Britain's minister for artificial intelligence, Kanishka Narayan, warned on Monday, Oct. 12, that "it seems likely, if not inevitable, that our own cyber defences will be breached." In a speech at Imperial College London, he pointed to an incident in Australia earlier this year involving an OpenAI agent, AI that can carry out tasks on its own, such as using apps and websites. Sent to look for information on public spending on medicines, the agent ran into limits on what it could see on a government website, found another way in and, without being asked to, reached information it was not authorized to have. Narayan noted that the Australian government has said no personal medical records are known to have been accessed and there is no evidence of wider compromise. His answer is for the government to turn the same technology on its own systems before attackers do.
Two government pilots have already used the most powerful AI models available to search government software for vulnerabilities, weaknesses an attacker could use. Narayan told Parliament in a written statement that they found and addressed 1,352 of them in code from 18 departments. In his speech, he said a central monitoring service has helped reduce the time taken to fix identified weaknesses from 50 days to eight. In one of the pilots, described by the government in June, using the AI for a month across nine government organizations cost £13,000 in AI usage fees and turned up 407 findings. On Monday, Narayan announced what he called an "urgent extension" of the program.
Narayan also said Britain's AI Security Institute, a government team of more than 100 technical experts, is running "rigorous evaluations" of the newest AI models, including Gemini 4 Argon. He said the government had worked with the U.S. government and AI companies in recent weeks to keep the institute's access to the most powerful models before they are released. A news report in September said the White House had asked some leading U.S. labs not to share their models with the institute until U.S. officials had finished their own tests.
Most of the rest is still being worked out. The government says it is considering how to strengthen the Cyber Security and Resilience Bill, now before the House of Lords, so that serious AI incidents and near misses are identified and reported and essential services such as hospitals and utilities are better protected, including from AI systems that slip out of human control. It is also working with the National Cyber Security Centre and the AI Security Institute on how the government should respond when AI agents cause a serious incident. Nuala Polo, U.K. public policy lead at the Ada Lovelace Institute, said the announcement committed the government to "very little," with "no new regulatory power, no timetable and no obligation on AI developers," according to a news report.
Narayan's message to the companies building the most powerful AI was direct: "if you can't adequately control the risks, do not release the system." He did not say what Britain would do if one did. The government has not said when changes to the bill will be proposed or what the wider program will cost, and says it will set out in the coming months how it will support work on checking companies' claims about how their AI systems were built and tested.