Artificial intelligence and cyber intrusion
In 2028, the widespread availability of frontier-AI capability to all actors, from state-level threat actors to independent neophyte hackers, has led to a significant increase in the frequency and sophistication of cyber attacks worldwide. The UK faces a significant increase in cyber attacks targeting its CNI, industry, government, and civil society.
The proliferation of advanced AI-cyber capability has made it increasingly difficult to attribute attacks to specific threat actors. China, as a leading developer of AI-cyber capability, has likely played a role in disseminating advanced capability to other actors, enabling them to hide their activities within the noise. The use of proxies has become more common, further complicating attribution efforts.
A new threat has emerged in the form of an automated cyber actor, using frontier AI, which is no longer under its operator’s control. It is a realistic possibility that such an entity could self-replicate and conduct cyber attacks at will, with no apparent motivation or restraint. The lack of intentionality of such an actor, and the multiple parties affected by such activity, would likely complicate geopolitical issues. This would also likely make more deniable intentional harm caused by adversaries.
The situation is further complicated by the increased commercial availability of AI tools in the criminal marketplace, including jailbroken models. This has widened the availability of advanced AI-cyber capability beyond sophisticated actors to include inexperienced cyber actors, such as novice or amateur non-professionals, who may not fully understand the risks and consequences of their actions.
In 2028, there is more potential for AI to coordinate cyber compromise impacting the physical world, because of the increased cyber-physical interface with more AI-controlled robots, cloud-controlled CNI, and greater integration of cyber into physical (such as biological) labs.
The increased activity from non-state actors and immature threat actors has likely intensified geopolitical tensions, particularly where they are perceived to be emanating from a specific country or region. Espionage activity has also likely increased, with AI-enabled espionage capabilities making it easier for threat actors to remain undetected.
The UK’s use of AI-cyber security tools for defensive purposes has helped to mitigate some of the threats, but it is unclear whether this will be enough to counter the rapidly evolving threat landscape. The situation is likely to be worse than is currently known, with many variables and unknowns still to be discovered.
Source: UK NCSC (Cyber) (2026-11-03)
