Highly likely: AI malware in a ransomware attack by 2028

The UK's National Cyber Security Centre has published an assessment of AI-enabled cyber intrusion and how the threat could look by 2028. It uses the government's probability yardstick, so its words carry defined meanings: highly likely, almost certain, realistic possibility. Its key judgements are stark. By 2028 it is highly likely that Russia, China and other states will routinely use AI-cyber capabilities for geopolitical ends, and almost certain that many systems will remain vulnerable to AI tools that find and exploit weaknesses.

The judgement aimed most directly at defenders concerns infrastructure. The NCSC considers it highly likely that, between now and 2028, AI-powered malware will have been used in a ransomware attack on UK critical national infrastructure, and likely that attackers will apply AI against known vulnerabilities in the legacy technology of critical infrastructure and against the new attack surface created by deploying AI tools inside it. It also notes that cheap, AI-found access lets attackers be less careful about losing a foothold, since replacing it costs little.

The assessment sets out three scenarios: a central one, a pessimistic one in which AI-cyber capability far outstrips the UK's defences, and one in which progress slows and defenders catch up. In the pessimistic case, frontier capability is available to everyone from states to novice hackers, attribution becomes harder, and the NCSC describes as a realistic possibility an automated actor, built on frontier AI, that is no longer under its operator's control and can replicate and attack at will.

On the defenders' side, the central scenario expects AI to shorten the time from zero-day to patched flaw, but only where the tools are configured correctly and widely. The NCSC stresses that the scenarios are plausible possibilities, not predictions, and that the prospect for surprise is high.