UK Cyber Agency Says AI-Powered Attack on Critical Infrastructure Is Likely by 2028

The assessment comes in the NCSC's Annual Review, published on November 3 and covering the 12 months to the end of August 2026. Richard Horne, the agency's chief executive, said the attacks could include ransomware carried out with AI-powered malware, according to a Reuters report carried by Al Bayan. He said the technology would let attackers find vulnerabilities that had been left unaddressed for far too long and exploit them at a scale that was previously unimaginable.

Horne told business leaders that those who had settled for cheap technology and failed to invest in cyber security or replace outdated systems would have to explain empty shop shelves, power cuts and failed companies, Al Bayan reported.

AI Revealed Existing Weaknesses

In his foreword to the review, Horne argued that the core problem is not new. "AI did not create these cyber security weaknesses; it revealed them," he wrote, pointing to technical debt and basic protections that organisations had put off. He added that "the UK's cyber resilience is not yet where it should be" and warned that "if we delay, cyber attacks will become more frequent, more severe and more costly."

Horne said AI makes attacks easier, faster, cheaper and more scalable, but that the same technology can help defenders identify weaknesses, automate their responses and recover more quickly. He called on organisations to modernise their technology and build long-term maintenance into their AI adoption plans.

State Actors and Scale

The review describes Chinese cyber activity as the most sophisticated and persistent cyber challenge facing the UK, and says Russia and China will routinely use AI to pursue their geopolitical goals, according to Al Bayan. It judges that AI use by states and criminals will very likely increase the scale and efficiency of hostile operations, though it expects AI mainly to refine and expand existing tactics rather than uncover entirely new classes of vulnerability.

The warning follows a week in which governments and companies rushed out emergency security updates after AI tools helped uncover two serious flaws in a core programming language used by around 70 percent of websites worldwide. Al Bayan reported that the flaws could allow attackers to reach sites without authentication and, in theory, take remote control of a web server without a password.

Why It Matters

The NCSC's assessment adds an official timeline to a risk that security teams have discussed in general terms since frontier models began showing strong code-analysis abilities. For boards, it shifts the question from whether AI-enabled attacks will reach essential services to how quickly legacy systems can be patched or replaced. Operators of energy, transport, healthcare and financial infrastructure, including Gulf companies with UK operations or suppliers, face pressure to treat modernisation of old technology as a security priority rather than an IT upgrade.