UK Cyber Chief Warns of AI-Driven Infrastructure Attacks by 2028

The United Kingdom is projected to confront artificial intelligence cyberattacks on its critical infrastructure by 2028, according to a warning issued Tuesday by the head of the National Cyber Security Center. Richard Horne stated that criminals and state actors, specifically China and Russia, are integrating AI into their operations to exploit vulnerabilities in essential systems.

The NCSC's annual cyber report marks the latest data point in a rising trend of state-sponsored digital aggression. In December 2025, UK and EU member states attributed a cyberattack on Poland's energy grid to Russia's FSB security service. The campaign targeted infrastructure that, had it been fully compromised, could have left 500,000 people without electricity during the winter.

Domestic costs have also risen sharply. The NCSC estimates that malicious cyber activity costs UK organizations approximately $20 billion every year. This financial burden includes the 2025 attack on carmaker Jaguar Land Rover, which resulted in over $260 million in direct losses and disrupted its suppliers and the wider UK economy.

Horne warned that business leaders who have relied on outdated or inexpensive technology will face scrutiny if they fail to invest in security. He stated that these leaders must explain why food is missing from shelves, lights are off, and businesses have closed if they do not update their systems. The report notes that AI will allow existing vulnerabilities to be discovered and exploited at a scale previously unseen.

The report identifies Chinese cyber activity as the most sophisticated and sustained challenge facing the UK. Both Russia and China are expected to use AI routinely to achieve geopolitical goals. Russia is conducting campaigns that remain below the threshold of armed conflict, while Iran is targeting individuals who pose a threat to its regime.

Recent events underscore the immediate relevance of these warnings. Last week, governments and corporations implemented urgent security updates after AI-assisted tools identified two critical flaws in a programming language used by 70% of global websites. These flaws allowed unauthenticated access to sites, potentially enabling remote control of web servers without passwords.

Horne noted that technology underpins physical processes vital to modern life, including electricity switching, water facility sluice gates, dam operations, manufacturing lines, and climate controls. He cited recent cyberattacks on refrigeration systems in French supermarkets as evidence of how easily hostile actors can exploit civilian infrastructure.

The NCSC advises that AI is more likely to enhance and scale existing tactics than to discover brand-new vulnerabilities. To prepare, organizations are urged to implement basic measures such as keeping devices up to date, limiting administrator access, and backing up important data.

Anne Keast-Butler, director of GCHQ, which oversees the NCSC, stated that cybersecurity is now part of the front-line defense of the nation. She called on every organization in the UK to take action now to protect customers, services, and livelihoods.