GCHQ to build AI national cyber shield for UK infrastructure

GCHQ has drawn up plans for a national cyber shield that will use agentic artificial intelligence to defend the United Kingdom’s critical infrastructure. The program aims to deploy autonomous AI agents to spot threats and act at machine speed to identify and repair software vulnerabilities in systems that support energy, water, healthcare, transport and financial services. Officials expect the capability to be operational within five years.

GCHQ director Anne Keast-Butler outlined a blueprint to “hardwire cutting-edge agentic AI into machine-speed cyber defence,” saying the agency is rethinking how cyber security can operate when defensive actions need to keep pace with automated attacks. The design focuses on detecting emerging threats across multiple sectors and on automating responses to limit damage from rapid intrusions.

Keast-Butler pointed to advances in frontier AI that can reveal large numbers of previously unknown security flaws in commonly used software, a development cited as a factor behind the program’s urgency. The Cabinet Office has asked leading AI companies to work with government on the project, and ministers have described the effort as a long-term national program.

Security minister Dan Jarvis has argued that protecting critical national infrastructure in the age of AI will require different approaches than relying only on off-the-shelf vendor products. The government plans to seek a mix of domestic partners and international technology where appropriate.

GCHQ intends to integrate frontier AI into its own analytic tools for tasks such as translating foreign languages and finding relevant signals in large volumes of data, to help analysts identify important information more quickly. The agency said those capabilities will support defensive work carried out by the National Cyber Force, which conducts daily operations to counter state threats, terrorists and criminals.

Protecting undersea cables and pipelines is a stated priority after officials reported an increase in hybrid actions aimed at undermining infrastructure, supply chains and public trust. Keast-Butler described steps being taken to disrupt attempts to smuggle Western technology, fend off cyber attacks targeting the UK and Europe, and reduce the Russian threat.

Officials also flagged threats from emerging technologies. Keast-Butler warned that advances in quantum sensing and, eventually, quantum computing could shorten tasks that take years today to seconds, including the potential to break current encryption. Businesses were urged to follow National Cyber Security Centre guidance to move toward algorithms that resist quantum attacks.

Space-based systems are another focus as governments and companies launch thousands of new satellites to support global data flows. Keast-Butler noted investment by other states in space capabilities and said the UK will work with partners to secure and defend communications and navigation systems.

GCHQ emphasized its longstanding role in cryptography, noting agency mathematicians developed public key cryptography in the 1970s and are now working on new forms of encryption designed for the quantum era. Keast-Butler said tech sovereignty should mean the ability of nations to shape their own digital future by supporting domestic research and industry while managing supply chains and dependencies.