AI minister Kanishka Narayan has warned that a major AI-powered cyber attack on the UK is “inevitable”, urging developers of advanced AI systems to be transparent about risks and strengthen safeguards before releasing powerful models.
Speaking at an event at Imperial College London, Narayan called on AI labs to listen to their own researchers, investigate unexpected model behaviours and avoid releasing systems if their risks cannot be adequately controlled. He also argued that protecting the UK cannot be left to technology companies or government alone, calling for closer collaboration between industry, researchers and regulators.
Andy Ward SVP International at Absolute Security commented: “These concerns from UK politicians highlight the growing risks AI poses to the cybersecurity landscape. Ensuring that the Cyber Security and Resilience Bill strengthens the UK’s ability to prepare for and respond to these threats should be a top priority.”
“Our recent research found that 42 per cent of UK organisations still lack a formal cyber resilience strategy. With attacks, disruption and complexity moving at AI speed, organisations need robust cyber resilience strategies and real-time visibility in place, so the UK does not risk sleepwalking into deeper vulnerabilities.”
John Lucey, VP EMEA at Cellebrite commented: “We are at a moment where AI leaders are experimenting with agents and have pushed them further than what was expected a year ago. Autonomy is moving faster than oversight and government regulation is missing in areas that safeguards are meant to close to protect against AI agents being unsafe. There’s no clear regulation yet for what happens when autonomous systems cross a line no one anticipates.”
First-hand, we’ve seen how agentic AI tools can go rogue, and the question is to what extent could these AI systems get out of control before they cause serious harm?
“In highly sensitive areas like digital forensics, safeguards have to be built into how these systems are designed and deployed from the start. This means purpose-built AI that works only within the boundaries of a single case, drawing solely on the evidence it’s given, with no open internet access and no outside data. Every output can trace back to the specific source that produced it and it means analysis can stay within the scope of the investigation. Guardrails like these is what makes AI both safe, and efficient.”
Simon Edwards, CEO of SE Labs: “As AI is becoming increasingly autonomous, it is posing a huge threat to individuals, and businesses off all sizes, on top of our critical national infrastructure. “First-hand, we’ve seen how agentic AI tools can go rogue, and the question is to what extent could these AI systems get out of control before they cause serious harm? Developing a dedicated national cyber strategy, and ensuring adequate testing of software and services for loopholes should be a top priority.”
Narayan’s comments come amid growing concerns about the cybersecurity implications of increasingly capable and autonomous AI systems. Recent incidents include AI agents breaching systems at Hugging Face during testing, on top of three former OpenAI safety researchers accusing the ChatGPT maker of dismissing them for raising concerns about the technology.
His warning comes as Bank of England governor Andrew Bailey called for more rigorous testing of advanced AI models, amid increasing concerns that autonomous systems may pose highly sophisticated threats to banks, financial markets and payments infrastructure.
Narayan also outlined plans to bolster the UK’s cyber defences and build domestic AI capabilities, by reducing reliance on technology developed overseas. The government also intends to make AI safety a central focus of its G20 presidency next year, aiming to balance stronger safeguards with ambitions to remain a leading destination for AI investment.
