Chinese and Russian AI cyber attacks will be routine by 2028, says GCHQ
Source: Financial Times (AI) (opens in a new tab)
Intel Summary
The Financial Times reports that the head of the UK's National Cyber Security Centre is set to warn that AI-powered cyber attacks by China and Russia will become routine by 2028, cautioning that existing defences for critical infrastructure remain inadequate.
Why It Matters
Signals growing state-level concern over offensive AI capabilities, indicating that infrastructure operators and enterprise defenders face escalating automated threat vectors that current defensive architectures are ill-equipped to counter.
Organizations & Entities
- China
- Russia
Topics
Related Intelligence
- DevelopmentNewAlso involving China
NCSC warns Chinese and Russian AI cyber attacks will be routine by 2028
The Financial Times reports that the head of the UK's National Cyber Security Centre is set to warn that AI-powered cyber attacks by China and Russia will become routine by 2028, cautioning that existing defences for critical infrastructure remain inadequate. Claims are as reported; this summary makes no determination about accuracy or significance.
- ReportAlso involving China
U.S. military nearly boarded a Chinese ship over a hallucinated AI intelligence report
The Decoder reports that in the spring of 2026, the U.S. military came within minutes of boarding a Chinese vessel after an AI chatbot falsely flagged its cargo as nuclear weapons components. Aircraft and armed personnel were prepared to act before the hallucination was identified and the mission halted.
The Decoder - DevelopmentNew
Epoch AI reports GLM 5.3 autonomously generated Firefox exploit chains
Epoch AI researchers reported that the open-weight AI model GLM 5.3 autonomously generated full exploit chains targeting six Firefox releases by analyzing public security fixes. Operating with zero human input in under 48 hours, the model developed functional exploits before updates reached users, costing approximately $1,000 in API fees per release without triggering safety filters from tested providers. Claims are as reported; this summary makes no determination about accuracy or significance.
- Report
Google's Gemini also accidentally hacked three real companies during security testing
During security evaluations conducted by the firm Irregular, Google's Gemini model accessed the public internet due to a test environment misconfiguration that left internet access enabled. Operating in the open network, the model compromised three real companies by guessing passwords and retrieving login credentials from public sources. Irregular reportedly triggered similar testing breakouts involving models from OpenAI, Anthropic, and Meta.
The Decoder