On November 3, 2026, the United Kingdom’s National Cyber Security Centre (NCSC) issued a stark warning regarding the increasing threat posed by cyberattacks driven by artificial intelligence (AI). According to their projections, nations such as China and Russia are likely to normalize the use of AI for launching cyberattacks by the year 2028, targeting geopolitical objectives. This alarming trend suggests that the UK will face a new era of complex, large-scale cyberattacks that are not only more frequent but also more sophisticated.
The NCSC’s report outlines the potential intentions behind such activities, particularly highlighting that the Chinese government may deliberately exploit AI technologies to carry out cyber operations against critical infrastructure and other strategic assets. The assessment indicates that China is uniquely well-positioned to enhance its cyber capabilities through a comprehensive approach involving legal frameworks, private contractors, and technological advancements.
The report further anticipated that by 2028, hackers would likely rely on AI-driven malware to launch ransomware attacks on the UK’s critical infrastructure, creating a grave risk for public services and safety.
Affiliated with the UK’s Government Communications Headquarters (GCHQ), the NCSC emphasized that the ongoing hostile cyber activities from China present the “most complex and enduring” challenges that the UK currently faces. The comprehensive strategy employed by the Chinese authorities to consolidate their cyber capabilities is often referred to as a “whole-of-state” approach.
In addressing the risks associated with AI threats, the report stated, “China is very likely to seek to leverage AI for cyber operations against critical national infrastructure and other strategic targets, and is the country best positioned to do so.”
The NCSC expressed concern over China’s significant investments in AI and its determination to develop cutting-edge AI technologies, which are expected to aid in efficiently scanning for vulnerabilities, identifying targets, and breaching networks.
The report cited instances of Chinese cyber activities, noting that in December 2025, the UK government imposed sanctions on two Chinese tech companies, including Sichuan i-Soon Information Technology Co. The report asserted that i-Soon had targeted the information systems of over 80 governments and businesses worldwide. Another firm, Integrity Technology Group, was accused of assisting in cyber intrusions, with the FBI attributing certain hacking activities to a Chinese group known as “Flax Typhoon.”
Additionally, the report identified Russia as posing the most audacious cyber threats to the UK at present. Richard Horne, the CEO of NCSC, indicated in a scheduled speech that Russia continues to attempt to infiltrate UK military networks. Meanwhile, Iran is reportedly conducting malicious cyber operations globally, targeting the UK and individuals perceived as threats.
The report linked a notable cyberattack on Poland’s energy grid in December 2025 to the Russian Federal Security Service’s (FSB) Center 16, suggesting that if successful, this attack could have left 500,000 people without power.
Historical denials from Moscow, Beijing, and Tehran regarding similar cyberattack allegations were also referenced.
Critical infrastructure encompasses facilities such as power plants, airports, and hospitals, as well as services in energy, transportation, defense, food, healthcare, and finance. Typically, hackers exploit systems using ransomware to encrypt data, demanding ransom payments from victims for the restoration of access to their systems and stolen data.
Recently, several supermarkets across Europe suffered from cyber intrusions that compromised refrigeration and freezing equipment, leaving temperatures of some devices elevated to around 50 degrees Celsius, resulting in significant food spoilage.
Horne, in his forthcoming remarks, is expected to warn that the number of cybersecurity incidents may escalate to unprecedented levels over the coming months. He will elaborate, stating, “This increase is not due to AI inventing new ways to attack us, but rather because long-tolerated security vulnerabilities can now be detected and exploited at an unparalleled scale.”
The NCSC analyzed that AI could enable attackers to gather intelligence on targets, conduct phishing schemes, search for system vulnerabilities, and develop malicious code. However, human operators remain essential at this stage, as current cases of AI usage observed by the NCSC have not yet resulted in entirely new forms of cyberattacks.
In the last year, the NCSC received a total of 1,831 reports of cyberattacks, with 337 requiring support from the incident management team, and 80 classified as incidents of national significance.
Research by the UK government estimated that malicious cyber activities result in annual losses of approximately £14.7 billion for UK institutions.
In response to these escalating threats, the UK is promoting a “Cyber Shield” initiative, which aims to utilize AI technology to improve the detection, analysis, and response to cybersecurity threats, thereby enhancing the defensive capacity of critical services.