UK cyber agency warns of AI ransomware attacks by 2028

What the agency expects by 2028

The assessment, “Artificial intelligence and cyber intrusion”, makes two main judgements. First, it is “highly likely that Russia, China and other nation states will routinely use AI-cyber to achieve their geopolitical goals”. The UK would then face attacks of greater scale and speed, it says.

Second, it is “highly likely that between now and 2028, AI-powered malware will have been used in a ransomware attack” on UK critical national infrastructure. Infosecurity Magazine names power stations, airports and hospitals as examples of what that means.

These are the agency’s forecasts, not facts. It writes that its three scenarios “are not predictions”, and that the “prospect for surprise is high”.

Sources16

What AI changes, and what it doesn’t

The annual review says the latest AI models “are transforming cyber operations” by helping with scouting targets, tricking people, finding flaws and writing exploit code. But it adds that the use of AI among attackers “remains uneven”.

The biggest effect will be that old methods get faster and larger, the review says, not that new ones appear. Horne made the same point at the launch in London.

In the coming months, “we face a real prospect of an unprecedented rise in the number of cyber incidents,” Horne said. That is “not because AI has invented new ways to attack us”, he said. It is “because vulnerabilities that have been tolerated for far too long can now be discovered and exploited at a scale that was once unimaginable”. The agency’s release gives no figure for the rise.

The assessment also looks at a worse case. In its pessimistic scenario, an automated attacker using frontier AI is no longer under its operator’s control. The agency calls it a “realistic possibility” that such a system could copy itself and attack at will.

Sources12346

The year in numbers

The review covers September 1, 2025 to August 31, 2026. The agency’s incident team received 1,831 reports of cyber attacks. Of those, 337 needed its support, and 80 were classed as nationally significant.

Its free Early Warning service also told 8,500 organisations about signs that their systems might be compromised. The service now has 19,922 organisations signed up, 52% more than a year ago.

For the PHP2Shell flaws alone, Horne said, the agency sent 110,000 notifications and alerts to UK organisations, Infosecurity Magazine reports. The review warns that its figures “do not tell the whole story”, because incidents differ greatly in size.

Sources36

What it asks organisations to do

“For decades, we have collectively got away with doing tech on the cheap,” Horne said. He criticised old systems “kept running for just one more year” and upgrades that get pushed back.

The agency’s list is short: invest properly in technology, don’t connect it to the internet without need, and treat its Cyber Essentials scheme as the starting point, not the end goal. The release says leaders who don’t act may have to explain themselves “when food isn’t on shelves, lights aren’t on, businesses have gone under”.

Last week the UK’s Chancellor announced £60 million for the first phase of a national Cyber Shield, and £70 million for a centre that looks for weak spots across critical infrastructure. The agency will also run a new AI Cyber Security Centre of Excellence in Manchester.

Sources2456