Britain's National Cyber Security Centre (NCSC) has warned that artificial intelligence could soon help criminals disrupt essential services. On November 3, the agency said AI-based malware could be used in ransomware attacks — intrusions that lock up systems or data and demand payment for their release — against UK critical infrastructure by 2028, with its chief cautioning that the country faces AI-powered attacks on critical infrastructure in two years.

The warning has not yet been confirmed. It centres on how quickly criminals could take advantage of vulnerabilities that operators have long struggled to fix — and it leaves Britain a defined window in which to close those gaps first.

Why the danger is speed, not a new kind of attack

AI is helping hackers carry out familiar attacks faster rather than enabling an entirely new form of assault. The NCSC's assessment of artificial intelligence and cyber intrusion describes the technology as a force multiplier: it allows attackers to identify targets, craft phishing messages, uncover vulnerabilities, and develop exploits more quickly. For defenders, that speed is the core problem: it shrinks the time available to find and fix the same weaknesses before attackers reach them. Humans still guide these operations. The International AI Safety Report confirms that no fully autonomous cyberattack, carried out from start to finish without human involvement, has been documented.

NCSC chief Richard Horne pointed to years of neglected security:

“Vulnerabilities that have been tolerated for far too long can now be discovered and exploited at a scale that was once unimaginable.”

Britain has committed £60 million to a Cyber Shield and £70 million to the NERV vulnerability-scanning centre, while a new AI Cyber Security Centre of Excellence is planned for Manchester; the government has also unveiled a broader plan for AI. Read together, those programmes aim at the same race the NCSC describes — finding and closing vulnerabilities faster than AI-assisted attackers can exploit them. The NCSC's annual review additionally considers China particularly well positioned to target strategic infrastructure with AI.

AI-assisted intrusions are already documented

There are already signs of what faster attacks look like. In October, CrowdStrike documented the China-linked group Vapor Panda using ARTEX against more than 200 organisations across at least 14 countries, though it confirmed post-exploitation at only nine. Being targeted does not mean being breached, as Cryptopolitan reported. The gap between 200 targets and nine confirmed breaches shows how quickly AI-enabled tooling can scale targeting — and how little targeting alone reveals about how far an intrusion has progressed.

Ransomware groups are also turning to AI to carry out attacks. Sophos found that Aur0ra operators used Cursor and other AI models to gain deeper access to compromised networks. The attackers supplied stolen credentials and identified their targets; AI then helped them explore the networks and obtain administrator privileges with little human supervision.

The results point to AI improving existing hacking methods rather than creating new ones. Red Canary reached the same conclusion, stating that attackers are hacking systems more quickly in known ways using AI instead of developing novel techniques. According to CrowdStrike's 2026 threat report, the problem is getting worse: the number of AI-enabled attacks increased by 89% in 2025.

Who sells the shovels when everyone starts digging

The growing threat comes as companies prepare to spend more on AI cybersecurity. Gartner forecasts global spending of $51.3 billion in 2026, rising to $86 billion in 2027. Cryptopolitan's calculations show that AI cybersecurity accounts for just 1.9% of total projected AI spending in 2026, up from 1.5% in 2025 — meaning only a small slice of the AI boom is currently aimed at defending against the risks officials are flagging.

Cybersecurity concerns are growing worldwide. A World Economic Forum survey found that 87% of respondents saw AI-related vulnerabilities as the fastest-growing cyber risk in 2025, while 94% expected AI to have the greatest impact on cybersecurity in the coming year. These findings show how seriously organisations view the threat, although they do not measure actual attacks. Gartner's spending forecasts were released before the NCSC's November 3 warning.

Can defenders patch faster than attackers exploit

But spending more on cybersecurity does not automatically make critical infrastructure safer. Britain's Cyber Shield and the NERV centre could help organisations identify vulnerabilities sooner; fixing them is another challenge. Operators still need money, skilled workers, and time to upgrade ageing systems. The NCSC warns that older infrastructure could remain vulnerable as AI makes attacks faster and cheaper — a serious problem for essential services already struggling with limited budgets. How quickly the new funding translates into faster scanning and patching, and whether the planned Manchester centre of excellence becomes operational, will be the near-term markers of Britain's readiness within the NCSC's two-year window. The question now is whether defenders can fix vulnerabilities before attackers exploit them.