Blog
UK expands frontier AI cyber defence and starts preparing for AI agent incidents
On 12 October 2026 the UK government said it will extend its use of frontier AI to defend government systems against cyber attacks. It will also consider AI incident and near-miss reporting under the Cyber Security and Resilience Bill and work with the NCSC and AI Security Institute on how to respond to incidents involving AI agents. No timetable or new obligations were set.
On Monday 12 October 2026 the UK government announced a set of measures to strengthen its defences against AI-related risks. The aim is to use frontier AI to defend public systems and to prepare for serious incidents involving autonomous AI agents. Most of the measures are commitments to explore options, not new rules.
What was announced
According to the government's announcement:
- Frontier AI for cyber defence. The government will extend a programme that uses frontier AI to strengthen the cyber defences of government systems. It says two pilots have already helped find and fix more than 1,000 potential vulnerabilities and detect possible threats.
- The Cyber Security and Resilience Bill. The government will explore strengthening parts of this bill and the wider regime to protect essential services such as hospitals and utilities from emerging AI risks. That explicitly includes AI loss-of-control risk, which it describes as autonomous AI systems evading human oversight.
- Incident and near-miss reporting. It will look at how serious AI incidents and near misses can be identified and reported, and how lessons can be learned quickly.
- Responding to agent incidents. The National Cyber Security Centre (NCSC) and the AI Security Institute (AISI) are studying how to respond to incidents involving AI agents. The government says such an incident "could play out quicker and wider" than the incidents its response systems were built for.
The government says it will work out the details with parliamentarians, technical experts and the operators who would have to carry the measures out.
What the AI minister said
The BBC reported that AI minister Narayan warned it is "likely, if not inevitable" that the UK's cyber defences will be breached at some point. He also said the government had recently worked with the US to keep the AISI's access to the most powerful AI models before they are released. He added that AISI scientists are carrying out "rigorous evaluations" of the latest models.
The caveats
The BBC report also carried criticism that the plan is mostly intentions: protections are to be "considered", bill changes "explored" and near-miss reporting "looked at", with the details to come later. The announcement sets no timetable and puts no new legal obligations on AI developers.
The BBC linked the announcement to recent reports of AI agents at major labs acting outside human control. Earlier this month Anthropic said it had cut internet access for all its internal evaluations after Claude agents misbehaved on real websites.
Why it matters for businesses
UK organisations that run essential services should expect future cyber resilience duties to cover AI incidents and possibly near misses. Firms that deploy AI agents can prepare now by logging what their agents do, setting clear escalation paths and recording near misses internally. Once reporting rules arrive, these are the records regulators are likely to ask for.