UK Uses AI to Find 1,352 Cybersecurity Flaws

By Suad Seferi · 12 October 2026

The United Kingdom is expanding its use of artificial intelligence to protect government systems after two pilot programmes identified and addressed 1,352 cybersecurity vulnerabilities across 548 code repositories in 18 government departments. The findings were announced on October 12, 2026, as British authorities introduced further measures to strengthen national cyber defences and prepare for security threats involving increasingly autonomous AI systems. The initiative represents a practical application of advanced AI in government cybersecurity, demonstrating how AI models can help identify software weaknesses while raising new questions about the security of autonomous systems themselves. AI Finds Weaknesses in Government Software The UK's Government Cyber Unit has been testing frontier AI models to identify vulnerabilities in public-sector software and improve the detection of advanced cyber threats. Following the results of two pilot programmes, the government announced plans to extend the use of AI-assisted vulnerability detection, particularly across systems considered critical to national security and public services. An earlier government case study provides insight into how the technology was deployed. Over one month, technical teams worked across nine government organisations, using AI models to examine public code repositories. The exercise produced 407 findings, including serious vulnerabilities involving authentication bypass, potential data exposure and remote code execution. According to the government, all critical vulnerabilities identified during that exercise were remediated, with no evidence that they had been exploited. The reported cost of AI model usage was approximately £13,000. Among the findings was a vulnerability involving an automated GitHub workflow used by a government digital service. A specially constructed comment on a pull request could have triggered unauthorised code execution, potentially exposing credentials and other sensitive information. The example demonstrates how AI-assisted analysis can uncover security weaknesses that arise from interactions between different software components. However, the government's overall figure of 1,352 vulnerabilities does not come with a complete public breakdown of the severity of every finding or the validation methods used across both pilot programmes. Britain Prepares for Security Incidents Involving AI Agents Photo: Getty Images / GCHQ cyber defence operations room The government's announcement also addresses a different category of cybersecurity risk: autonomous AI agents. Unlike conventional AI assistants that primarily respond to requests, autonomous agents can perform sequences of actions, access connected systems and execute tasks with limited human intervention. These capabilities introduce new operational risks. An AI agent with access to sensitive systems could act outside its intended instructions, mishandle confidential information or perform actions with unintended consequences. British authorities are working with the National Cyber Security Centre and the AI Security Institute to develop an approach for responding to serious incidents involving such systems. The work will examine how organisations can identify, investigate and contain incidents where autonomous AI behaviour contributes to security failures. Existing cybersecurity procedures are largely designed around malicious actors, compromised infrastructure and conventional software vulnerabilities. Autonomous systems introduce additional considerations, including the permissions granted to agents, the instructions they follow and the mechanisms available to interrupt their actions. The government has not yet published a completed incident-response framework. AI Risks Could Shape New Cybersecurity Rules The UK is also examining whether its Cyber Security and Resilience Bill should more explicitly address risks associated with advanced artificial intelligence. Potential measures include stronger reporting requirements for serious AI incidents and near misses, improved information sharing and additional protections for essential services. Healthcare, energy and water infrastructure are among the sectors where disruptions to digital systems could have significant consequences. These proposals remain under consideration and should not be confused with requirements already established in law. Separately, the UK's AI Security Institute continues to evaluate advanced AI models, including through testing arrangements that provide access to models before their public release. Independent evaluation has become an increasingly important part of the government's approach to AI safety, particularly as models gain capabilities that allow them to interact directly with software systems and external tools. Finding Vulnerabilities Is Only the Beginning The government's findings demonstrate the potential value of using advanced AI to inspect large software repositories and identify weaknesses that may otherwise remain undetected. They also illustrate an important distinction between discovering a vulnerability and improving the security of an entire organisation. AI-generated findings still require technical validation. Security teams must determine whether identified weaknesses are exploitable, assess their severity and implement appropriate fixes. A large number of reported vulnerabilities does not necessarily indicate a proportional improvement in cybersecurity. The significance depends on the quality of the findings, the risks involved and whether the problems are successfully resolved. The earlier UK pilot provides useful evidence of practical results, including documented vulnerabilities and remediation. The broader programme will require similarly transparent reporting to establish whether AI-assisted detection can consistently outperform or complement existing security methods. The Next Phase of AI-Powered Cyber Defence The British government is mov…