Artificial intelligence (AI) is becoming a powerful tool in many industries, but it is also creating new risks for online security. Governments and cybersecurity experts are now warning that countries could use advanced AI technology to carry out more powerful cyberattacks in the coming years.
According to a new warning from the United Kingdom’s intelligence and cybersecurity agencies, China, Russia and other countries are likely to start using AI regularly in cyber operations by 2028. These attacks could become faster, more advanced and harder to stop than many of the cyber threats seen today.
The warning comes from the National Cyber Security Centre (NCSC), which operates under the UK’s intelligence agency, Government Communications Headquarters (GCHQ). The agency says that AI is already helping attackers improve their methods, and its use is expected to grow significantly over the next two years.
The biggest concern is that attackers could use AI to find weaknesses in computer systems, prepare targeted attacks and damage important services. These threats could affect government departments, businesses, hospitals, electricity networks and other important parts of society.
AI Could Make Cyberattacks More Powerful by 2028
The NCSC believes that China, Russia and other state-backed groups will increasingly depend on AI to achieve their political and strategic goals. By 2028, it is considered highly likely that these countries will regularly use AI in cyber operations against the UK.
AI tools can process large amounts of information in a short time. This makes it easier for attackers to study computer networks, identify security problems and find possible ways to enter protected systems.
In traditional cyberattacks, hackers often need a lot of time and technical knowledge to prepare their operations. They may spend weeks studying a target, testing different methods and searching for weaknesses.
AI can make many of these activities faster. It can help attackers understand systems, prepare convincing messages and discover security problems that might otherwise remain hidden.
This does not mean that AI will carry out every part of a cyberattack without human involvement. Instead, attackers are expected to use it as an additional tool to improve their existing methods.
The NCSC has warned that this change could increase both the number and speed of cyber incidents.
China Remains the Biggest Cybersecurity Challenge for the UK
The NCSC has described China as the most sophisticated and sustained cyber threat facing the United Kingdom.
According to the agency, Chinese cyber activity is a major concern because of its technical ability and continued focus on online operations.
China has been accused by Western governments of carrying out cyber activities linked to intelligence gathering, political interests and national security goals. The growing use of AI could make these operations more effective.
With advanced AI systems, attackers may be able to study large networks, collect information and identify weak points more quickly.
The concern is not limited to direct attacks on government departments. Businesses, technology companies and organisations connected to important services could also become targets.
AI could also help attackers prepare messages that look more realistic and are designed for specific individuals. This could make it harder for employees to identify fake emails and other online scams.
The NCSC believes that China is likely to make greater use of these technologies as part of its wider cyber strategy over the next two years.
Russia Could Also Increase Its AI-Based Cyber Operations
Russia is another major concern highlighted in the cybersecurity warning.
The NCSC describes Russia as one of the most aggressive cyber threats facing the UK. It has also warned that Russian cyber campaigns are being used to create pressure and disruption without reaching the level of a traditional armed conflict.
This type of activity is often linked to political disagreements, international tensions and national security interests.
Russia has already been connected to cyber operations targeting important infrastructure in Europe. One example mentioned in the report is an attack on Poland’s electricity network in December 2025.
According to the report, the attack was linked to a Russian security service cyber unit. If the operation had succeeded, around 500,000 people could have been affected by electricity disruption during winter.
This example shows why cyberattacks against important infrastructure are taken seriously by governments.
If attackers gain control of systems responsible for electricity, transport or water supplies, the impact could reach far beyond the digital world.
AI could make such operations easier to prepare by helping attackers find weaknesses and understand how connected systems work.
However, the warning does not mean that every future cyberattack will be successful. Strong security systems and quick responses can still prevent or limit damage.
AI-Powered Ransomware Could Target Important UK Services
One of the most serious concerns raised by the NCSC is the possible use of AI-powered malware in ransomware attacks against the UK’s critical national infrastructure by 2028.
Ransomware is a type of malicious software that blocks access to computer systems or files. Attackers then demand money from the affected organisation to restore access or prevent stolen information from being published.
These attacks can create major problems for businesses and public services.
The NCSC believes it is highly likely that AI-powered malware will be used in a ransomware attack against UK critical infrastructure between now and 2028.
Critical infrastructure includes services and facilities that people depend on every day. These include:
- Electricity and energy networks.
- Hospitals and healthcare services.
- Airports and transport systems.
- Water supply facilities.
- Food production and distribution.
- Financial services.
- Important government systems.
- Manufacturing and industrial facilities.
A successful ransomware attack against any of these areas could affect thousands or even millions of people.
For example, an attack on a hospital could interrupt access to important digital records and medical services. A cyber incident affecting electricity networks could create problems for homes, offices and factories.
Similarly, attacks on food supply systems could affect storage, transport and supermarket operations.
The agency’s warning is a forecast about future risks, not confirmation that an AI-powered ransomware attack has already affected UK critical infrastructure.
How Hackers Are Already Using Artificial Intelligence
AI is not a completely new tool for cybercriminals. Attackers have already started using different AI technologies to improve their online activities.
However, experts believe that the latest AI developments could take these threats to another level.
One common use is gathering information about potential targets. Hackers can use AI to study publicly available information and understand which systems or organisations may have weak security.
AI can also help create phishing messages.
Phishing is a common online scam in which attackers send fake emails, messages or website links to trick people into sharing passwords, banking details or other private information.
Older phishing messages often contained spelling mistakes or strange sentences that made them easy to recognise. Modern AI tools can help criminals write more natural and convincing messages.
This makes it harder for ordinary users and even trained employees to identify fake communications.
Another important use is finding software weaknesses. AI can help security researchers and attackers examine computer code and identify possible problems.
If hackers discover these weaknesses before companies fix them, they may use them to enter systems without permission.
The NCSC says AI is more likely to improve existing hacking techniques and increase their scale rather than create completely new types of security weaknesses.
AI Could Increase the Number of Cyberattacks
One major advantage of AI for attackers is speed.
In the past, hackers often needed large teams of people to research targets, prepare messages and carry out different stages of an operation.
AI can reduce the time needed for several of these tasks.
This could allow cybercriminals and state-backed groups to target more organisations using fewer resources.
For example, attackers may use AI to prepare different phishing messages for thousands of people. Each message could be written according to the target’s job, organisation or interests.
AI could also help attackers study several computer systems at the same time.
As a result, security teams may have less time to identify suspicious activity and respond before damage takes place.
The growing speed of cyber operations is a major reason why cybersecurity agencies are asking businesses and governments to improve their protection.
Outdated Technology Is Creating More Security Risks
The NCSC has also warned that many organisations are not investing enough money in cybersecurity.
Some businesses continue to use old computer systems and software because replacing them can be expensive.
However, outdated technology can create serious security problems.
Older systems may no longer receive important security updates. They may also contain weaknesses that hackers already know how to exploit.
Richard Horne, the head of the NCSC, has warned that organisations can no longer afford to ignore these problems.
He believes that companies and public institutions must take cybersecurity more seriously before attackers begin using AI on a much larger scale.
The concern is that AI could help hackers discover and exploit weaknesses that organisations have ignored for years.
A security problem that previously required weeks of research could potentially be discovered much faster with advanced AI tools.
This means even small weaknesses could become serious risks if organisations fail to fix them.
UK Reports a Growing Number of Cybersecurity Incidents
The latest warning comes at a time when cyber threats against UK organisations are already increasing.
According to the NCSC’s latest annual cybersecurity review, the agency received 1,831 reports of cyberattacks affecting UK organisations during the year covered by the report.
Around 80 incidents were considered nationally significant.
These figures show that cyberattacks are not simply a future concern. Organisations are already dealing with online threats that can affect their daily operations.
The financial impact is also serious.
The NCSC estimates that malicious cyber activity costs UK organisations almost $20 billion every year.
One major example is the cyberattack affecting car manufacturer Jaguar Land Rover in 2025. The incident reportedly caused more than $260 million in direct losses and also affected its suppliers.
This shows that the impact of a cyberattack does not always remain limited to the organisation that was targeted.
When a large company faces serious technical problems, its suppliers, customers and business partners can also suffer.
With AI becoming more advanced, the financial and operational risks could increase further.
Businesses Must Improve Their Cybersecurity
The NCSC is asking organisations across the UK to take immediate steps to protect their systems.
Companies should not wait until a major cyberattack happens before improving their security arrangements.
There are several basic steps that can help reduce risks.
1. Keep Software Updated
Businesses should install security updates as soon as they become available. Software updates often fix weaknesses that attackers could otherwise exploit.
2. Use Strong Passwords
Employees should use strong and different passwords for important accounts. Multi-factor authentication should also be enabled wherever possible.
3. Limit Administrator Access
Not every employee needs full access to company systems. Organisations should only give higher-level access to people who genuinely need it.
4. Back Up Important Data
Regular backups can help businesses recover important information after ransomware attacks or other technical problems.
5. Monitor Computer Networks
Organisations should regularly check their networks for unusual activity. Early detection can help security teams respond before an incident becomes more serious.
6. Replace Outdated Technology
Old devices, operating systems and software that no longer receive security updates should be replaced when possible.
These measures cannot remove every cybersecurity risk, but they can make attacks more difficult and reduce the damage caused by successful incidents.
AI Is Becoming a Challenge for Governments Worldwide
The growing use of AI in cyber operations is not only a problem for the United Kingdom.
Governments around the world are watching how advanced AI tools could change the way cybercriminals and state-backed groups operate.
Countries depend on connected technology for electricity, banking, transport, healthcare, communication and other important services.
As these systems become more connected, the impact of cyberattacks can become more serious.
The challenge is that AI can support both sides. Security teams can use it to detect unusual activity, find weaknesses and respond to threats. Attackers can also use similar technology to prepare more effective operations.
This has created a race between cybersecurity experts and people who want to misuse AI.
Governments and businesses will need to invest in better technology, skilled workers and stronger security policies to stay ahead of these threats.
What Does the Warning Mean for the Future?
The warning from GCHQ and the NCSC highlights how quickly the cybersecurity situation is changing.
China and Russia are expected to use AI more regularly in their cyber operations by 2028. Other state-backed groups and cybercriminals could also benefit from the technology.
The biggest concern is not simply that AI can help hackers create new attacks. It is that the technology can make existing attacks faster, cheaper and easier to carry out on a much larger scale.
Critical infrastructure could face serious risks if organisations continue using outdated systems and fail to address known security weaknesses.
For ordinary people, this could eventually mean greater risks to personal information, online accounts and essential services.
The warning also sends a clear message to businesses and governments: cybersecurity should not be treated as an optional expense.
Organisations need to prepare now rather than wait for a major incident.
Although AI has the potential to improve many parts of modern life, its misuse could create serious problems for national security and public services.
The coming two years will be important as governments work to understand these risks and improve their defences against AI-powered cyber threats.
Frequently Asked Questions (FAQs)
1. What has GCHQ warned about China and Russia?
GCHQ’s cybersecurity centre has warned that China, Russia and other countries are highly likely to use AI regularly in cyber operations by 2028 to support their political and strategic goals.
2. Why could AI make cyberattacks more dangerous?
AI can help attackers find software weaknesses, prepare convincing phishing messages and study computer networks faster. This could increase the speed and scale of cyberattacks.
3. What is the NCSC?
The National Cyber Security Centre is the UK’s main government organisation responsible for helping protect the country against cyber threats. It operates under GCHQ.
4. Could AI-powered ransomware attack UK infrastructure by 2028?
Yes. The NCSC considers it highly likely that AI-powered malware will be used in a ransomware attack against UK critical national infrastructure by 2028.
5. Which country is considered the biggest cyber threat to the UK?
The NCSC describes China as the most sophisticated and sustained cyber challenge facing the UK. Russia is also considered a major and aggressive cyber threat.
6. What is an AI-powered cyberattack?
An AI-powered cyberattack is an online attack in which criminals or other hostile groups use artificial intelligence to improve activities such as finding weaknesses, creating phishing messages or preparing malware.
7. Can AI attacks affect hospitals and electricity networks?
Yes. Hospitals, electricity networks, water facilities and transport systems could become targets because they depend on connected computer systems and digital technology.
8. How can businesses protect themselves from AI cyberattacks?
Businesses should update their software, use strong passwords, enable multi-factor authentication, limit administrator access, monitor networks and keep regular backups.
9. Are AI-powered cyberattacks already happening?
AI is already being used to support different cyber activities, including information gathering, phishing and finding software weaknesses. However, the NCSC’s prediction about AI-powered ransomware against UK critical infrastructure is a future warning.
10. Why is 2028 important in the cybersecurity warning?
The year 2028 is the expected timeframe in which China, Russia and other countries could be routinely using AI in cyber operations, while AI-powered malware is also expected to become part of attacks against important UK infrastructure.
Read Also: check
