Chinese and Russian AI cyber attacks will be routine by 2028, says GCHQ

Britain is already subject to AI-powered cyber attacks from its adversaries, and their speed and scale will increase significantly over the next two years, the intelligence services have warned.

The National Cyber Security Centre, part of the UK’s signals intelligence agency GCHQ, said that the latest advancements in AI models are “transforming cyber operations” by making it easier for attackers to identify vulnerabilities, target victims and operate more efficiently.

“By 2028, it is highly likely China, Russia, and other nation states will routinely use AI cyber to achieve their geopolitical goals with the UK facing an increase in scale and speed of sophisticated cyber attacks,” the NCSC said in its annual cyber security review, published on Tuesday.

Within the next two years the cyber agency also expects to see AI-powered ransomware attacks on UK infrastructure, meaning a hack in which a criminal group uses AI to infect a target with malware and returns control to the operator only once a ransom payment is made.

The warnings come after a spate of high-profile cyber attacks targeting companies and infrastructure around the world, many of which are thought to have been aided by rapidly advancing AI tools.

On Monday freezers at dozens of supermarkets across Europe were hacked by an unknown attacker, ruining food in the second set of such incidents in a month.

The attacks followed the theft last week of $6.3bn in cryptocurrency from Binance, the world’s largest crypto exchange, by far the biggest robbery in history.

Rather than using AI to fully automate attacks, hackers have so far generally deployed it to conduct reconnaissance, tailor phishing exercises and identify and exploit software vulnerabilities, the NCSC said.

China represents the “most sophisticated and sustained” cyber threat facing the UK, the NCSC said.

Russia, however, is the “most audacious” cyber threat, the report added, noting how a December 2025 attack on Poland’s energy grid attributed to a cyber unit within the Russian security services would have affected 500,000 citizens if it had succeeded.

This year the NCSC has received 1,831 reports of cyber attacks affecting UK organisations across a range of sectors. Of these, 80 were classed as nationally significant.

In a speech to launch the report on Tuesday, NCSC chief executive Richard Horne is expected to warn that cyber security defences, particularly for critical infrastructure, are inadequate to deal with the mounting threat.

“For decades we have collectively got away with tech on the cheap,” Horne will say, urging organisations across the country to increase investment in cyber security and ensure technology is not unnecessarily connected to the internet.

“In the coming months, we face a real prospect of an unprecedented rise in the number of cyber incidents,” Horne will say.

“That is not because AI has invented new ways to attack us, but because vulnerabilities that have been tolerated for far too long can now be discovered and exploited at a scale that was once unimaginable.”