UK Cyber Chief Warns of AI Attacks on Critical Infrastructure by 2028
Britain’s National Cyber Security Center states that artificial intelligence will allow criminals and states to exploit long-tolerated vulnerabilities at a scale previously impossible.
By Beatriz Soto ·
Richard Horne, head of the U.K.’s National Cyber Security Center, stated that the country will likely face artificial intelligence cyberattacks on critical infrastructure by 2028. He made the warning Tuesday while unveiling the agency’s annual cyber report.
Horne said AI-powered malware will enable attackers to find and exploit vulnerabilities that have been tolerated for far too long. He described the resulting impact as occurring at a scale that was once unimaginable.
The report identifies Chinese cyber activity as the most sophisticated and sustained challenge facing the U.K. It notes that both Russia and China will routinely use AI to achieve geopolitical goals. Iran is also carrying out attacks targeting individuals who threaten the Iranian regime.
AI is more likely to enhance and scale existing tactics rather than discover new vulnerabilities, according to the report. This assessment follows urgent security updates issued last week after AI-assisted discoveries of flaws in a programming language used by 70% of websites globally.
Those two critical flaws could allow bad actors to gain unauthenticated access to sites. In theory, this would let them control web servers remotely without a password.
Horne listed specific systems at risk, including electricity switching, water sluice gates, dam operations, manufacturing lines, and heating and refrigeration controls. He pointed to recent attacks on French supermarket refrigeration systems as evidence of how easily civilian infrastructure can be exploited.
The U.K. and E.U. member states attributed a December 2025 attack on Poland’s energy grid to Russia’s FSB security service. That attack could have left 500,000 people without electricity during winter.
Malicious cyber activity costs U.K. organizations nearly $20 billion every year, the NCSC said. In 2025, Jaguar Land Rover suffered over $260 million in direct losses from a cyberattack that also hit its suppliers.
Anne Keast-Butler, director of GCHQ, said every U.K. organization must take action now. She noted that cybersecurity is now part of the front line defense of the nation.
The NCSC recommends implementing basic measures such as keeping devices up to date, limiting administrator access, and backing up important files and data.
