The United Kingdom is likely to face artificial intelligence-driven cyberattacks on its critical infrastructure by 2028 as criminals and hostile states increasingly use the technology for malicious activities, Britain's cyber chief has warned.
Richard Horne, head of the National Cyber Security Centre (NCSC), said AI could help hackers develop malware for ransomware attacks and identify and exploit long-standing security weaknesses on an unprecedented scale.
In a speech marking the publication of the NCSC's annual cyber report on Tuesday, Horne warned that outdated technology and inadequate investment in cybersecurity could disrupt essential services and business operations.
He cited recent attacks on refrigeration systems in French supermarkets, where hackers exploited weaknesses to raise temperatures and cause food to thaw. Similar vulnerable systems were also found in the UK, prompting NCSC experts to work through the night to alert affected organisations.
The attacks did not involve AI, Horne said. Instead, hackers exploited outdated refrigeration technology connected directly to the internet and protected by default passwords, highlighting the risks posed by poorly secured operational systems.
The report described Chinese cyberactivity as the most sophisticated and sustained cyber challenge facing the UK. It said Russia and China were expected to use AI routinely to advance their geopolitical objectives.
Horne also said Russia was deliberately conducting cyber campaigns below the threshold of armed conflict, while Iran was targeting the UK and individuals considered threats to the Iranian government.
The NCSC said AI was highly likely to increase the scale and efficiency of hostile cyber operations by both state actors and criminals. However, it is more likely to enhance existing methods than to uncover entirely new vulnerabilities.
Horne warned that digital technology now controls essential physical processes, including electricity switching, water facility gates, dam operations, manufacturing lines, and heating and refrigeration systems.
He said business leaders who had relied on outdated or inexpensive technology would have to explain the consequences if essential supplies were disrupted, businesses collapsed or public services failed because of inadequate cybersecurity investment.
The warning comes after governments and companies last week rushed to introduce security updates following the AI-assisted discovery of vulnerabilities in PHP, a programming language used by around 70 percent of websites worldwide.
Two critical flaws identified with AI assistance could allow attackers to access websites without authentication and potentially take remote control of web servers without passwords.
Russia has already been accused of targeting critical infrastructure in Europe. The UK and several European Union member states said Russia's FSB security service was behind a December 2025 attack on Poland's energy grid. A successful attack could have left 500,000 people without electricity during winter.
According to the NCSC, malicious cyberactivity costs UK organisations nearly $20 billion annually. Carmaker Jaguar Land Rover suffered more than $260 million in direct losses from a cyberattack in 2025, which also affected its suppliers and harmed the British economy.
Anne Keast-Butler, director of GCHQ, Britain's signals intelligence agency under which the NCSC operates, urged all UK organisations to take immediate action to strengthen their cybersecurity.
She said cybersecurity had become part of the country's frontline national defence and was essential to protecting customers, services and livelihoods.
The NCSC advised organisations to adopt basic but effective safeguards, including keeping devices and software updated, restricting administrator access to systems and regularly backing up important files and data.