The country's state cyber guardians have, for the first time in plain terms, attached a horizon to a fear that had until now hovered in general warnings. Between now and 2028, they judge it highly likely that artificial intelligence will be turned into a weapon in ransomware attacks on the systems that keep power, flight, medicine and water moving through Britain. It is a reminder, as old as the telegraph and as new as the chatbot, that every tool which makes defence wiser also makes attack quicker, and that the margin between the two is now a matter of investment and access.
UK Cyber Agency Warns AI-Powered Malware Is 'Highly Likely' to Hit Critical Infrastructure by 2028
"For decades we have collectively got away with tech on the cheap."
Mark
Why does a date like 2028 matter so much here?
Mimi
Because the NCSC is naming a window, not just a vague risk. It says AI-powered malware is highly likely to be used in a ransomware attack on UK critical infrastructure by then.
Mark
What does AI actually change for the attackers?
Mimi
The review points to scouting targets, finding weaknesses in networks and writing malicious code. Ransomware itself is old; AI speeds up the groundwork.
Luke
Worth noting that "highly likely" is a judgement, not a sighting. Nothing here says such an attack has already happened.
Mark
Fair. Is there any evidence AI is already finding flaws?
Mimi
One example: last month AI helped uncover a critical weakness in PHP, which is used by almost 70% of websites.
Luke
That shows AI can find vulnerabilities. It doesn't show criminals are doing it at scale. And the claim that Russia and China will use AI routinely is the NCSC's expectation, not a documented fact.
Mark
And the defensive side?
Mimi
Alan Woodward argues defenders need access to the same tools. Some firms have been given advanced access to models from OpenAI and Anthropic.
Luke
We don't know how many firms, or whether that access is enough. The reporting doesn't say.
Mark
What about the supermarket fridges?
Mimi
Horne cites European attacks that raised fridge temperatures above 50C as a warning about resilience.
El Pulso
- The NCSC has set a deadline: AI-powered malware is judged highly likely to strike UK critical national infrastructure by 2028.
- Power stations, airports and hospitals sit in the crosshairs, where a single encrypted system can halt whole cities.
- Russia and China are expected to deploy AI routinely, using it to scout targets, find network weaknesses and write malicious code.
- Chief Richard Horne warns of an unprecedented rise in cyber incidents in the months ahead, with military communications already under daily attack.
- Officials are urging heavy investment in cyber resilience, and experts argue that defenders need the same cutting-edge AI access as attackers.
The country's state cyber guardians have, for the first time in plain terms, attached a horizon to a fear that had until now hovered in general warnings. Between now and 2028, they judge it highly likely that artificial intelligence will be turned into a weapon in ransomware attacks on the systems that keep power, flight, medicine and water moving through Britain. It is a reminder, as old as the telegraph and as new as the chatbot, that every tool which makes defence wiser also makes attack quicker, and that the margin between the two is now a matter of investment and access.
The UK's National Cyber Security Centre has put a date on a danger it had previously described only in general terms. In its annual review, the agency, part of GCHQ, says it is "highly likely" that by 2028 AI-powered malware will be used in a ransomware attack on critical national infrastructure, from power stations and airports to hospitals, food supply, defence and finance.
Ransomware is already a favoured tool of criminal gangs. Attackers break into systems, lock files with custom malware and demand payment in cryptocurrency. Royal Mail, the outsourcing firm Capita and several councils have all been victims. The NCSC expects AI to make this worse by helping attackers pick targets, locate weaknesses and write code more quickly. Chief executive Richard Horne will warn of a coming surge in incidents, pointing to old IT flaws that have been "tolerated for far too long" and to a recent AI-assisted discovery of a serious flaw in PHP, a language used by nearly 70% of websites.
Experts see both danger and hope in the same technology. Alan Woodward of Surrey University argues that AI can also find and patch flaws, but only if defenders gain access to the most capable models, which some AI firms have begun offering to selected companies. The warning follows the government's Be Ready campaign urging households to stockpile supplies, and Horne will describe daily, sustained attacks on military communications, with Russia running campaigns designed to stay below the threshold of armed conflict. His message is that the era of cheap technology is over, and that resilience must now be paid for.
The UK's state cybersecurity body has put a date on a threat it once described only in general terms. In its annual review, the National Cyber Security Centre says it is "highly likely" that between now and 2028, AI-powered malware will be used in a ransomware attack on UK critical national infrastructure. That category covers power stations, airports and hospitals, and more broadly facilities and services in energy, transport, defence, food, health and finance.
The NCSC is part of the GCHQ spy agency. Its review also says Russia and China are expected to start using AI "routinely" in cyber-attacks. Chief executive Richard Horne is due to deliver a speech alongside the review on Tuesday, in which he will warn of "a real prospect of an unprecedented rise in the number of cyber incidents" in the coming months.
Ransomware is already a cornerstone of the criminal hacker's toolkit, and a signature method of gangs that typically operate out of former Soviet Union states. Attackers first gain access to a victim's IT systems, then encrypt files with bespoke malware and demand payment in cryptocurrency to unlock the crippled systems and return any stolen data. UK victims have included Royal Mail, the outsourcing firm Capita and various public bodies, councils among them.
The NCSC expects AI to sharpen this threat in three ways: scouting targets, locating weaknesses in IT networks, and writing malicious code. Horne will tie the coming surge to the technology's ability to uncover weaknesses in IT systems that have been "tolerated for far too long." A recent example came last month, when AI helped discover a critical flaw in PHP, a computer language used by almost 70% of the world's websites.
Alan Woodward, a professor of cybersecurity at Surrey University, said the warning underlines why nation states and companies need access to cutting-edge AI. "AI can help people find these flaws and patch them, but if we don't get the access the bad guys will beat them to it," he said. So far, leading AI companies such as OpenAI and Anthropic have given some companies advanced access to their most powerful models to help them identify serious IT flaws.
The warning lands weeks after the government launched its Be Ready campaign, urging Britons to stock up to nine litres of bottled water and three days' worth of food so households could survive a weather, cyber or other serious emergency. Wes Streeting, the defence secretary, said at the launch that Britain needed to prepare for the threat of "state-sponsored terrorism" by Russia or other hostile powers targeting everyday infrastructure.
Horne will also say that communications networks used by the British military face daily attacks that are "persistent" and "sustained." Russia is one of the perpetrators, he will say, running "notable campaigns" that deliberately stay below the threshold of armed conflict as it escalates its attempts at hybrid warfare.
He will point to recent attacks on supermarket fridges in Europe, where hackers raised temperatures to more than 50C, as a warning to organisations to invest heavily in cyber resilience. "For decades we have collectively got away with tech on the cheap," he will say. The speech on Tuesday is the next marker to watch.
Citas Notables
In the coming months, we face a real prospect of an unprecedented rise in the number of cyber incidents.— Richard Horne, NCSC chief executive
AI can help people find these flaws and patch them, but if we don't get the access the bad guys will beat them to it.— Alan Woodward, Surrey University
Quieres la nota completa?
Lee el original en The Guardian ↗
Technology