Zora Hauser

Notes On: British Spy Agency’s Latest Report 1. British intelligence agency NCSC, part of GCHQ, has its annual report out. It’s v interesting reading, touching on AI, agentic behaviour, and explicitly warns about China. 2. CEO Richard Horne opens with this: “The cyber challenge for the next decade is ensuring organisations are adequately prepared and can adapt quickly enough to defend themselves against AI‑powered attacks.” Security Minister Dan Jarvis adds “by far the biggest development in cyber security over the last decade is the advent of artificial intelligence.” 3. China gets substantial coverage relative to any other country in this report. Its “rapid development into a tech superpower is distinguished by its scale and its ‘whole-of- state’ approach, which sees it combine legislation, private sector contractors and technology development to achieve its goals. Data sits at the centre of China’s approach, and in this AI era, data is more valuable than ever. China uses its advanced cyber capabilities to acquire large amounts of information from the UK and elsewhere. It trains models, improves capability and generates insight. China’s ability to acquire, process and exploit vast quantities of information therefore has implications far beyond traditional espionage.” 4. China’s “adversarial cyber activity represents the most sophisticated and sustained cyber challenge facing the UK.” Furthermore, “China highly likely has the intent and is best positioned to use AI for operations against critical national infrastructure and other strategic targets.” NCSC then assess with a high degree of likeliness that “AI malware will be used in a ransomware attack on UK CNI.” 5. On agentic and automated AI, NSCS sets out a hypothetical future scenario. It’s 2028, and “A new threat has emerged in the form of an automated cyber actor, utilising frontier AI, which is no longer under its operator’s control. It is a realistic possibility such an entity could self-replicate and conduct cyber attacks at will, with no apparent motivation or restraint.” 6. The report looks to the near future. “As AI becomes embedded in connected devices that sense and act in the physical world - think robotics, autonomous vehicles, drones, connected medical devices and industrial systems - the consequences of compromise will also change.” 7. On the roles of an analyst: “Roles and skills will also change. AI can raise the productivity of experienced practitioners by allowing multiple lines of analysis, and a more strategic focus of effort. It can help those new to cyber security learn and broaden participation. However, if entry- level tasks are automated without redesigning training pathways, the profession may inadvertently weaken the pathways through which people acquire deep expertise. Organisations should preserve deliberate practice, mentoring and opportunities to work through problems rather than only review machine- generated answers.”