UK cyber chief warns of AI attacks on infrastructure by 2028

The U.K. will likely face artificial intelligence-enhanced cyberattacks on its critical infrastructure by 2028, according to Britain’s cyber chief, Richard Horne. Speaking ahead of the National Cyber Security Centre (NCSC) annual cyber report, Horne warned that criminals and state actors, including China and Russia, are increasingly using AI to bolster their cyber operations.

He suggested that AI-enabled malware could exploit long-tolerated vulnerabilities and operate at previously unimaginable scale, potentially affecting essential services such as electricity, water facilities, and manufacturing controls.

The NCSC report notes that state actors already exploit AI to augment existing techniques, with China described as the most sophisticated ongoing cyber challenge and Russia conducting campaigns that fall below armed-conflict thresholds. It also references recent sector incidents, including AI-assisted vulnerability discovery in a programming language critical to about 70% of websites, where two AI-identified flaws could theoretically grant unauthenticated server access.

In the U.K., the cost of malicious cyber activity is cited at almost $20 billion per year, with Jaguar Land Rover cited as suffering over $260 million in direct losses in 2025. Anne Keast-Butler of GCHQ urged organisations of all sizes to invest in cybersecurity and update outdated technology, emphasising that cybersecurity now forms part of the front-line defence of the nation.