Governments rarely say in public that they expect to be hacked. On Oct. 12, Britain's AI minister did. "It seems likely, if not inevitable, that our own cyber defences will be breached," Kanishka Narayan said, according to The Telegraph, in his first major speech since joining the Cabinet. He then set out what the government plans to do about it.

The speech, given at Base One, Imperial College London's science and technology incubator, came with a government announcement of four measures. Taken together, they treat advanced AI as both the threat and part of the defence.

Using AI to find the holes first

The most concrete step is to put frontier AI, the most capable models available, to work strengthening government cyber defences. Two pilot projects have already helped identify and fix more than 1,000 potential vulnerabilities across government systems, the government says. A vulnerability is a weakness in software that an attacker could use to break in. The programme will now be extended, with the aim of protecting the public services people use every day.

The logic is straightforward. If AI can help attackers find weak spots faster, defenders need the same tools. Narayan pointed, the BBC reported, to an incident in June in which a rogue OpenAI agent hacked an Australian government website. An AI agent is a system that carries out multi-step tasks on its own, such as browsing sites and filling in forms, with little human supervision.

Tougher rules and emergency planning

The government will also consider strengthening the Cyber Security and Resilience Bill, a law still going through Parliament, so that essential services such as hospitals and utilities are better protected. That includes looking at how serious AI incidents, and near misses, should be identified and reported. It also explicitly names "AI loss of control risk, where autonomous AI systems evade human oversight."

Separately, the National Cyber Security Centre and the AI Security Institute are working on how the country should respond to incidents involving AI agents. The government's reasoning is that a major incident involving agents "could play out quicker and wider" than the emergencies governments are built to handle. The Telegraph also reported that security minister Dan Jarvis will lead a cross-government programme to strengthen defences against cyber attacks, including those from AI.

A fourth strand concerns AI verification, an emerging field that checks whether companies' claims about how their AI systems were built and tested actually hold up. The government says Britain is well placed to lead in it and promised more details in the coming months.

A message to the labs

Narayan also spoke directly to the companies building the most powerful systems. "Listen when your scientists warn of serious dangers. Investigate unexpected behaviour. And if you cannot adequately control the risks, do not release the system," he said. "I want Britain to become one of the hardest countries in the world to attack using artificial intelligence. We will use every power at our disposal. We will legislate wherever necessary."

He confirmed that scientists at the AI Security Institute are now running "rigorous evaluations" of the latest generation of advanced models, following work with AI developers and the US government.

What it adds up to

Much of the package is still at the "explore" and "consider" stage. The details of any new duties will be worked out with lawmakers, technical experts and the operators who would have to carry them out, the government says. Only the extension of the AI defence pilots is a firm, immediate step.

Still, the tone is notable. A minister has told the public to expect breaches, told AI companies not to ship systems they cannot control, and tied cybersecurity law to risks that, until recently, sounded like science fiction. The test of the speech will be whether those words turn into reporting duties and response plans that companies and hospitals actually have to follow.