UK Cyber Chiefs Warn of AI-Powered Attacks by 2028, Beijing Calls It a “Smear”

.

What the British Report Says

On November 3, the NCSC published its annual review, launched at an event in London. The agency is part of GCHQ, Britain's signals intelligence service.

According to AP, the report names Chinese cyber activity as the "most sophisticated and sustained" challenge the UK faces. It judges that by 2028, China, Russia and other states will "highly likely" use AI routinely to reach their geopolitical goals. Britain should expect more attacks, launched faster and with greater skill.

In British intelligence language, "highly likely" is a formal probability rating. It means roughly an 80 to 90 percent chance, which makes it a strong judgment but not a certainty.

The NCSC also warned of a separate danger. Criminal gangs are expected to use AI-powered malware in ransomware attacks (attacks that lock data and demand payment) on UK critical infrastructure by 2028. That means targets such as power stations, airports and hospitals.

Beijing Hits Back

China's foreign ministry answered the next day. Spokeswoman Mao Ning said at a regular briefing in Beijing that China was seriously concerned about what she called speculative accusations made without evidence.

According to The Standard, she said Britain had long politicised cybersecurity. She also accused London of using "hacking" as an old pretext to introduce new measures against China's AI development.

China's state-run Global Times reported further remarks. Mao argued that the claims would not build trust between the two countries and would damage the UK's credibility in international cooperation on AI safety.

A Familiar Pattern

Beijing's reaction follows a well-known script. Britain, the United States and New Zealand have publicly accused China of cyber intrusions over the past decade. Beijing has denied all of these claims.

The dispute is also not new for London. In November 2025, China dismissed British spying allegations as "phantom allegations," according to TRT World, citing a DPA report.

The NCSC's own record adds context. In a June speech, NCSC chief Richard Horne said the agency handled more than 200 incidents affecting critical national infrastructure in the year to May 2026. About 75 percent were believed to be linked to state actors, mainly Russia, China and Iran, according to UKAuthority. The agency also said it had received reports of 1,831 cyber attacks on UK organisations so far in 2026, and 80 of them were considered nationally significant.

What the Report Does Not Claim

The report is not a story of defeat. According to The Record, it stresses that AI did not create the weaknesses attackers exploit. It says AI exposes years of "technical debt," meaning outdated systems and missing basic protections that were never fixed.

The NCSC also says the structural advantage will remain with defenders. The government has begun testing advanced AI systems to find holes in its own networks.

Some experts think the timeline is too relaxed. Anthony Young, CEO of the UK security firm Bridewell, told Infosecurity Magazine the two-year warning "feels generous."

Why It Matters

China's government has a documented record of tight state control over technology and information. It has little tolerance for independent scrutiny at home. When a foreign government cites intelligence assessments, Beijing's standard reply is denial, often without addressing the specifics.

Readers should keep two things in mind. The NCSC's findings are assessments by an intelligence agency, and the agency has not published all of its evidence. Beijing's denials are equally unverifiable. Independent technical analysis is the best way to judge such claims over time.

What is not in dispute is the direction of travel. AI lowers the cost of finding weak points in computer systems, and every government with strong cyber capabilities has an incentive to use it. For Britain, the practical answer is the unglamorous one: patch old systems, strengthen basic security, and plan for faster attacks.

Outlook

The 2028 deadline gives governments and operators of critical systems about two years. Expect more public attributions from Western agencies and more flat denials from Beijing. The more important test will be whether UK infrastructure operators close the gaps the NCSC has described before AI tools make them easier to exploit.

.

Sources

1. The Standard (Hong Kong), "Beijing says UK cybersecurity report 'smears' China": https://www.thestandard.com.hk/china/article/347500/
2. AP via AsiaOne, "UK cyber chief says the UK will face AI cyberattacks on critical infrastructure by 2028": https://www.asiaone.com/world/uk-cyber-chief-says-uk-will-face-ai-cyberattacks-critical-infrastructure-2028
3. Infosecurity Magazine, "NCSC Chief Warns of AI Ransomware Threat to UK Critical Infrastructure": https://www.infosecurity-magazine.com/news/ncsc-ai-ransomware-threat-uk-cni/
4. The Record, "UK faces 'unprecedented rise' in cyberattacks in coming months, warns cyber chief": https://therecord.media/uk-ncsc-predicts-rise-cyberattacks-coming-months
5. Mobile World Live, "Russia, China to ramp up UK cyberattacks by 2028": https://www.mobileworldlive.com/ai-cloud/russia-china-to-ramp-up-uk-cyberattacks-by-2028/
6. UKAuthority, "Critical infrastructure under attack, NCSC CEO": https://www.ukauthority.com/articles/critical-infrastructure-under-attack-ncsc-ceo
7. Global Times (Chinese state media), report on Mao Ning's remarks: https://www.globaltimes.cn/page/202611/1373617.shtml
8. TRT World, "China slams UK over 'phantom allegations' after MI5 claims": https://trtworld.com/article/6c567982f540

.