November 3, 2026 — The United Kingdom’s National Cyber Security Centre (NCSC) has warned that AI-powered malware is highly likely to be used in a ransomware attack against the country’s critical national infrastructure by 2028.
The warning, published on November 3 as part of the NCSC’s State of the Cyber Nation assessment, highlights a growing concern among security officials: artificial intelligence could allow cybercriminals and state-backed attackers to exploit existing security weaknesses much faster and at a significantly greater scale.
The agency is not reporting that such an attack has already occurred. Instead, it is urging organizations responsible for essential services to prepare for an increasingly dangerous cyber threat environment.
What Did the UK’s Cybersecurity Agency Warn About?
The NCSC, which operates as part of Britain’s intelligence agency GCHQ, says hostile actors are likely to use artificial intelligence to make several established forms of cybercrime more effective over the next two years.
These include:
- Ransomware attacks that encrypt or disrupt computer systems.
- Social engineering designed to deceive employees and gain unauthorized access.
- Faster identification and exploitation of software vulnerabilities.
- Cyber operations targeting essential services and their suppliers.
The agency’s central warning is specific: it assesses that AI-powered malware will highly likely feature in a ransomware attack against UK critical national infrastructure by 2028.
That assessment does not mean officials know when an attack will happen, which organization will be targeted, or who will be responsible.
Rather, the NCSC believes the combination of increasingly capable AI tools and longstanding security weaknesses makes this scenario sufficiently likely to warrant immediate preparation.
Why Artificial Intelligence Could Make Cyberattacks More Dangerous
One of the most important points in the NCSC’s warning is that AI does not necessarily give attackers entirely new methods of breaking into systems.
Instead, it can make familiar methods faster, easier to scale and more accessible.
Faster discovery of security weaknesses
Many organizations still depend on outdated software, poorly maintained systems or infrastructure that was not originally designed to withstand modern cyber threats.
Attackers have long searched for these weaknesses. AI-assisted tools could help them analyze information, identify potential targets and prioritize vulnerabilities more efficiently.
For defenders, this could reduce the time available to identify and repair exposed systems before attackers attempt to exploit them.
More scalable ransomware operations
Ransomware is already a serious threat to businesses and public services.
AI could help attackers automate parts of their operations, allowing them to pursue more potential victims without increasing their resources at the same rate.
However, the existence of AI-assisted cybercrime does not mean every attack is autonomous or that AI can reliably compromise any system.
Human expertise, access to vulnerable infrastructure and the specific defenses of a target remain important factors.
More convincing social engineering
Artificial intelligence can also help produce convincing phishing messages and other deceptive communications.
An attacker may use AI to tailor messages to particular employees, organizations or industries, potentially increasing the effectiveness of attempts to steal credentials or gain access to internal systems.
These threats make employee awareness, strong authentication and well-designed access controls especially important.
What Counts as Critical National Infrastructure?
Critical national infrastructure includes the systems and services that a country depends on for everyday life and economic activity.
Examples include electricity, water, transport, communications and other essential operations.
A serious cyber incident affecting one of these sectors could have consequences beyond the organization initially targeted.
For example, disruption to an important supplier or technology provider could affect multiple businesses or services that depend on it.
The NCSC’s warning is therefore not limited to organizations that directly operate power stations or water facilities.
Businesses supplying software, maintenance, logistics and other services to critical infrastructure operators may also form part of the wider security picture.
NCSC Raises Concerns About State-Backed Cyber Operations
The November 3 warning also addresses cyber threats associated with foreign governments.
According to Reuters, NCSC chief executive Richard Horne identified China as the country the agency considers best positioned to use AI in operations targeting British critical infrastructure and other strategic assets.
The agency also raised concerns about Russian attempts to access UK military networks and malicious Iranian cyber activity.
These are assessments and allegations attributed to British security officials, not independently established findings that any of those governments carried out the specific AI-powered ransomware attack described in the 2028 forecast.
Reuters noted that China, Russia and Iran have previously denied similar accusations of malicious cyber activity.
The distinction matters: a warning about a country’s capabilities and possible intentions is not evidence that a particular future attack has already been planned or launched.
Why the Warning Matters Beyond the United Kingdom
Although the NCSC’s assessment focuses on Britain, the underlying security problem is relevant to organizations around the world.
Many countries face similar challenges, including aging technology, complex supplier networks, internet-connected industrial systems and shortages of cybersecurity resources.
AI could increase the pressure on these environments by making it easier for attackers to identify weaknesses at scale.
The report also highlights a broader change in how artificial intelligence is affecting cybersecurity.
AI is not only a tool for writing, research or software development. It is increasingly relevant to both cyber defense and malicious activity.
That dual-use challenge has already become visible in the AI software ecosystem. Radavora previously covered the security implications of a malicious Claude Code-branded extension distributed through the Cursor marketplace — a separate incident illustrating why developers and organizations must carefully evaluate the software they install.
Editor’s note: The extension article link should only be used if that exact Radavora URL is published and accessible.
What Should Organizations Do Now?
The NCSC is urging organizations to address longstanding security weaknesses rather than wait for a major AI-enabled attack.
Several established cybersecurity practices remain especially important.
1. Update and maintain essential systems
Organizations should identify unsupported software, outdated operating systems and known vulnerabilities in important infrastructure.
Security updates and well-planned replacement programs can reduce the number of weaknesses available for attackers to exploit.
2. Reduce unnecessary exposure
Not every operational system needs to be directly accessible from the internet.
Reviewing network connections, separating sensitive environments and limiting unnecessary remote access can make attacks more difficult.
3. Strengthen identity and access security
Multi-factor authentication, restricted administrator privileges and careful management of employee accounts can reduce the damage caused by stolen credentials.
4. Prepare for ransomware incidents
Organizations should maintain appropriate backups, test recovery procedures and establish clear incident-response responsibilities.
The ability to restore essential services can be as important as preventing the initial intrusion.
5. Review third-party security risks
Suppliers, contractors and technology partners may have access to systems or information that attackers could exploit.
Critical infrastructure operators should understand these dependencies and include them in security planning.
These measures cannot eliminate every risk, but they address many of the weaknesses that the NCSC says AI could make easier to exploit.
The UK Is Also Investing in AI-Powered Cyber Defense
The warning comes alongside new British government initiatives intended to strengthen national cybersecurity.
According to the NCSC’s November 3 announcement, recently announced measures include £60 million for the first phase of a national Cyber Shield and £70 million for a National Exposure and Real-Time Vulnerability (NERV) Centre.
The government also plans an AI Cyber Security Centre of Excellence in Manchester.
These initiatives reflect another important side of the story: artificial intelligence can help defenders as well as attackers.
Security teams may use AI-assisted systems to identify suspicious activity, prioritize vulnerabilities and analyze large volumes of security information.
The challenge is ensuring that defensive improvements keep pace with the increasing speed and scale of malicious activity.
What Happens Next?
The NCSC’s assessment does not establish that a major AI-powered ransomware attack against British critical infrastructure is inevitable.
It does, however, provide a clear warning about the direction of cyber threats through 2028.
For governments and organizations responsible for essential services, the central question is whether they can strengthen their defenses before attackers become substantially more effective at exploiting existing weaknesses.
The immediate priority is not preparing for an entirely unfamiliar form of cyberattack.
It is fixing known security problems before AI makes them easier to find and exploit.
Sources
- UK National Cyber Security Centre — Cyber chief: UK facing AI-powered attacks on critical infrastructure within two years — November 3, 2026.
- Reuters — UK must expect AI-powered attack on critical infrastructure within two years, report says — November 3, 2026.
- Associated Press — UK cyber chief warns of AI cyberattacks on critical infrastructure by 2028 — November 3, 2026.
Editorial disclosure: This article is based on publicly available government statements and independent news reporting. Radavora did not conduct its own cybersecurity investigation or independently verify classified intelligence assessments.
