UK will use frontier AI to find weaknesses in government systems before attackers do, AI minister says

UK AI minister Kanishka Narayan said on Monday 12 October 2026 that the government will lead "the urgent use of frontier AI capabilities to find weaknesses within Government systems before attackers exploit them". He set out the plan in a speech at Base One, Imperial College London's science and tech incubator, published alongside a gov.uk press release from the Cabinet Office, the AI Security Institute (AISI), the National Cyber Security Centre (NCSC) and DCMS.

Frontier AI on government systems

According to the press release, the move builds on two pilots that "have already helped identify and fix over a thousand potential cyber vulnerabilities across government systems, and detect potential cyber threats". In the speech, Narayan said that across two government pilots, frontier AI "has helped identify and address more than a thousand vulnerabilities, alongside other threats to our public services".

He said the government's central vulnerability-monitoring service has helped cut the time taken to fix identified weaknesses from 50 days to eight. Neither names the pilots or the systems covered; the 50-to-eight figure appears only in the speech, which does not explain how it was measured.

Narayan said he would lead the work with the DCMS Cyber Minister and the Security Minister. The release says extending the programme will help protect public services in the short term "and will support longer-term adoption across the public sector."

"I want Britain to become one of the hardest countries in the world to attack using artificial intelligence," he said.

The Cyber Security and Resilience Bill

The release says the government "will explore strengthening parts of the Cyber Security and Resilience Bill and the wider regime" so that essential services "such as hospitals and utilities are better protected from emerging AI related risk".

In the speech, Narayan said the government would work with Parliament and technical experts to assess strengthening the regime, including "identifying and reporting on serious incidents and near misses, including reducing AI-driven risk across essential services, and ensuring serious AI incidents can be properly reviewed."

These are areas to examine, not tabled amendments. The release says: "The detail of any measures will be worked through with parliamentarians, as well as technical experts and the operators who would need to deliver them." Neither document sets out wording or a timetable. Parliament's bills website lists the Bill as in the House of Lords, with report stage scheduled for Monday 26 October 2026.

Responding to incidents involving AI agents

The release says work is under way with the NCSC and AISI "to look at how incidents involving AI agents - which can perform complex tasks with little human supervision - should be responded to". It says a major incident involving AI agents "could play out quicker and wider than other major incidents that governments are designed to respond to".

Narayan said the government, working with DCMS, the NCSC and AISI, would develop ways for government to respond to agentic AI incidents, "looking in particular at how incidents can be contained, and how those affected can be supported."

AI verification

The release describes AI verification as helping to check "that claims about how AI systems have been developed, tested and assessed stands up to scrutiny". It says: "More details on support for UK AI verification efforts will be set out in the coming months." In the speech, Narayan named hardware-enabled verification as one avenue, calling it "early research".

What this means for UK organisations

• The Bill does not cover the whole economy. According to gov.uk's summary factsheet, the existing NIS Regulations apply to operators of essential services in energy, transport, health, drinking water and digital infrastructure, plus some digital services such as cloud computing. The Bill would bring in medium and large data centres, medium and large managed service providers, large load controllers and designated critical suppliers.
• Incident reporting is already in the Bill. As gov.uk describes it, organisations in scope would send an initial notification within 24 hours and a fuller report within 72 hours, with the NCSC informed at the same time. The incident-reporting factsheet says these measures will be brought into force through secondary legislation after Royal Assent. Any AI-specific reporting the government decides to add would come on top of this, and its detail has not been set out.
• For everyone else, the release's notes to editors point to ministers' earlier open letter to businesses, which urged them to take cyber security seriously at the top of organisations, get the basics right with Cyber Essentials, and follow NCSC advice and sign up to its Early Warning Service. Narayan said: "I want cybersecurity discussed in every boardroom in Britain, rather than simply delegated to middle management."

For earlier context: in September, the Alan Turing Institute said uncertainty over existential AI risk should not delay action on nearer-term threats, naming cyber attacks among them.

Why it matters

On our reading, the firm news is the pilot results and the decision to scale them; the Bill changes are a commitment to explore, with the detail still to be worked out. With the Bill already in the House of Lords, whether and how AI incident and near-miss reporting is added is the part essential-service operators will want to follow.