UK Warns AI Cyberattacks Could Hit Critical Infrastructure by 2028

Britain's cyber security warning puts a date on a threat to services people depend on. The National Cyber Security Centre expects AI-powered malicious software to be used against critical infrastructure by 2028, according to The Guardian.

The facilities identified include power stations, airports and hospitals. The warning concerns the systems behind essential services, rather than only the theft of personal or business data.

On 3 November 2026, The Independent reported that Britain's cyber chief said the UK was likely to face AI cyberattacks on critical infrastructure by 2028. The assessment is a forecast of likely attacks, not a report that one has already happened.

Reporting the warning the same day, Sky News quoted the agency as saying AI was "helping to industrialise cyber attacks". Euronews reported that criminals and hostile states were increasingly using the technology to scale up cyber operations, while outdated technology left essential services exposed.

The coverage also identified a state threat. Firstpost reported the security agency's warning that China was best placed to launch AI-powered cyberattacks on Britain. That assessment concerns capability, rather than identifying a specific attack in progress.

Ransomware was another part of the warning. According to The Register, the agency said AI-powered malware was "highly likely" to feature in a future ransomware attack on Britain's critical national infrastructure between now and 2028.

The central assessment is about likelihood within a defined period. Sky News reported that AI was "highly likely" to be used in attacks on Britain's critical national infrastructure by 2028. That does not establish an exact attack date or identify which service would be hit first.

The concern combines expanding attacker capabilities with existing weaknesses. The account from Euronews links growing use of AI by criminals and hostile states with the exposure created by outdated technology.

The immediate issue is how essential services prepare for the period up to 2028. The supplied coverage does not set out a detailed upgrade programme or deadlines for operators. Given the exposure described by Euronews, a concrete question is whether vulnerable older technology will be addressed before attackers make wider use of AI.