrastructure within two years, security chief warns”.