AI minister: UK cyber breach ‘likely, if not inevitable’
The government is also working on how it would respond to a serious incident involving autonomous AI agents.
It “seems likely, if not inevitable” that the UK’s own cyber defences will be breached, AI Minister Kanishka Narayan has said.
Narayan made the remark in a speech at Imperial College London’s science and tech incubator, Base One, on 12 October, as the government set out measures to counter growing risks from artificial intelligence.
The Cabinet Office said the same day it would build on two pilots in which AI has helped identify and fix more than 1,000 potential cyber vulnerabilities across government systems. Narayan said a central vulnerability-monitoring service has helped cut the time taken to fix identified weaknesses from 50 days to eight.
Narayan pointed to an incident in Australia as a warning. An OpenAI agent looking for information about public spending on medicines reached a government website that restricted what it could access, and “found another way in”, Narayan said. Its task was “benign, legitimate”, but the agent gained access to information it was not authorised to have.
The Australian government has said no personal medical records are known to have been accessed, and there is no evidence of wider compromise, Narayan said.
The National Cyber Security Centre (NCSC) has warned that AI will “almost certainly” make elements of cyber intrusion more effective and efficient, the minister added.
What the government says it will do next
The government said it would explore strengthening parts of the Cyber Security and Resilience Bill and the wider regime, to better protect essential services such as hospitals and utilities from emerging risks linked to AI.
That includes “loss of control” risk, which the government described as autonomous AI systems evading human oversight. It will also look at how serious AI incidents and near misses can be identified and reported. The detail of any measures will be worked through with parliamentarians, technical experts and the operators who would need to deliver them.
Separately, the government is working with the NCSC and the AI Security Institute on how to respond to incidents involving AI agents, which can perform complex tasks with little human supervision. It said a major incident of that kind “could play out quicker and wider than other major incidents” that governments are designed to respond to.
Scientists at the AI Security Institute are now evaluating the latest generation of models, including Gemini 4 Argon, Narayan said.
In a statement issued with the announcement, Narayan’s message to companies developing the world’s most powerful AI systems was: “Listen when your scientists warn of serious dangers. Investigate unexpected behaviour. And if you cannot adequately control the risks, do not release the system.”
