The report
The UK National Cyber Security Centre's November 3 annual review assesses that AI will almost certainly increase the speed and scale of familiar cyber operations, including reconnaissance, social engineering, vulnerability research and exploit development. It also judges highly likely that AI-enabled ransomware will affect UK critical national infrastructure. This is a forward-looking intelligence assessment, not confirmation that such an attack has occurred or that a specific year, victim or tool is known.
The NCSC's argument is more specific than a claim of fully independent attacker robots. It expects skilled human operators to direct, validate and exploit model outputs, with uneven gains across organizations. It warns that defenders without mature controls may fall further behind and that uncontrolled staff use of shadow AI can expose internal information. The forecast's confidence labels describe assessed likelihood, not incident counts or measured model success rates.
The distinction changes how to read the evidence already available. The BOSSAI operator case supports human-directed agent parallelism; the DIVD intrusion includes victim-side agent job artifacts; and the earlier Dragos OT tests document disruptive actions on lab hardware, not a production ransomware campaign. A GPT-6 Cyber exploit benchmark likewise cannot supply an unnamed real-world victim. The official threat review should therefore inform a measurement plan rather than be counted as an additional AI attack.