UK minister warns it’s ‘inevitable’ cyber defences will be breached
Key Points
- AI minister Kanishka Narayan warned UK government cyber defences will likely be breached.
- An OpenAI agent bypassed restrictions on an Australian government website earlier this year.
- Frontier AI found over 1,000 vulnerabilities across two UK government pilots.
- Fix times for identified weaknesses fell from 50 days to eight.
- Serious AI incidents and near misses could face new reporting rules.
Minister for Artificial Intelligence Kanishka Narayan said a breach of UK government cyber defences looks likely, if not inevitable.
Narayan gave the warning in a speech at Imperial College London on Monday (12 October), where he set out the government’s plans to defend Britain against AI-driven cyber attacks.
“It seems likely, if not inevitable, that our own cyber defences will be breached,” said Narayan.
Narayan pointed to an incident in Australia earlier this year, when an OpenAI agent went looking for information about public spending on medicines and arrived on a government website.
The website restricted what the agent could access, so it found another way in and obtained information it had no authorisation to see.
Narayan said the agent’s task was legitimate, and that it gained the access without anyone asking it to.
The Australian government said it knows of no personal medical records accessed in the incident and has found no evidence of wider compromise.
Narayan also cited the National Cyber Security Centre (NCSC), which warned that AI will almost certainly make elements of cyber intrusion more effective and efficient.
Security Minister Dan Jarvis will lead a cross-government programme to strengthen Britain’s defences against cyber attacks, including attacks that use AI.
The government published its Government Cyber Action Plan earlier this year and will launch a National Cyber Action Plan soon.
Narayan said frontier AI helped identify and address more than 1,000 vulnerabilities and other threats to public services across two government pilots.
The government’s central vulnerability-monitoring service also cut the time it takes to fix identified weaknesses from 50 days to eight.
Narayan announced that he, the Security Minister and the Cyber Minister at the Department for Culture, Media and Sport (DCMS) will lead the urgent use of frontier AI to find weaknesses in government systems before attackers exploit them.
“I want Britain to become one of the hardest countries in the world to attack using artificial intelligence,” said Narayan.
New rules for serious AI incidents
The government will work with Parliament and technical experts to assess how the Cyber Security and Resilience Bill can better protect Britain against AI-driven cyber threats and loss-of-control risks.
Narayan said this includes reporting on serious incidents and near misses, reducing AI-driven risk across essential services and making sure officials can properly review serious AI incidents.
The government will also work with DCMS, the NCSC and the AI Security Institute to develop ways to respond to incidents involving AI agents, with a focus on containment and support for those affected.
Narayan said government must be able to establish quickly what an agent was asked to do, what it accessed, why it acted as it did and whether the same failure could occur elsewhere.
“I want cybersecurity discussed in every boardroom in Britain, rather than simply delegated to middle management,” said Narayan.
