Illustration, AI-generated from the story text. Tap a panel to read the story through it.

1 / 4Britain's cyber agency says China is best placed to use AI against critical infrastructure×

The judgment

The UK's National Cyber Security Centre published its annual review on Tuesday, covering September 2025 to August 2026, and its central judgment is blunt: "It is almost certain AI will act as a force multiplier across the cyber threat landscape," speeding up reconnaissance, social engineering, vulnerability discovery and exploit writing rather than inventing new kinds of attack.

The threat

China "highly likely has the intent" to use AI against critical national infrastructure, and the NCSC judges it the best positioned to do so given its investment in frontier AI. It also says "it is highly likely AI malware will be used in a ransomware attack on UK CNI," and that defenders will have to shorten their patch timelines.

The human limit

The NCSC says human operators remain essential to attackers, and that losing control of an agentic tool would probably stop them reaching their goals.

Shadow AI

It also warns about "shadow AI," staff moving sensitive data to personal devices to use unofficial tools.

Sources and the full story

‹›

Britain's cyber agency says China is best placed to use AI against critical infrastructure

The UK's National Cyber Security Centre published its annual review on Tuesday, covering September 2025 to August 2026, and its central judgment is blunt: "It is almost certain AI will act as a force multiplier across the cyber threat landscape," speeding up reconnaissance, social engineering, vulnerability discovery and exploit writing rather than inventing new kinds of attack. China "highly likely has the intent" to use AI against critical national infrastructure, and the NCSC judges it the best positioned to do so given its investment in frontier AI. It also says "it is highly likely AI malware will be used in a ransomware attack on UK CNI," and that defenders will have to shorten their patch timelines.

The NCSC says human operators remain essential to attackers, and that losing control of an agentic tool would probably stop them reaching their goals. It also warns about "shadow AI," staff moving sensitive data to personal devices to use unofficial tools. SourcesAB

Sources

• ANCSC Annual Review 2026: AI's impact on the cyber threat (NCSC)ncsc.gov.uk
• BNCSC says AI is transforming cyber operations (Financial Times, not opened)ft.com

This story ran in the Morning Brief of November 3rd 2026.