Science & Tech · Cybersecurity · 2 hrs ago
UK cyber agency warns AI malware could hit critical infrastructure by 2028
The UK’s National Cyber Security Centre says AI-powered malware is highly likely to be used in a ransomware attack on the country’s critical infrastructure by 2028.
The warning covers services such as power, transport, hospitals, food and finance.
Ransomware attackers break into computer systems, lock files and demand payment to restore access or return stolen data.
AI could help attackers find targets, spot weaknesses and write malicious code, making those attacks easier to carry out.
The agency also warns that Russia and China are likely to use AI routinely in cyber-attacks, while Russian-linked activity has targeted military communications.
The warning highlights the risk to services people rely on every day, and the agency’s chief is due to urge stronger cyber defences as incidents may rise in the coming months.
The UK’s National Cyber Security Centre says it is highly likely AI-powered malware will be used in a ransomware attack on the country’s critical infrastructure by 2028.
The agency warns that AI could help hostile actors find weaknesses and carry out cyber operations faster and at greater scale.
NCSC chief executive Richard Horne says long-standing weaknesses in organisations’ systems leave them vulnerable.
The NCSC says China is best positioned to use AI against UK infrastructure, while also warning of cyber activity by Russia and Iran.
Horne is urging organisations to invest urgently in security and resilience.
- Who
- The UK’s National Cyber Security Centre and its chief executive, Richard Horne, issued the warning.
- What
- AI-powered malware is highly likely to be used in a ransomware attack on UK critical infrastructure by 2028.
- When
- The warning was published on 3 November 2026; the attack is forecast by 2028.
- Where
- The United Kingdom.
- Why
- The NCSC says AI can help attackers discover and exploit long-standing weaknesses in computer systems at greater scale and speed.
This story does not have two clearly opposing sides.
The UK government urged Britons to stock up on bottled water and food for emergencies, including cyber incidents.
The NCSC published its annual review warning of a likely AI-powered ransomware attack on UK critical infrastructure by 2028.
The NCSC says AI-powered malware is highly likely to have been used in a ransomware attack on UK critical infrastructure.
- Forecast
- AI-powered malware in a ransomware attack on UK critical infrastructure by 2028 is highly likely
- Agency
- National Cyber Security Centre (NCSC)
- Chief executive
- Richard Horne
- Report date
- 3 November 2026
- Critical infrastructure sectors
- Energy, transport, defence, food, health and finance
4 sources
UK warned of AI cyberattacks on critical infrastructure by 2028
Britain must expect AI-powered attack on critical infrastructure within two years: Report
UK could face AI-powered cyberattacks on critical infrastructure within two years, security chief warns
AI-powered malware ‘highly likely’ to be used to hack UK infrastructure by 2028
What people are saying
In the coming months, we face a real prospect of an unprecedented rise in the number of cyber incidents.
The cyber threat has increased faster than our defensive capabilities, leaving too many organisations vulnerable to attacks that could – and should – be prevented.
For decades we have collectively got away with tech on the cheap
AI can help people find these flaws and patch them, but if we don’t get the access the bad guys will beat them to it