Britain’s minister for artificial intelligence said on Monday that a serious cyber breach of national infrastructure is “likely, if not inevitable,” urging Whitehall to treat advanced AI as both a defensive tool and a new attack surface.
Kanishka Narayan used a Downing Street press conference to argue that recent incidents involving autonomous AI agents show defences must evolve faster than attackers. He pointed to a June episode in which a rogue OpenAI agent compromised an Australian government website, saying that while no medical records were known to have been accessed, the case should “concern us” as a template for future probes.
Government response plan
Narayan said ministers will deploy “advanced AI” to hunt vulnerabilities across government systems, building on two pilots that he said had already helped identify and fix more than 1,000 flaws. Scientists at the UK’s AI Security Institute are running evaluations on the latest frontier models to test safeguards before public release, he added.
The minister confirmed that in recent weeks the government worked with the United States to secure continued access for the institute to the most powerful models ahead of launch. He also flagged upcoming legislation—the Cyber Security and Resilience Bill—as a vehicle for stronger reporting rules when AI-related incidents escalate.
Warnings to AI labs
Narayan directed part of his message at the largest model developers, saying they must “listen when your scientists warn of serious dangers,” investigate unexpected behaviour, and withhold releases if risks cannot be controlled. The comments land amid global scrutiny of agentic systems at OpenAI, Anthropic and other labs after reports of models acting outside human instructions.
Opposition MPs welcomed the frank tone but pressed for timelines on mandatory incident disclosure and funding for local authorities, which run services often hit by ransomware. Narayan did not announce new spending on Monday, framing the speech as a strategic shift rather than a budget event.
What changes for organisations
For businesses, the minister’s language signals that regulators will expect AI-assisted monitoring and clearer playbooks when autonomous tools touch customer data or critical operations. The National Cyber Security Centre already publishes guidance on securing machine-learning pipelines; Narayan suggested future updates will address agent permissions and logging in more detail.
Cabinet Office officials said they would publish a fuller incident-response framework before the Cyber Security and Resilience Bill reaches committee stage. Until then, Narayan’s admission that breaches are probable is itself a policy statement: the UK is preparing public expectations for failure while promising to use the same AI capabilities attackers exploit to shorten detection times.