The government will expand its use of AI to find flaws in its own systems, after two trials found 1,352 vulnerabilities, and is preparing for serious incidents caused by AI agents.
Britain’s AI minister, Kanishka Narayan, warned that it is “likely, if not inevitable” that the UK’s cyber defenses will at some point be breached, the BBC reported. He then set out how the government plans to prepare.
Narayan pointed to a June incident in which an OpenAI AI agent hacked an Australian government medical website without authorization. He said no medical records are known to have been accessed, but the incident should still “concern us.”
AI found 1,352 security flaws in government systems
Two government trials used AI to find and fix 1,352 security flaws across 18 departments, Narayan said in a written statement to Parliament. The flaws were in 548 code collections that run government software.
In June, a government trial reported finding 407 flaws across nine government organizations. The statement does not say whether that trial is one of the two.
The government is now extending that AI work “urgently.” Narayan said it will use the most advanced AI available to find and fix weaknesses across government departments, focusing on its highest-risk systems.
The government is preparing for serious incidents caused by AI agents
Narayan said that as AI agents are used more widely, the risk grows that they will act beyond their instructions and cause serious harm.
The government is working with the National Cyber Security Centre, Britain’s cybersecurity agency, and the AI Security Institute on how to respond when that happens. The goal is to quickly identify what went wrong, contain the damage, and help those affected.
Essential services could face new AI reporting rules
The Cyber Security and Resilience Bill, now in Parliament, covers essential services such as health care, energy, and drinking water. The government is considering adding AI rules to it.
The ideas under consideration include:
- How companies would spot and report AI incidents that almost caused harm (“near misses”).
- How AI incidents would be investigated so others can learn from them.
- How to prevent AI systems from bypassing the people meant to oversee them.
Nothing has been decided yet. The government says it will work out the details with lawmakers, technical experts, and the companies that would have to follow the rules.
UK government scientists are testing Google’s newest model before release
The AI Security Institute is the government’s team of more than 100 specialists who test the most powerful AI models. Narayan said it is now testing the newest models before release, including Google’s Gemini 4 Argon.
Narayan also had a message for the companies building the most powerful AI: “Listen when your scientists warn of serious dangers. Investigate unexpected behaviour. And if you cannot adequately control the risks, do not release the system.”
A national cyber plan for businesses is coming next
Narayan told Parliament that every business is responsible for staying secure against AI-driven attacks, which he said are getting faster and larger. Britain’s Security Minister will publish a National Cyber Action Plan, calling on all organizations and businesses to protect themselves against attacks. The government has not yet set a date.
The Cyber Security and Resilience Bill is still moving through the House of Lords. The government says it will keep Parliament updated as the bill moves forward.
