# NCSC: AI Malware Attack on UK CNI Within 2 Years [2026] > Source: > Published: 2026-11-03 03:56:25+00:00 The National Cyber Security Centre (NCSC), a part of GCHQ, [published a warning on 3 November 2026](https://www.ncsc.gov.uk/sites/default/files/2026-11/Cyber-chief-UK-facing-AI-powered-attacks-on-critical-infrastructure-within-two-years.pdf) that it is “highly likely” that AI-powered malware will be used in a ransomware attack on UK critical national infrastructure (CNI) between now and 2028. The line is a likelihood assessment, not a report of an incident. It still lands hard, because it comes from the agency that defends the networks behind power, transport, health and telecoms. The assessment appears in the NCSC report *State of the Cyber Nation*. The agency also says hostile use of AI will raise the scale and efficiency of ransomware, social engineering and vulnerability exploitation within two years. Richard Horne, the head of the NCSC, framed the problem as old weaknesses meeting new speed. Industry voices have made a similar argument, and we examined it in [Altman: AI Exposes Flaws, Oracle Patches 3,000](https://shattered.io/sam-altman-ai-not-creating-problem-oracle-3000-patches-2026/). This analysis sorts what the NCSC confirmed from what it did not. It walks through the three attack levers the agency names, the legacy-technology problem, the market consequences, a short comparison of attacker and defender advantages, five predictions and a seven-question FAQ. Wherever the official material is silent, we say so rather than fill the gap. The story about AI-powered malware in the UK is serious enough without embellishment. Don't miss new tech stories on Google Add Shattered once in the Google app and our stories show up in your news suggestions. [Add now](https://www.google.com/preferences/source?hl=en&q=https%3A%2F%2Fshattered.io%2F) ## The NCSC Warning on AI-Powered Malware, in Plain Terms The NCSC released *State of the Cyber Nation* on 3 November 2026. Its headline judgment is that AI-powered malware will, in the agency’s words, “highly likely” feature in a ransomware attack on UK critical national infrastructure before the end of the forecast window in 2028. The report ties that judgment to a broader claim. Hostile actors who use AI will hit harder and faster, and they will do it across the full attack chain, from the first phishing message to the final encryption routine. Two points deserve emphasis. First, the NCSC does not name a malware family, a vendor, a model or a threat group. Second, it does not name a specific power station, airport or hospital. The warning describes a category of risk across UK CNI. That framing is typical of government threat assessments, which aim to move budgets and board agendas rather than to point at a single target. | NCSC judgment | Time window | Confidence wording | Scope | |---|---|---|---| | AI-powered malware used in a ransomware attack | Between now and 2028 | Highly likely | UK critical national infrastructure | | Hostile AI raises scale and efficiency of ransomware, social engineering and vulnerability exploitation | Within the next two years | Highly likely | UK-wide threat picture | | Russia, China and other states routinely use AI-cyber for geopolitical goals | By 2028 | Highly likely | State-backed activity | | AI applied to known vulnerabilities in legacy CNI technology | By 2028 | Likely | Legacy CNI systems | | AI applied to new attack surface created by AI tools inside CNI | By 2028 | Likely | CNI that deploys AI | | Publication | 3 November 2026 | Not applicable | NCSC, part of GCHQ | Computer Weekly summarised the warning under the headline [UK to face AI-powered cyber attacks within two years, warns NCSC](https://www.computerweekly.com/news/366653412/UK-to-face-AI-powered-cyber-attacks-within-two-years-warns-NCSC). The two-year framing matters for planners. It turns an abstract forecast into a budget-cycle problem, because most infrastructure operators set capital plans on a one-to-three-year horizon. ## What “Highly Likely” Means for Risk Planners “Highly likely” sits at the confident end of the calibrated language that intelligence-style assessments use. It tells readers the agency considers the outcome far more probable than not. It does not say the event is certain. The NCSC material available at publication attaches no percentage to the phrase, so we will not invent one here. The distinction between a likelihood and an event is the first thing executives should absorb. No AI-powered ransomware attack on UK CNI has been confirmed in the official material. The NCSC is telling operators to plan for a case that it expects to happen, not describing one that already did. That is a useful warning because it arrives while defenders still have time to act. It is also easy to misread, which is why headlines that imply a completed attack deserve scepticism. For a chief information security officer, the practical reading is simple. Treat the 2028 window as a deadline for closing known gaps. Treat the confidence wording as a signal that the board should fund the work now rather than after the first incident. If the forecast proves too pessimistic, the money still buys patched systems and tested backups. If it proves accurate, the same money decides how long an outage lasts. ## Richard Horne: Old Flaws, New Speed Horne’s central argument is that AI does not hand attackers a new playbook. It hands them a faster way to exploit the old one. As [U.S. News reported](https://www.usnews.com/news/world/articles/2026-11-02/uk-must-expect-ai-powered-attack-on-critical-infrastructure-within-two-years-report-says), he said: “But we must be clear that is not because AI has invented new ways to attack us, but because vulnerabilities that have been tolerated for far too long can now be discovered and exploited at a scale that was once unimaginable.” That sentence carries the whole report. It shifts blame away from exotic technology and toward long-standing neglect. A flaw that sat unexploited for years because nobody had the time to find it becomes a target once automated tools can scan, test and chain weaknesses around the clock. The attacker’s cost per attempt falls. The defender’s backlog does not shrink on its own. Horne also stressed why infrastructure is different from an ordinary corporate network. In coverage carried by [NewsPressNow](https://www.newspressnow.com/news/world_news/uk-cyber-chief-says-the-uk-will-face-ai-cyberattacks-on-critical-infrastructure-by-2028/article_3ef2ada5-87fd-5758-a370-367efe2730b7.html), he said: “Technology underpins the automation of physical processes that are vital to modern life.” When ransomware hits an office network, staff lose email. When it reaches systems that control physical processes, the cost moves from lost productivity to disrupted services. ## Why Legacy CNI Technology Is the Soft Target The NCSC says attackers are likely to apply AI against known vulnerabilities in legacy CNI technology. It also names a second opening: the attack surface created when operators deploy AI tools inside their own environments. Those two sentences describe the pincer that infrastructure defenders now face. ### Known vulnerabilities that stay open for years Operational technology ages differently from office IT. A controller installed to run for decades cannot be rebooted on a Tuesday afternoon. Vendors may have stopped issuing patches long ago. Many operators wrap such systems in network segmentation and hope the perimeter holds. AI-assisted tooling attacks that assumption by making it cheaper to probe every reachable device for every documented flaw. The OT world already shows what that looks like. On 2 November, The Register reported on a max-severity bug in a widely used OT programming tool that attackers exploited to deliver Linux malware. That report is separate from the NCSC warning, and nothing in the official material links the two. It does illustrate the pattern the agency describes: a known flaw in industrial tooling, picked up by attackers with working exploit code. ### AI tools inside CNI as a new attack surface The second half of the NCSC’s concern is self-inflicted. Operators are adding AI assistants, anomaly detectors and automation agents to control rooms and back offices. Each addition brings credentials, data flows and model integrations that attackers can target. We covered one angle of this in [20+ Hear Iowa State Expert on AI Grid Defense](https://shattered.io/iowa-state-govindarasu-penn-state-lecture-ai-power-grid-security-2026/), which looked at how AI both protects and exposes power systems. The lesson is not to avoid AI. It is to treat every AI deployment in a CNI setting as a new system with its own threat model. If an operator would not connect an unreviewed third-party service to a control network, it should not connect an unreviewed AI agent either. ## Ransomware, Social Engineering and Vulnerability Exploitation The NCSC singles out three activities where hostile AI use is highly likely to raise scale and efficiency over the next two years. Each one targets a different stage of an intrusion, and together they cover most of what a ransomware crew does. **Ransomware.** Ransomware groups already run like businesses, with affiliates, negotiators and leak sites. AI lets them automate the tedious parts: reconnaissance, tailoring payloads to a victim’s environment and drafting extortion notes. The NCSC judgment that AI-powered malware will feature in a CNI attack follows from that economics. A smaller crew can run more intrusions at once. **Social engineering.** Phishing quality used to depend on the attacker’s language skills and patience. Generative models remove both limits. Messages can match a target’s role, tone and local references, and they can arrive in volume. The first foothold in many CNI breaches is still a human who clicked, so any gain here compounds through the rest of the chain. **Vulnerability exploitation.** This is the lever Horne emphasised. Finding flaws used to take specialist time. AI-assisted analysis shortens it, and defenders feel the pressure in patch volumes. Our report on [AI Bug Flood: Microsoft Ships 1,461 Patches](https://shattered.io/ai-found-bugs-flood-microsoft-1461-patches-silicon-valley-2026/) shows how much remediation work a single vendor can generate when bug discovery speeds up. For a utility running thousands of assets from many vendors, that arithmetic is punishing. ## Nation-States and AI-Cyber by 2028 The NCSC also judges that, by 2028, it is highly likely Russia, China and other nation states will routinely use AI-cyber capabilities to pursue geopolitical goals. The word “routinely” is the important one. It describes AI becoming an ordinary part of state operations rather than a headline experiment. State actors differ from criminals in patience and purpose. A ransomware crew wants a payout and moves on. A state service may want persistent access it can use during a crisis. The NCSC’s accompanying review of a decade of cyber threats says critical infrastructure and government institutions continue to attract state actors. AI does not change those motives. It lowers the effort needed to maintain access across many networks at once. One caution is in order. The NCSC does not attribute any specific AI-powered attack to a named state in the material available at publication. The forecast concerns capability and routine use, not a particular campaign. Readers should be wary of any coverage that treats the warning as proof of an ongoing state operation. ## What Remains Unconfirmed A fast-moving security story attracts rumour. The table below separates what the official material supports from what it does not. We reviewed the NCSC publication and the coverage linked in this article. | Claim | Status | What the available material shows | |---|---|---| | NCSC published the warning on 3 November 2026 | Confirmed | NCSC publication, part of GCHQ | | AI-powered ransomware on UK CNI is “highly likely” by 2028 | Confirmed as an assessment | A likelihood judgment in *State of the Cyber Nation* | | Such an attack will definitely happen by 2028 | Unconfirmed | The wording is a likelihood, not a confirmed event | | A named malware family or product is involved | Unconfirmed | No malware, company, model or attacker is identified | | Specific power stations, airports or hospitals will be hit | Unconfirmed | The material refers generally to UK CNI | | AI invents wholly new attack methods | Disputed by the NCSC chief | Horne says the issue is scale of exploitation, not new methods | The unconfirmed rows matter as much as the confirmed ones. A reader who sees a viral post naming a particular hospital or grid operator as the next target should treat it as unsupported. The NCSC has not said that, and no outlet in the sources we reviewed reports it. ## Market Impact: Who Spends, Who Sells, Who Pays The NCSC material available at publication carries no spending figure, so any market-size number attached to this warning is the commentator’s own. We will not supply one. We can still map where the money is likely to move, and label it as analysis. **Operators.** Utilities, transport bodies and health trusts face a replacement-versus-protect decision on legacy systems. Ripping out old controllers is expensive and slow. Wrapping them in monitoring, segmentation and tested recovery is cheaper in the short term. Expect most to do the second while lobbying for money to do the first. **Security vendors.** Firms that sell OT visibility, vulnerability prioritisation and [incident response](https://shattered.io/category/security/) gain a government-endorsed sales argument. Vendors of AI-driven defence will pitch themselves as the answer to AI-driven attack. Buyers should ask for evidence of results in industrial settings, since a tool built for office endpoints may behave poorly on a control network. **Insurers.** Cyber insurers will read the NCSC warning as a reason to tighten questions on patching, backups and segmentation. Operators that cannot show tested recovery may face higher premiums or narrower cover. That pressure often changes behaviour faster than regulation does. **AI vendors.** Model providers face scrutiny over misuse. If the forecast materialises, expect louder calls for abuse monitoring and access controls on cyber-capable models. For our wider coverage of the sector, see the [security section](https://shattered.io/security/). ## 2026 Evidence: The Pattern Behind the Forecast The NCSC forecast does not arrive in a vacuum. Our 2026 coverage already tracks the ingredients the agency describes: heavy patch loads, weak points in connected devices and a steady stream of data breaches. The table collects headline figures from earlier shattered.io reports. They are not NCSC data and do not describe UK CNI directly. They show the conditions in which the warning lands. | Earlier shattered.io report | Headline figure | Relevance to the NCSC warning | |---|---|---| | AI Bug Flood | Microsoft shipped 1,461 patches | Faster bug discovery raises patch workload | | Altman on AI exposing flaws | Oracle patched 3,000 issues | Vendors face the same flood of findings | | AI-generated code security | Opus 5.5 and GPT-6-Sol tied at 73% | AI-written code still carries security risk | | Healthcare data governance | 78.6M records breached in 8 months | Health is a sector the NCSC review flags for ransomware | | Supermarket freezer attacks | 7 countries affected | Cyberattacks reaching physical cold-chain systems | | Delhaize fridge attack | 40 stores hit | Connected equipment as an attack path | | Azure Kubernetes flaw | CVSS 10.0 | Maximum-severity cloud flaws exist alongside legacy risk | The freezer story is the closest analogy to the NCSC concern. In [Freezer Hacks Span 7 Countries: 5 Lessons](https://shattered.io/supermarket-freezer-cyberattacks-seven-countries-five-lessons-2026/), we looked at attacks that moved from IT systems into equipment that keeps food cold. That is a small version of the infrastructure problem. Once a digital break-in reaches a physical process, the damage is measured in spoiled stock or stopped services rather than stolen files. ## Attackers Versus Defenders: A Competitive Comparison AI helps both sides, but the gains are uneven. The NCSC framing suggests attackers benefit first from cheap scale, while defenders benefit from context they alone possess. The comparison below summarises the balance, based on the agency’s reasoning and our analysis. - **Speed:** Attackers can scan and test continuously at low cost. Defenders must schedule changes around operational uptime. - **Context:** Defenders know their own assets, network maps and normal behaviour. Attackers must infer them. - **Accountability:** Defenders must follow safety rules, change control and procurement. Attackers answer to nobody. - **Failure cost:** An attacker can fail a hundred times and try again. A defender often needs to be right on every attempt. - **Scale of effort:** A small criminal crew can now do work that once needed a larger team. Defender headcount rarely grows at the same rate. The code-quality dimension also cuts both ways. In [AI Code Security: Opus 5.5, GPT-6-Sol Tie at 73%](https://shattered.io/ai-generated-code-security-veracode-claude-opus-5-5-gpt-6-sol-73-percent-2026/), we covered a Veracode test where two leading models scored the same on code security. Models that write code for defenders can introduce flaws, and models that write code for attackers can find them. Neither side gets a clean advantage from the technology alone. ## Historical Context: From Profit Ransomware to State Pre-Positioning The NCSC is part of GCHQ, and its annual review of a decade of cyber threats sets the backdrop for this forecast. According to that review, UK telecommunications and healthcare organisations have faced high-profile ransomware attacks aimed at financial gain. It also says critical infrastructure and government institutions continue to be targeted by state actors. Two threat types, criminal and state-backed, have shared the same infrastructure for years. What changes in 2026 is the production model. Earlier ransomware waves depended on skilled operators doing manual work inside each victim. The NCSC now expects AI to cut that labour, which lets criminals and states alike widen their reach without growing their teams. The agency’s wording suggests continuity of threat with a step change in volume. The historical lesson for operators is uncomfortable. The weaknesses AI will exploit are not new. They are the ones that reviews, audits and earlier warnings already flagged. Horne’s phrase about vulnerabilities “tolerated for far too long” is, in effect, a verdict on a decade of deferred maintenance. ## What CNI Operators Can Do in the Next 90 Days The NCSC warning gives operators a two-year runway, but the first quarter sets the pace. The steps below follow directly from the agency’s concerns about legacy technology and new AI attack surface. They are practical suggestions from us, not NCSC instructions. 1. Inventory every asset that touches a physical process, including its software version and vendor support status. 2. Rank known vulnerabilities in legacy systems by exposure, not only by severity score. 3. Segment control networks from corporate IT and verify the segmentation by testing, not by diagram. 4. Run a restore drill from offline backups and record how long it takes. 5. List every AI tool deployed or piloted, with its data access and credentials. 6. Train staff on AI-written phishing, with examples that match your sector. A simple risk register keeps the work visible to the board. The template below is illustrative, and teams should adapt the fields to their own governance model. ``` asset: boiler-controller-07 owner: plant-operations vendor_support: ended known_vulns: open network_segment: ot-zone-b ai_tools_with_access: none last_restore_test: 2026-10-14 decision: protect-now / replace-by-2027-budget ``` The register matters because it forces a decision on each legacy asset. “Protect now, replace later” is a legitimate choice, provided someone signs for it and a date is attached. ## Five Predictions for 2027 and 2028 These are our own judgments, drawn from the NCSC assessment and the market conditions above. They are not NCSC forecasts and no named expert endorses them. 1. **Operators will fund asset inventories first.** Visibility is the cheapest step and the one every other control depends on. Expect budget requests to lead with it. 2. **Insurers will add AI-specific questions.** Underwriting forms will probably ask how organisations govern AI tools and how fast they patch known flaws. 3. **Patch backlogs will grow before they shrink.** If AI keeps speeding up bug discovery, vendors will ship more fixes, and operators with constrained maintenance windows will fall behind. 4. **Disclosure of AI involvement will stay vague.** Even if an attack occurs, proving that AI tooling drove it is hard. Public reports may describe AI use cautiously or not at all. 5. **Regulators will press on supply chains.** Small suppliers to CNI operators are the easiest way in, so expect more demand for evidence of baseline security from them. The first and fifth predictions are the most likely to hold, because they follow existing regulatory habits. The fourth is the most uncertain, since it depends on how forensic teams choose to describe future incidents. ## How the Story Was Reported Several outlets carried the warning on 2 and 3 November. Computer Weekly and U.S. News led with the two-year timeline. AOL’s syndicated headline put the forecast most bluntly: AI-powered malware “highly likely” to be used to hack UK infrastructure by 2028. The headline compresses the NCSC wording, and readers should remember it describes an assessment of likelihood. The Record from Recorded Future News took a different angle, with the headline [UK faces ‘unprecedented rise’ in cyberattacks in coming months, warns cyber chief](https://therecord.media/uk-ncsc-predicts-rise-cyberattacks-coming-months). That framing focuses on Horne’s near-term warning rather than the 2028 horizon. Comparing the coverage shows how the same publication can yield two stories: a long-range forecast about AI-powered malware and a nearer-term alert about incident volumes. For readers, the safest practice is to go to the primary source. The NCSC publication is the authority on what was assessed and how confidently. Secondary coverage is useful for context, but only the agency’s own wording settles disputes about what it claimed. ## Frequently Asked Questions **What did the NCSC say about AI-powered malware?** The NCSC, part of GCHQ, said on 3 November 2026 that it is highly likely AI-powered malware will be used in a ransomware attack on UK critical national infrastructure between now and 2028. The warning appears in its report *State of the Cyber Nation*. **Has an AI-powered ransomware attack on UK infrastructure already happened?** The official material does not confirm one. The NCSC statement is a forecast. It tells operators to prepare for an event it considers highly likely, not to react to one that has occurred. **Which malware or company is behind the threat?** None is named. The available NCSC material identifies no malware family, company, software model or individual attacker. **Which sites will be targeted?** Unconfirmed. The material refers to UK critical national infrastructure in general and names no power station, airport or hospital. **What did Richard Horne say?** Horne, the head of the NCSC, said AI could allow vulnerabilities that have been tolerated for far too long to be discovered and exploited at a scale that was once unimaginable. He argued the problem is scale of exploitation, not new attack methods. **What does the NCSC expect from Russia and China?** It judges that by 2028 it is highly likely Russia, China and other nation states will routinely use AI-cyber capabilities to pursue geopolitical goals. **What should infrastructure operators do first?** Start with an asset inventory and a check of legacy systems with known vulnerabilities, because the NCSC expects attackers to use AI against those. Then verify network segmentation, test backup restores and review any AI tools already deployed inside the environment.