NCSC Annual Review: AI Malware "Highly Likely" in a UK CNI Ransomware Attack

The UK’s National Cyber Security Centre has put a date range on a risk for UK critical infrastructure. In its Annual Review 2026, published on 3 November, the NCSC says it is highly likely that between now and 2028, AI-powered malware will have been used in a ransomware attack on UK critical national infrastructure (CNI). The wording is a forecast. The review does not describe such an attack as having happened.

What the assessment actually says

The headline sits in the review’s chapter on the cyber threat to the UK, and is restated, without the date range, on a separate page of key judgements on the impact of AI. The framing is more measured than the headline suggests. The NCSC says AI is unlikely to change the goals of hostile actors but highly likely to increase the speed, scale and efficiency with which they operate. It also says AI will highly likely be folded into existing attack methods “rather than autonomously conducting end-to-end attacks”, and that human operators highly likely remain essential for directing and validating AI output. The NCSC’s incident team adds that it has begun to see threat actors incorporating AI tools into attacks, and that none of the observed uses enabled a novel class of attack.

Other judgements on the same page:

• AI-assisted vulnerability discovery and exploit development will highly likely pose a significant threat, giving attackers more chances to hit systems before they are patched. Defenders face a race to shorten patch timelines.
• China highly likely has the intent and is best positioned to use AI against CNI and other strategic targets.
• Open source AI tools built for security researchers are likely to be repurposed by criminals to orchestrate and automate existing workflows.
• ”Shadow AI” will highly likely leave organisations open to exploitation, because staff move sensitive data onto personal devices and the organisation loses sight of who can access it.
• Adoption among threat actors “remains uneven”, and skilled operators see the biggest gains.

The pessimistic 2028 scenario

A separate page, “The age of autonomous attack”, sketches one plausible bad outcome. In it, frontier AI capability is available to everyone from states to novices, attribution gets harder, and China “has likely played a role in disseminating advanced capability to other actors”. The NCSC adds that an automated cyber actor no longer under its operator’s control is a “realistic possibility” that could self-replicate and attack “at will, with no apparent motivation or restraint”.

The review is explicit that this is a scenario, and that its purpose “is not to predict the future”. It is a useful read mostly for what it says about attribution: if an uncontrolled agent causes damage, intentional harm by adversaries becomes more deniable.

The defensive side

The review is not all warning. Two programmes stand out. Project DROMOS, run by the Government Cyber Coordination Centre with the AI Security Institute, began as a four-week pilot using frontier models to review government code repositories, then expanded to selected government environments, where participating organisations used AI-assisted analysis to uncover hundreds of potential security issues, including critical vulnerabilities. Human oversight and false-positive handling were built into the process.

In our view Cyber Shield is the bigger bet: it is a five-year effort to build an agentic cyber defence ecosystem, with the NCSC feeding data to defensive agents inside UK organisations and consuming their signals. The first stage focuses on detection and blocking. The NCSC notes that some of the automated defensive actions needed for more proactive protection remain outside many organisations’ risk tolerances today, and that the open question is how defenders can trust an automated fix not to cause disruption.

Reading it

Our assessment: the useful part for practitioners is less the 2028 date than the pairing of two judgements. Attackers get faster at finding flaws, and defenders must shorten patch timelines in response. NCSC CEO Richard Horne’s foreword makes the same point from the other side: AI “did not create these cyber security weaknesses; it revealed them”, citing years of deferred technology investment.

The ransomware judgement is a probability statement from the NCSC, and we have no independent evidence for or against it. We found no AI-malware ransomware attack on UK CNI described in the review itself, as of 4 November 2026.

References

• NCSC — Annual Review 2026: The impact of AI on cyber threat
• NCSC — Annual Review 2026: The cyber threat to the UK
• NCSC — Annual Review 2026: The age of autonomous attack
• NCSC — Annual Review 2026: Project DROMOS
• NCSC — Annual Review 2026: Cyber Shield
• NCSC — Annual Review 2026: Incident management
• NCSC — Annual Review 2026: Foreword, Richard Horne