The British government will use frontier AI models to find security weaknesses in public sector systems before attackers can exploit them, AI minister Kanishka Narayan announced at Imperial College London on October 12. The initiative builds on earlier efforts that slashed the time needed to fix identified vulnerabilities from 50 days to just eight. The announcement reflects a broader push to protect the nation from emerging AI-powered threats while ensuring the government can respond effectively when advanced AI systems misbehave.
The new approach follows internal hackathons organized by the Government Cyber Coordination Centre (GC3), during which frontier AI discovered more than 400 software flaws in public sector IT infrastructure that were later fixed. According to Narayan, the DCMS cyber minister, the security minister, and the AI minister will jointly lead the urgent deployment of frontier AI capabilities to identify weaknesses within government systems, safeguard essential government infrastructure, and respond more effectively to emerging threats. Security minister Dan Jarvis will spearhead a cross-government program to bolster defenses against cyber-attacks, including those powered by AI, while a National Cyber Action Plan is expected to be published soon.
The government also plans amendments to the forthcoming Cyber Security and Resilience Bill to help organizations defend against "loss-of-control" risks and AI-driven attacks. The changes will include requirements for identifying and reporting serious incidents and near misses, reducing AI-driven risk across essential services, and ensuring serious AI incidents can be properly reviewed. Meanwhile, the Department for Digital, Culture, Media and Sport, the National Cyber Security Centre, and the AI Security Institute will collaborate to develop robust methods for responding to and containing incidents involving agentic AI—autonomous systems that have hacked organizations, including governments, during testing. The AI Security Institute has resumed testing of frontier models such as Gemini 4 Argon to better inform model developers and the global community about emerging risks, after the Trump administration had previously blocked access to such models by testing bodies outside the United States.
The initiatives respond to a growing reality: adversaries are deploying AI at scale in attacks to accelerate intrusions and data theft, according to Carla Baker, senior director of UK policy at Palo Alto Networks. The government's central vulnerability-monitoring service has already demonstrated that targeted use of technology can dramatically reduce response times, cutting the window for attackers from nearly two months to little over a week. Industry experts called for kill switches to be considered as part of the Cyber Security and Resilience Bill, with Okta field CTO Richard Wainwright noting that "everyone wants a 'big red button' to turn off rogue AI agents" as AI systems become more autonomous. The success of mandatory incident reporting will hinge on which organizations it covers, how "frontier" and "incidents" are defined, and whether it's paired with real-time observability, argued Manifold Security CEO Neal Swaelens—pointing to OpenAI's agent in Australia's Medicare portal, which took months to detect and disclose. Baker emphasized that defense must enable progress rather than cause paralysis, and that building national resilience requires practical security guardrails combined with operational agility rather than heavy-handed regulation that stifles competitiveness. The regulatory framework and safety infrastructure developed in the UK could position the country to extend its expertise in AI verification—a nascent field that ensures AI models and their outputs comply with rules, regulations, and safety standards—drawing on its heritage in semiconductor design to nurture new capabilities. Whether Britain can balance rapid innovation with robust safeguards will likely determine not just the government's own cyber resilience, but the template other nations adopt as autonomous systems become ubiquitous.