The UK's National Cyber Security Centre (NCSC) expects AI-powered malware to be used against the country's critical national infrastructure by 2028, The Guardian reported. The NCSC, part of the GCHQ spy agency, made the warning in its annual review, published on Tuesday.
"It is … highly likely that between now and 2028, AI-powered malware will have been used in a ransomware attack on UK CNI," the NCSC said. Under the UK definition, critical national infrastructure covers energy, transport, defence, food, health and finance. The review also warned that Russia and China will start using AI "routinely" in cyber-attacks.
Ransomware attackers break into a victim's IT systems and lock files with custom malware. They then demand cryptocurrency to unlock the systems and return stolen data. The Guardian said the method is a signature tactic of gangs that typically operate from former Soviet Union states. Past UK victims include Royal Mail, outsourcing firm Capita and several councils. According to the NCSC, AI will help attackers scout targets, find weak spots in networks and write malicious code.
NCSC chief executive Richard Horne is due to give a speech alongside the review. He will warn of "a real prospect of an unprecedented rise in the number of cyber incidents" in the coming months. Horne will say AI can uncover IT weaknesses that have been "tolerated for far too long". Last month, AI helped find a critical flaw in PHP, a programming language used by almost 70% of the world's websites.
Horne will also say that British military communications networks face "persistent" and "sustained" attacks every day. He will name Russia as one of the attackers. According to Horne, Moscow's campaigns deliberately stay below the threshold of armed conflict. He will also point to recent hacks on supermarket fridges in Europe, where temperatures were pushed above 50C. "For decades we have collectively got away with tech on the cheap," he will say.
Alan Woodward, a cybersecurity professor at Surrey University, said the warning shows that governments and companies need access to the most advanced AI. "AI can help people find these flaws and patch them, but if we don't get the access the bad guys will beat them to it," he said. So far, OpenAI and Anthropic have given some companies advanced access to their most powerful models to help find serious flaws.
The warning follows Be Ready, a government campaign launched last month. It urged Britons to store up to nine litres of bottled water and three days' worth of food for emergencies, including cyber-attacks.