Attacks that once needed specialist skills can now be automated with frontier AI, the most advanced AI tools available. That makes them easier, faster and cheaper to run, and organisations without basic protections are the easiest to attack.
That is the warning in Frontier AI: what you need to know, guidance from the National Cyber Security Centre (NCSC), the UK government's cyber authority.
What AI attackers can already do
The NCSC and the AI Security Institute tested seven frontier models on a simulated 32-step attack on a company network, a job a human expert would need about 14 hours to complete. Read the full findings.
As of March 2026, no public model finished the full attack. The best one completed 22 steps in its best run, and a full attempt cost around £65.
Without extra processing time, the best model averaged nearly 10 steps, up from fewer than two 18 months earlier. The NCSC says the limiting factor is increasingly funding.
The NCSC expects AI to speed up attacks on soft targets, the organisations with weak basic protections.
What it means for your business
Technical debt is the backlog of old, unpatched or unsupported technology that every organisation carries. NCSC CTO Ollie Whitehouse warns that AI is now exploiting it at scale, and expects a “patch wave”: a rush of software updates as new flaws are disclosed.
The NCSC's advice is to prioritise anything exposed to the internet, switch on automatic updates, and replace technology that no longer receives updates.
The second risk is the AI tools your own team uses. For organisations running AI agents (tools that can plan and act on your behalf), the NCSC's interim guidance on agentic AI says each agent should have its own identity, only the access its task needs, and a way to shut it down quickly.
Access limits matter more because of prompt injection: text hidden in an email, CV or web page that tricks an AI tool into following an attacker's instructions. The NCSC says it may never be fully mitigated, so the aim is to reduce the risk and the impact. Its advice is not to let an AI tool that processes emails from outside people have access to privileged tools, and to be wary of any product that claims it can stop prompt injection.
AI-written code needs the same thought. The NCSC's vibe coding spectrum says fully AI-built code can be fine for low-risk work such as prototypes and internal tools. Anything that handles logins or sensitive data needs human review.
What to do about it
The NCSC says strong fundamentals still protect against AI-assisted and conventional attacks alike. It names accurate asset inventories, robust access controls, secure configuration and comprehensive logging. For a small business, four checks put that into practice.
- Update by default. Switch on automatic updates and name an owner for each system.
- Know what you expose. List every website, login page and cloud service reachable from the internet, including old ones nobody uses.
- Limit what AI tools can reach. Give each tool only the access its job needs, keep tools that read outside emails or documents away from sensitive systems, and keep a way to switch them off.
- Review AI-written code before it handles logins or customer data.
Our Vulnerability Scan checks your internet-facing systems every day for known flaws, and tells you what to fix first.
Our Recon Scan maps what's reachable on your network from the outside.
The good news
The NCSC believes AI will ultimately be a “net positive” for cybersecurity. It says defenders keep an advantage because they can shape their own environment.
Attack activity from the models it tested tends to set off alerts that are easy to spot, where monitoring is in place.
The NCSC says AI amplifies the strengths and weaknesses you already have. Getting the foundations right needs urgent action now, and the attention of the people running the business.
Find out where you'd stand
See what an attacker would see with a free HackRisk Report. It's completely free and arrives within 24 hours.