The British government has announced a range of new initiatives designed to better protect the nation from emerging AI threats.

Speaking at Imperial College London on October 12, AI minister Kanishka Narayan laid out a series of plans, including the use of frontier models to find vulnerabilities in government systems.

“Our central vulnerability-monitoring service has already helped reduce the time taken to fix identified weaknesses from 50 days to just eight. Built on these advances, I want us to go further,” he explained.

“I am announcing that the DCMS cyber minister, the security minister and I will lead the urgent use of frontier AI capabilities to find weaknesses within government systems before attackers exploit them, protect essential government systems, and respond more effectively to emerging threats.”

This follows a series of internal hackathons run by the Government Cyber Coordination Centre (GC3) where frontier AI was used to find over 400 software flaws in public sector IT which were subsequently patched.

Read more on government AI efforts: UK Government Launches AI Safety Scheme to Tackle Deepfakes.

Narayan also announced that the Department for Digital, Culture, Media and Sport (DCMS), the National Cyber Security Centre (NCSC) and the AI Security Institute (AISI) would work together to “develop robust ways” to respond to and contain agentic AI incidents.

That follows a series of cases in which frontier models have hacked organizations, including governments, during testing.

Additionally, security minister, Dan Jarvis, will lead a “cross-government program to strengthen our defenses against cyber-attacks, including from AI,” Narayan explained.

A National Cyber Action Plan will be published “soon,” he added.

There will also be amendments to the long-awaited Cyber Security and Resilience Bill (CSRB) to help protect organizations from “loss-of-control” risks and AI-powered threats.

“That includes identifying and reporting on serious incidents and near misses, including reducing AI-driven risk across essential services, and ensuring serious AI incidents can be properly reviewed,” Narayan said.

AISI Testing of Frontier Models Resumes

While many of the details related to these initiatives are still being worked out, there was at least confirmation of one positive development from the AI minister.

He revealed that the AISI has resumed testing of frontier models including Gemini 4 Argon, to help better inform model developers and the global community of emerging risks. The Trump administration had previously blocked access to such models by any testing bodies outside the US.

Narayan said that, in the future, the UK could extend this expertise and draw on its heritage in semiconductor design to nurture new capabilities in AI verification. This nascent field will help to ensure AI, and the outputs of models, comply with rules, regulations and safety standards.

Okta field CTO, EMEA, Richard Wainwright, welcomed the focus on AI security and called for kill switches to be considered as part of the CSRB.

“As AI agents become more autonomous, safety must be built into the infrastructure UK businesses and government rely on,” he added. “Everyone wants a 'big red button' to turn off rogue AI agents.”

Carla Baker, senior director of UK policy at Palo Alto Networks, praised the government's focus on proactive threat detection and incident reporting, arguing that adversaries are deploying AI “at scale” in attacks to accelerate intrusions and exfiltration.

"Defense must enable progress, not cause paralysis. Building national resilience isn't about imposing heavy-handed regulation that stifles UK competitiveness,” she continued. “By combining practical, robust security guardrails with the operational agility that organizations need, the UK can safely deploy frontier AI and win on the global stage."

The success of a mandatory incident reporting regime will depend on which organizations it would cover, what counts as “frontier” and how “incidents” are defined, added Manifold Security CEO, Neal Swaelens.

“Given we’re seeing time and time again that incidents of agentic AI breaches are being reported months after they occurred, if mandatory reporting is to have any impact, it must be paired with observability, including proper oversight of what agents are doing at runtime so that incidents can be caught when they happen, and not weeks later,” he argued.

“OpenAI’s agent in Australia's Medicare portal, for example, took months to be detected and disclosed.”