UK cyber agency expects AI-built malware to hit hospitals and power plants by 2028

The UK's National Cyber Security Centre (NCSC) says it is "highly likely" that AI-powered malware will be used in a ransomware attack on UK critical infrastructure between now and 2028. That covers places like power stations, airports and hospitals. The warning comes from the agency's annual review. The NCSC is part of GCHQ, the UK spy agency.

What changed

Ransomware is a familiar crime. Attackers break into a victim's computer systems, lock the files with malicious software, then demand payment in cryptocurrency to unlock them and return any stolen data. UK victims have included Royal Mail, the outsourcing firm Capita and several councils.

The NCSC says AI will make this worse. It can help attackers scout targets, find weak spots in IT networks and write malicious code. The review also warns that Russia and China will start using AI "routinely" in cyber-attacks.

What the agency expects

NCSC chief executive Richard Horne will give a speech on Tuesday to accompany the review. He will say that "in the coming months, we face a real prospect of an unprecedented rise in the number of cyber incidents." He blames AI's ability to uncover weaknesses in IT systems that have been "tolerated for far too long."

One recent example: last month AI helped find a critical flaw in PHP, a computer language used by almost 70% of the world's websites. Horne will also point to hackers in Europe who raised supermarket fridge temperatures to more than 50C, calling it a warning to invest in cyber resilience.

Who it affects

The named targets are UK facilities. The UK's definition of critical infrastructure also includes energy, transport, defence, food, health and finance. But the weak spots AI is good at finding sit in ordinary business and public systems too. Last month the UK government urged households to keep up to nine litres of bottled water and three days of food in case of a cyber or other serious emergency.

What to do

The material does not give a checklist, but the logic is clear. Faster attackers mean old, unpatched software is the easiest target. Sensible steps include:

• Install updates on phones, computers and business software promptly.
• Replace systems that no longer receive updates.
• Ask IT providers how quickly they fix known flaws.

The defense side

Alan Woodward, a cybersecurity professor at Surrey University, says AI can also help defenders find and fix flaws. But he warns that if they lack access to the best tools, "the bad guys will beat them to it." So far, OpenAI and Anthropic have given some companies advanced access to their most powerful models to help spot serious IT glitches.