UK cyber agency warns AI ransomware could hit infrastructure by 2028

A threat with a deadline

The NCSC is part of the intelligence agency GCHQ. It says AI could strengthen ransomware attacks by helping criminals choose targets, find vulnerabilities in networks and write malicious code.

Ransomware groups break into victims’ IT systems, encrypt files and demand cryptocurrency to unlock systems and return stolen data. UK victims have included Royal Mail, outsourcing company Capita and government organisations, including local councils.

The warning comes amid a wider government push to prepare for emergencies. Last month, the government urged people to keep up to nine litres of bottled water and three days’ worth of food at home. Launching the Be Ready campaign, Defence Secretary Wes Streeting said the UK should prepare for threats including “state-sponsored terrorism” and attacks by Russia or other hostile powers on everyday infrastructure.

The weakness AI can find

NCSC chief Richard Horne is due to warn on Tuesday, at the release of the agency’s annual review, that AI could soon drive a surge in cyberattacks.

“In the coming months, we will face a real threat of an unprecedented increase in cyber incidents,” he will say.

Horne says AI can expose weaknesses in IT systems that have “been considered acceptable for too long.” A recent example came when AI helped uncover a critical vulnerability in PHP, a programming language used by almost 70% of websites worldwide.

Alan Woodward, a professor of cybersecurity at the University of Surrey, argues that the warning makes access to advanced AI tools important for governments and companies. AI can help defenders find and fix vulnerabilities, he says, but attackers may gain the advantage if defenders lack access. OpenAI and Anthropic have given some organisations early access to their most powerful models to identify serious problems in IT systems.

The question of who gets access

My read is that the NCSC’s warning is about more than malware: it points to a race over who can use advanced AI to find weaknesses first. But the announcement does not say how widely that early access is available, or whether the organisations receiving it can protect the range of systems covered by the UK’s infrastructure definition.

Horne will also say that British military communication networks face daily attacks that are “persistent” and “systematic.” He will identify Russia as one source, saying Moscow runs “visible campaigns” that “deliberately stay below the threshold of armed conflict” while increasing efforts at hybrid warfare.

Recent attacks on refrigerators in European supermarkets should also serve as a warning to organisations, Horne will say. Hackers raised the temperature inside the refrigerators above 50 °C, illustrating how cyberattacks can reach beyond conventional IT systems.

“For decades, we have all managed to get by with cheap technology,” he will say. The warning puts the cost of that bargain in focus: infrastructure that was built to work cheaply may now need sustained investment to withstand attacks.