UK Warns AI-Powered Cyberattacks Could Hit Critical Infrastructure by 2028 — What the Forecast Means

Britain’s cyber-security agency is warning that artificial intelligence could make attacks on essential services faster and more disruptive within two years. The warning is a forecast of risk—not a report that a nationwide AI-driven shutdown has already happened.

What the warning actually says

In reporting published on November 3, 2026, Reuters and the Associated Press describe a new assessment from the UK’s National Cyber Security Centre (NCSC): AI-powered malware is considered highly likely to feature in a ransomware attack on critical national infrastructure by 2028. NCSC chief executive Richard Horne argues that criminals and hostile states can use AI to identify exposed systems and exploit neglected weaknesses at greater speed and scale.

The distinction matters. This is not a claim that AI has invented an entirely new class of attack. The agency’s concern is that familiar methods—reconnaissance, social engineering, vulnerability discovery and malicious-code development—may become cheaper and more effective. An earlier NCSC assessment on AI and cyber threats similarly anticipated an amplification of established techniques rather than entirely novel threat vectors.

Why ordinary people could feel the effects

Critical infrastructure is not limited to government databases. It includes the systems that support electricity, water, transport, manufacturing and food distribution. A successful intrusion into a supplier, maintenance contractor or ageing operational system can have consequences far beyond the initial victim. But the severity of any incident depends on its specific target, available safeguards and recovery capacity; a forecast is not proof of an inevitable blackout.

The warning follows reports of cyber incidents involving European supermarket refrigeration systems. Those cases illustrate the possibility of digital disruption affecting physical services, but they should not be presented as evidence that the projected 2028 AI-powered ransomware scenario has already occurred.

What organisations can do now

The practical lesson is less futuristic than the headline might suggest. Operators need accurate inventories of internet-facing assets, prompt security updates, restricted privileged access, network segmentation where appropriate, tested offline backups and rehearsed recovery plans. Smaller suppliers matter too: attackers may exploit a weaker partner rather than directly attacking a well-defended utility.

AI also offers defenders useful capabilities, including anomaly detection, triage and vulnerability analysis. The contest is therefore not simply humans against autonomous software; it is about whether defenders can adopt protective technology and repair longstanding weaknesses before attackers exploit them.

Illustrative image: data-centre servers, photograph by imgix / Unsplash. Not a photograph of an actual attack.