NCSC warns AI-powered malware could target UK critical infrastructure by 2028
The UK National Cyber Security Centre (NCSC) has warned that AI-powered malware could be used to attack critical infrastructure by 2028. Its 2026 annual review describes such use as “highly likely,” reflecting concern that artificial intelligence may strengthen offensive cyber capabilities.
The assessment focuses on the potential for AI to enhance malware and hacking operations aimed at essential UK systems. It does not represent a confirmed attack or a specific forecast of when or how an incident will occur, but signals that infrastructure operators may need to prepare for AI-assisted threats within the stated timeframe.
As malicious and defensive uses of AI continue to develop, the warning underlines the need for organizations to treat AI-enabled cyber capabilities as an emerging component of critical-infrastructure risk. The NCSC’s assessment suggests that security planning and readiness will increasingly need to account for malware that uses AI to operate more effectively.