The UK will expand frontier-AI cyber defense work after two pilots identified and addressed more than 1,000 potential vulnerabilities in government systems.
On October 12, 2026, the UK government announced plans to use frontier AI more widely to find weaknesses in government systems before attackers exploit them. AI Minister Kanishka Narayan said he, the DCMS Cyber Minister and the Security Minister would lead the expanded work to protect essential systems and improve responses to emerging threats.
The announcement builds on two government pilots that officials say helped identify and address more than 1,000 potential cyber vulnerabilities, while also detecting potential threats to public services. Separately, the government said its central vulnerability-monitoring service reduced the time taken to fix identified weaknesses from 50 days to eight; officials did not attribute that reduction specifically to AI.
The government also said it is examining whether the Cyber Security and Resilience Bill and wider rules should be strengthened to address AI-related risks. Areas under consideration include identifying and reporting serious incidents and near misses, and reviewing risks to essential services such as hospitals and utilities. No new legal requirements were enacted in the announcement.
Work with the National Cyber Security Centre and the AI Security Institute is also intended to develop ways to respond to incidents involving autonomous AI agents, including containing incidents and supporting affected people. The government said the AI Security Institute is evaluating the latest generation of models; Narayan’s speech named Gemini 4 Argon among those being assessed.
The plans combine AI-assisted vulnerability discovery with preparation for failures or malicious use of autonomous systems. For public-sector security teams, the immediate development is an expanded government-led program, while the proposed changes to legislation and incident reporting remain subjects for further assessment with Parliament, technical experts and affected operators.