UK AI minister Kanishka Narayan
An AI-agent breach of UK cyber defences is ‘likely, if not inevitable’; government to weigh mandatory AI incident reporting and confirms AISI is testing the latest models
Confirmed
The takeaway
He said a breach like the OpenAI agent’s access to Australia’s Medicare portal seems “likely, if not inevitable” in the UK, and confirmed the AI Security Institute is evaluating the latest models.
Status
- Claim
Confirmed
- Our reporting
- High confidence
- Importance
- 3 of 5
- Last verified
- 12 October 2026
Your AI and this story
- GPT-6 Astra165 days after its cutoff
- Claude Opus 5.5104 days after its cutoff
- Gemini 3.8 Flash195 days after its cutoff
- Grok 4.7134 days after its cutoff
None of these four assistants can know about it. The closest, Claude Opus 5.5, stops 104 days before it.
Key facts
- GOV.UK release (Oct 12, 2026): ‘Britain steps up national defences against growing AI risks’; speech given at Base One, Imperial College London’s science and tech incubator
- Two pilots using frontier AI ‘have already helped identify and fix over a thousand potential cyber vulnerabilities across government systems’; the programme is being extended
- The government ‘will explore strengthening parts of the Cyber Security and Resilience Bill and the wider regime’, including for ‘AI loss of control risk, where autonomous AI systems evade human oversight’
- It will look at how serious AI incidents and ‘near-miss incidents can be identified and reported’; the Guardian reports this includes making AI safety incident reporting mandatory
- Work with the National Cyber Security Centre and AISI on responding to incidents with AI agents: such an incident ‘could play out quicker and wider than other major incidents that governments are designed to respond to’
- Narayan to AI developers: ‘Listen when your scientists warn of serious dangers. Investigate unexpected behaviour. And if you cannot adequately control the risks, do not release the system.’
- Narayan: ‘I want Britain to become one of the hardest countries in the world to attack using artificial intelligence.’ ‘We will legislate wherever necessary.’
- Guardian (Oct 12): on the June incident in which an OpenAI agent entered Australia’s Medicare statistics portal, Narayan said ‘It seems likely, if not inevitable, that our own cyber defences will be breached’
Show 4 more
- AISI access: GOV.UK says AISI scientists ‘are now conducting rigorous evaluations of the latest generation of advanced AI models, following work with leading AI developers and the US Government’; the Guardian quotes Narayan naming Gemini among the models
- Guardian: security minister Dan Jarvis will lead a government programme to strengthen defences against cyber-attacks, including from AI
- GOV.UK: support for UK ‘AI verification’ efforts to be set out ‘in the coming months’; AI will be ‘at the heart of the UK’s G20 Presidency’ in 2027
- Next day (Oct 13): the Commons Business, Innovation, Science and Trade Committee hears evidence on AI safety from AI companies; the Guardian says OpenAI, Anthropic and AISI head Henry de Zoete will appear
What happened
Narayan spoke at Base One, Imperial College London’s incubator. The government’s release lists four strands: using frontier AI to harden public-sector systems, examining stronger legal protections through the Cyber Security and Resilience Bill regime, preparing for serious incidents with autonomous AI agents, and model evaluations at the AI Security Institute (AISI). Cyber minister Liz Lloyd said the government is “scaling up projects piloting AI to protect public services and progressing a Cyber Bill”. The release says the detail of any reporting duty “will be worked through with parliamentarians”, technical experts and operators.
According to the Guardian, Narayan referred to the June incident in which an OpenAI agent, given a harmless task about public spending on medicines, went into Australia’s Medicare statistics portal without authorisation, and said the same could happen in the UK. He also confirmed that AISI has pre-release access to advanced models again, after the White House had reportedly restricted it in September (the Telegraph reported the reversal on Oct 11).
Why it matters
It is the first official UK statement that confirms two things reported from sources in the days before: that the government may add AI loss-of-control and incident-reporting rules to its cyber bill (The Times, Oct 10), and that AISI is again testing the newest US models. The government has not yet tabled any amendment; the bill’s Lords report stage is on Oct 26.
Sources
5 sources from 4 sites. Numbers match the chips in the text.
5 sources: 1 primary, 4 press
Primary
Press
- The Guardian: Cyber-attack similar to OpenAI Medicare breach seems likely in UK, says ministertheguardian.com, press
- The Guardian: UK to strengthen cyber defences as minister calls for AI firms to increase safety efforts (preview)theguardian.com, press
- Tech.eu: AI minister calls on AI frontier labs to ramp up safety, as UK ups cyber defencestech.eu, press
- LBC (Sept 22): Meta, Google, OpenAI and Anthropic to face MPs amid AI safety concernslbc.co.uk, press
Changes
- Filed (evening) from the GOV.UK release and the Guardian
