UK ministers commit frontier AI to hunting flaws in government systems
UK AI minister Kanishka Narayan said on October 12 that government will use frontier AI to find flaws in its systems, after hackathons found over 400 flaws. The fix-time fall from 50 days to eight is credited to a central monitoring service.
The Watch · Security desk
Before-and-after figure: the time taken to fix identified weaknesses fell from 50 days to 8 days, according to AI minister Kanishka Narayan, who credits the central vulnerability-monitoring service.
| Measure | Value | As of | Claim |
|---|---|---|---|
| Reported time to fix weaknesses, before | 50 days | 12 | |
| Reported time to fix weaknesses, after | 8 days | 14 |
What happened
- DCMS, the NCSC and the AI Security Institute will work together to develop ways to respond to and contain agentic AI incidents.
- Security minister Dan Jarvis will lead a cross-government cyber-defence program that includes AI threats, and a National Cyber Action Plan is due "soon".
- Amendments to the Cyber Security and Resilience Bill are meant to cover "loss-of-control" risks and AI-powered threats, including reporting of serious incidents and near misses.
- The AI Security Institute has resumed testing frontier models including Gemini 4 Argon, after the Trump administration had blocked access by testing bodies outside the US.
Why it matters
- Who's exposed exposure Operators of essential services are the stated target of the incident and near-miss reporting amendments, but the details of what they would have to report are still being worked out.
- What it limits constraint Whether mandatory AI incident reporting works depends on three definitions not yet fixed: which organisations are covered, what counts as frontier, and what counts as an incident.
- What's now possible capability Government is pointing at its own systems the class of model that has already hacked organisations, governments among them, during testing.
Narayan led with the speed figure. He said: "Our central vulnerability-monitoring service has already helped reduce the time taken to fix identified weaknesses from 50 days to just eight. Built on these advances, I want us to go further." [12] That is 42 fewer days, an 84% cut [14]. The sentence credits the monitoring service, and it covers weaknesses once they have been identified. Infosecurity Magazine's account does not attribute the speed-up to frontier AI [12].
The AI evidence is the other number. Frontier AI was used in internal GC3 hackathons to find over 400 software flaws in public sector IT, and those flaws were subsequently patched [13]. The report does not include a period for the hackathons, a severity mix or the number of systems scanned. It also does not say whether the eight-day fix time applied to those patches.
Carla Baker, senior director of UK policy at Palo Alto Networks, pointed to a different clock. Mandatory reporting, she said, must be paired with observability "so that incidents can be caught when they happen, and not weeks later" [11]. Her example was "OpenAI's agent in Australia's Medicare portal, for example, took months to be detected and disclosed." [8] A fix time that starts at identification does not measure that gap.
Richard Wainwright, field CTO for EMEA at Okta, called for kill switches to be considered as part of the bill [10]. "Everyone wants a 'big red button' to turn off rogue AI agents," he said [10].
What to watch
- Publication of the National Cyber Action Plan, which Narayan said would come "soon".
- The text of the Cyber Security and Resilience Bill amendments: whether they name covered organisations and define "frontier" and "incident".
- Any release of the period, severity mix and fix times behind the 400-plus flaws from the GC3 hackathons.
Clarity's read
What the record supports and how the coverage leans. The claims behind it follow.
Reality
- Evidence35
- Adoption25
- Hype gap+30
- Incentives55
- Confidence55
Claim ledger
Ranked by verification strength, evidence, and original report placement.
- [1]
Speaking at Imperial College London on October 12, AI minister Kanishka Narayan said that he, the DCMS cyber minister and the security minister would lead the urgent use of frontier AI capabilities to find weaknesses within government systems before attackers exploit them.
- [2]
DCMS, the National Cyber Security Centre and the AI Security Institute will work together to "develop robust ways" to respond to and contain agentic AI incidents.
- [3]
The agentic AI incident work follows a series of cases in which frontier models have hacked organizations, including governments, during testing.
- [4]
Security minister Dan Jarvis will lead a cross-government program to strengthen defenses against cyber-attacks, including from AI, and a National Cyber Action Plan will be published "soon".
- [5]
The Cyber Security and Resilience Bill will be amended to help protect organizations from "loss-of-control" risks and AI-powered threats, including identifying and reporting serious incidents and near misses, reducing AI-driven risk across essential services, and ensuring serious AI incidents can be properly reviewed.
- [6]
The AI Security Institute has resumed testing of frontier models including Gemini 4 Argon; the Trump administration had previously blocked access to such models by any testing bodies outside the US.
- [7]
Carla Baker, senior director of UK policy at Palo Alto Networks, said the success of a mandatory incident reporting regime will depend on which organizations it covers, what counts as "frontier", and how "incidents" are defined.
- [8]
Baker said: "OpenAI's agent in Australia's Medicare portal, for example, took months to be detected and disclosed."
- [9]
Many of the details related to the initiatives are still being worked out.
- [10]
Richard Wainwright, field CTO EMEA at Okta, called for kill switches to be considered as part of the Cyber Security and Resilience Bill, saying: "Everyone wants a 'big red button' to turn off rogue AI agents."
- [11]
Baker said: "if mandatory reporting is to have any impact, it must be paired with observability, including proper oversight of what agents are doing at runtime so that incidents can be caught when they happen, and not weeks later."
- [12]
Narayan said: "Our central vulnerability-monitoring service has already helped reduce the time taken to fix identified weaknesses from 50 days to just eight. Built on these advances, I want us to go further."
- [13]
A series of internal hackathons run by the Government Cyber Coordination Centre (GC3) used frontier AI to find over 400 software flaws in public sector IT, which were subsequently patched.
- [14]
A cut in fix time from 50 days to 8 days is 42 days, or 84%.
Get this ledger inside ChatGPT. Ask about any of our stories and the answer brings its figure, each claim’s verdict and the sources. Free, no account.
Sources
1 independent publisher whose own reporting we read for this story.
- infosecurity-magazine.comUK Government Announces Sweeping New AI Security Plans
1 article · October 13, 2026
Topics and entities
Follow any of these and your For You feed starts watching them — no settings page required.
Topics
- Agentic AI incidentsFollow
- AI safety and security policyFollow
- Government CybersecurityFollow
Entities
- Palo Alto NetworksFollow
- Department for Digital, Culture, Media and SportFollow
- Cyber Security and Resilience BillFollow
- Dan JarvisFollow
- National Cyber Security CentreFollow
- Kanishka NarayanFollow
- AI Security InstituteFollow
- Government Cyber Coordination CentreFollow
- OktaFollow