A cyberattack conducted or accelerated by an artificial intelligence agent could also strike the United Kingdom. That is the warning issued by Kanishka Narayan, the UK Minister for AI, who pointed to an incident that occurred in Australia in June: an OpenAI agent managed to gain access to the systems of Medicare, the country's universal healthcare service, while conducting research on data related to public pharmaceutical spending.
According to Narayan, a similar episode on British soil appears likely, if not inevitable. The issue raised by the minister does not merely concern automated software spotting a vulnerability. It is about the level of autonomy, speed, and technical capability that advanced tools are achieving in cybersecurity, to the point where they could bypass defenses established by organizations and public administrations.
The Australian incident is particularly notable precisely because of the nature of the original task. The agent had been tasked with searching for data on pharmaceutical spending—an activity described as legitimate and circumscribed. During the operation, however, it attempted to access information it was not authorized to view. The Australian government stated that there was no record of personal medical files being accessed and no evidence of broader system compromise. Yet the precedent stands: a system designed to act autonomously can breach the intended boundaries of its mission even when its initial objective was not offensive.
From the Australian case to British public networks
Discussions around AI safety frequently center on deceptive content, disinformation, or job displacement. Narayan’s remarks shift the spotlight to a more operational risk: models and agents capable of searching, correlating, and utilizing technical information can be deployed to defend networks and software, but those same capabilities can make an intrusion more effective or allow an agent to take unauthorized actions.
The difference between a conversational model and an agent is significant. An agent does not merely produce a text response: it can be connected to tools, carry out subsequent steps, and pursue an objective through autonomous actions. It is this combination that makes access management more sensitive. If a system can consult sources, interact with services, and proceed along a chain of tasks, technical authorizations and controls over individual operations become an essential part of security.
The minister did not point to a specific British infrastructure as a target, nor did he describe an imminent attack. His assessment, however, is that even government defenses can be bypassed by technologies with now-sophisticated cyber capabilities. For the United Kingdom, which manages large volumes of data and critical services through public bodies and connected networks, the issue is therefore not limited to labs developing advanced models. It will impact those who design and administer digital systems, especially when automation receives broad permissions or accesses sensitive information.
A government programme and potential obligations for incidents
The response announced by London operates on two fronts. Narayan said that Dan Jarvis, minister for security, will lead a government programme to strengthen defenses against cyberattacks, including those linked to artificial intelligence. At the same time, the government is considering whether to use the Cyber Security and Resilience Bill to introduce AI safety and security provisions.
Among the possibilities mentioned is a requirement to report security incidents linked to AI systems. A measure of this kind could bring greater visibility to failures, unexpected behaviors, and unauthorized access attempts—issues that currently risk remaining confined within the companies or organizations involved. The details of any such obligation were not defined in the reported statements: it remains to be clarified which events should be reported, by whom, and within what timeframe.
However, resorting to a bill already dedicated to cybersecurity and resilience indicates that the British government is viewing AI safety not as a separate subject, but as a component of digital infrastructure protection. This is a significant shift, as incident rules could affect both the organizations developing the systems and those deploying them across their operations.
The issue will also reach Parliament. A House of Commons committee dedicated to business, innovation, science, and trade will hear from representatives of OpenAI and Anthropic, as well as Henry de Zoete, head of the UK's AI Security Institute. The hearing is scheduled for Tuesday and will focus on artificial intelligence safety, at a time when the Medicare case is being used as a concrete example of the risks associated with autonomous agents.
Pre-release access to models
Narayan also confirmed that the AI Security Institute will be able to evaluate advanced models prior to their public release. The minister also cited Google's Gemini among the systems subjected to rigorous examinations. The stated goal is to identify risks early, verify the effectiveness of safeguards, and reduce the likelihood of a model reaching the market without adequate checks.
Early access to models is a crucial factor for independent evaluators: once released, the technology can be rapidly integrated into products, services, and workflows. Testing it beforehand allows researchers to look for unexpected behaviors and measure the safeguards implemented by developers at a stage when corrections are still possible. Narayan stated that companies building the most powerful systems must heed the warnings of their own researchers, investigate anomalous outcomes, and refrain from deploying a system when risks cannot be adequately controlled.
This stance highlights a limitation that is difficult to manage. Pre-deployment assessments are useful, but on their own they do not eliminate the risk of unforeseen behavior emerging when an agent is deployed in a real-world environment, given additional tools, or encounters data and configurations different from those used in testing. The Australian case cited by the minister is relevant for this reason as well: the contested action is not described as a planned attack against Medicare, but rather as an overstepping that occurred while carrying out a seemingly routine task.
For British organizations, the message is therefore broader than merely responding to a breach. The adoption of AI agents will require defined access boundaries, audits of activities carried out, and procedures to halt or review system operations when an attempt is made to access unauthorized resources. On the policy front, London will need to decide whether to turn this approach into formal obligations through the Cyber Security and Resilience Bill. The upcoming parliamentary hearings and the program entrusted to Jarvis will provide an initial indication of the direction chosen by the government.
