AI-powered malware ‘highly likely’ to be used to hack UK infrastructure by 2028

* AI-powered malicious software is highly likely to be used in hacking attacks against the UK’s power stations, airports, and hospitals by 2028.
* The National Cyber Security Centre (NCSC) stated that AI will probably enable a ransomware attack against Critical National Infrastructure (CNI) between now and 2028.
* The UK’s CNI covers facilities and services across energy, transport, defence, food, health, and finance.
* Ransomware involves encrypting files with malicious software and demanding cryptocurrency for release of data.
* UK ransomware victims include Royal Mail, Capita, and various public bodies, including councils.
* AI is expected to assist attackers in scouting targets, locating IT network weaknesses, and writing malicious code.
* A professor noted that AI can help find and patch flaws in systems, but access is necessary to prevent bad actors from exploiting them first.
* Communications networks used by the British military are subjected to persistent and sustained daily attacks.
* Cyber-attacks on European supermarket fridges have raised temperatures above 50C, serving as a warning regarding cyber resilience.

The narrative connects a technological advancement—AI capability—directly to an imminent, tangible threat against foundational national infrastructure, framed by historical patterns of state-sponsored conflict and criminal opportunism. The core tension lies between the accelerating defensive capabilities (AI for vulnerability detection) and the adversarial application of that same technology (AI for attack generation). The implication is a race where access dictates security; if entities do not secure access to advanced AI tools, they become passive targets against vulnerabilities that the AI can rapidly expose. This raises critical questions about equitable access to necessary defense technologies and whether current defensive investments are adequate when adversaries operate with this level of technological leverage. The reference to past complacency regarding technology costs suggests a systemic failure in prioritizing resilience over cost efficiency, creating an environment ripe for exploitation.
What happens when the ability to detect flaws is decoupled from the speed of remediation? How does the focus on state-level threats (Russia/China) interact with the impact felt by public and commercial entities suffering ransomware? If vulnerabilities are being found faster than they can be patched, what shifts in responsibility occur regarding the deployment of advanced AI tools for defense versus offense?