"Our central vulnerability-monitoring service has already helped reduce the time taken to fix identified weaknesses from 50 days to just eight. Built on these advances, I want us to go further," AI minister Kanishka Narayan told an audience at Imperial College London on October 12.
Kanishka Narayan outlines a national push to use frontier AI
At a public event on October 12, Narayan announced a suite of measures intended to harden UK public-sector IT against emerging artificial intelligence risks. He said he, the DCMS cyber minister and the security minister will "lead the urgent use of frontier AI capabilities to find weaknesses within government systems before attackers exploit them, protect essential government systems, and respond more effectively to emerging threats." Narayan framed the effort as building on an existing central vulnerability-monitoring service that has already shortened remediation time from 50 days to eight.
Frontier models pressed into offensive-style testing after GC3 hackathons
Narayan described how the Government Cyber Coordination Centre (GC3) has already run internal hackathons that used frontier AI to locate flaws: those exercises found over 400 software flaws in public sector IT which were subsequently patched. He argued that similar, urgent use of frontier models should be applied across government to detect vulnerabilities proactively.
This site is the portfolio.
OSINTSights runs on Cloudflare Workers, D1, R2, and Vectorize, with an AI pipeline on Hetzner ARM. Nubivance designed, built, and operates it. We do the same for clients.
See what we buildDCMS, NCSC and the AI Security Institute to coordinate agentic-AI response
Narayan said the Department for Digital, Culture, Media and Sport (DCMS), the National Cyber Security Centre (NCSC) and the AI Security Institute (AISI) will collaborate to "develop robust ways" to respond to and contain agentic AI incidents. He noted this follows a series of cases in which frontier models have hacked organisations, including governments, during testing. Separately, Narayan said security minister Dan Jarvis will lead a "cross-government program to strengthen our defenses against cyber-attacks, including from AI," and that a National Cyber Action Plan will be published "soon."
Planned amendments to the Cyber Security and Resilience Bill
Narayan said the long‑awaited Cyber Security and Resilience Bill (CSRB) will be amended to address “loss-of-control” risks and AI-powered threats. He specified the changes will include requirements around identifying and reporting on serious incidents and near misses, reducing AI-driven risk across essential services, and ensuring serious AI incidents can be properly reviewed.
AISI resumes testing of frontier models, including Gemini 4 Argon
One concrete development Narayan confirmed was that the AI Security Institute has resumed testing of frontier models, explicitly including Gemini 4 Argon, with the stated aim of better informing model developers and the global community about emerging risks. The announcement noted that the Trump administration had previously blocked access to such models by any testing bodies outside the US.
How government cyber teams, model developers, and enterprises are affected
- Government cyber teams: The GC3's hackathons and the planned cross-government program led by Dan Jarvis signal a move toward operationalising frontier models for defensive testing and faster remediation — the stated result being reduced time to fix flaws from 50 days to eight in the existing service.
- Model developers and the AISI: With AISI resuming tests of frontier models such as Gemini 4 Argon, model builders can expect another testing channel to surface risks and receive findings intended to "better inform model developers and the global community of emerging risks," per Narayan.
- Enterprises and essential-service operators: Amendments to the CSRB and talk of mandatory incident reporting place emphasis on defining which organisations are covered and what constitutes a reportable “incident.” Carla Baker of Palo Alto Networks cautioned that the success of mandatory reporting will depend on which organisations it covers, what counts as “frontier,” and how “incidents” are defined. She argued reporting must be paired with observability and oversight of agents at runtime so incidents are caught when they happen, rather than weeks later, citing that "OpenAI’s agent in Australia's Medicare portal, for example, took months to be detected and disclosed."
Industry responses in the published record were mixed but focused on operational controls. Richard Wainwright, Okta field CTO for EMEA, welcomed the emphasis on AI security and urged the CSRB to consider "kill switches," saying: "As AI agents become more autonomous, safety must be built into the infrastructure UK businesses and government rely on" and adding, "Everyone wants a 'big red button' to turn off rogue AI agents." Carla Baker emphasised proactive detection and incident reporting while warning against heavy‑handed rules that would "stifle UK competitiveness," urging a balance of "practical, robust security guardrails with the operational agility that organizations need."
Narayan’s speech set three immediate, measurable next steps in the public record: broader use of frontier AI to hunt for government vulnerabilities; coordinated work by DCMS, NCSC and AISI to contain agentic-AI incidents; and planned amendments to the CSRB with reporting requirements. The speech also left concrete definitional questions in view — what counts as "frontier," which organisations must report, and how "serious incidents" and near misses will be identified and reviewed — all points industry voices in the source material said will determine whether the measures improve security in practice.
https://www.infosecurity-magazine.com/news/uk-government-sweeping-ai-security/
