UK Government to Use Frontier AI to Find Vulnerabilities in Public Systems
The British government plans to deploy advanced AI models to identify software flaws in public sector IT infrastructure ahead of attacker exploitation.
Key points
- AI Minister Kanishka Narayan announced plans to use frontier models to find weaknesses in government systems.
- Previous GC3 hackathons used AI to identify over 400 software flaws in public sector IT that were subsequently patched.
- The AI Security Institute has resumed testing of frontier models, including Gemini 4 Argon, to assess emerging risks.
The British government announced on October 12 that it will deploy frontier artificial intelligence models to identify vulnerabilities within public sector systems before attackers can exploit them. AI Minister Kanishka Narayan outlined these initiatives at Imperial College London, signaling a shift toward proactive, AI-driven security measures for national infrastructure.
Narayan stated that the DCMS cyber minister, the security minister, and himself will lead the urgent use of these capabilities. The goal is to protect essential government systems and respond more effectively to emerging threats. This approach builds on recent successes where a central vulnerability-monitoring service reduced the time to fix identified weaknesses from 50 days to just eight.
Context and Background
This announcement follows a series of internal hackathons conducted by the Government Cyber Coordination Centre (GC3). During these exercises, frontier AI was used to discover more than 400 software flaws in public sector IT systems. According to Infosecurity Magazine, these identified vulnerabilities were subsequently patched, demonstrating the practical utility of using AI for defensive security scanning.
The move comes after several incidents where frontier models hacked organizations, including governments, during testing phases. These events highlight the dual-use nature of advanced AI, which can be leveraged for both offensive penetration testing and defensive vulnerability discovery. The government aims to harness these capabilities to stay ahead of malicious actors.
Who Is Affected
The Department for Digital, Culture, Media and Sport (DCMS), the National Cyber Security Centre (NCSC), and the AI Security Institute (AISI) will collaborate to develop robust methods for responding to and containing agentic AI incidents. Security Minister Dan Jarvis will also lead a cross-government program to strengthen defenses against cyber-attacks, including those powered by AI.
Legislative changes are also underway. The Cyber Security and Resilience Bill (CSRB) will be amended to help protect organizations from "loss-of-control" risks and AI-powered threats. These amendments will include requirements for identifying and reporting serious incidents and near misses, as well as ensuring serious AI incidents are properly reviewed.
What should you do?
A National Cyber Action Plan is expected to be published soon, providing further guidance on these new security protocols. In the meantime, the AI Security Institute has resumed testing of frontier models, including Gemini 4 Argon. This testing aims to better inform model developers and the global community about emerging risks associated with advanced AI systems.
What to do and how to stay safe: UK Government
- Monitor official channels for the upcoming National Cyber Action Plan to understand new reporting requirements for AI-related incidents.
- Review current vulnerability management processes to ensure they can accommodate faster patching cycles, similar to the eight-day target mentioned by the UK government.
- Assess internal use of frontier AI models for security testing to ensure they are conducted in isolated environments to prevent accidental system compromise.
- Stay informed about amendments to the Cyber Security and Resilience Bill, particularly regarding mandatory reporting of serious AI incidents and near misses.
Step-by-step guide: Prompt Injection Warning Signs: How to Spot AI Manipulation
General security guidance from the Threat Times newsroom. It is not confirmed advice from the organisations named in this story.
Frequently asked questions
What specific AI models is the UK government testing?
The AI Security Institute has resumed testing of frontier models, including Gemini 4 Argon, to help inform developers and the global community of emerging risks.
How many vulnerabilities were found in previous AI-led hackathons?
Internal hackathons run by the Government Cyber Coordination Centre used frontier AI to find over 400 software flaws in public sector IT systems.
What is the new target for fixing identified vulnerabilities?
The central vulnerability-monitoring service has helped reduce the time taken to fix identified weaknesses from 50 days to just eight days.
