AI-Powered Cyberattacks: What to Expect by 2028

November 4, 2026

AI Powered Cyberattacks: What Organizations Should Expect by 2028 and Beyond

4 November 2026

Artificial intelligence is already changing cyberattacks, but not in the way the most dramatic predictions suggest. The clearest evidence does not show AI independently inventing entirely new forms of intrusion, it shows attackers using AI to perform familiar work faster, at greater scale, and with fewer specialist resources. Reconnaissance becomes easier, phishing becomes more convincing, malware can be modified more quickly, vulnerabilities can be investigated sooner, and social engineering can be personalized across thousands of potential targets.

The next stage is more consequential. AI systems are beginning to perform connected sequences of offensive tasks, including reconnaissance, vulnerability discovery, exploitation, credential analysis, and data collection. These systems remain unreliable and usually require human direction, but the movement from AI-assisted attacks towards semi-autonomous operations is no longer theoretical. For organizations, the central risk is therefore not a sudden appearance of an all-powerful autonomous hacker. The gradual compression of the attack cycle allows attackers to move from target selection to exploitation more quickly than many organizations can identify exposed assets, prioritize vulnerabilities, approve changes, and deploy protections.

That is the real significance of the UK National Cyber Security Centre’s warning about AI-powered attacks on critical infrastructure by 2028.

What the NCSC's 2028 Warning Actually Says

In November 2026, the National Cyber Security Centre published an assessment, Artificial intelligence and cyber intrusion, examining AI-enabled intrusion through 2028. Its central judgement is not that a fully autonomous AI system will inevitably compromise critical infrastructure in 2028. The assessment says it is highly likely that AI-powered malware will have been used in a ransomware attack against UK critical national infrastructure between now and 2028.

It also assesses that:

Russia, China, and other nation states are highly likely to use AI routinely in support of geopolitical cyber operations by 2028.
Many systems are almost certain to remain vulnerable to AI-enabled tools capable of identifying and exploiting weaknesses.
Attackers are likely to apply AI capabilities against known vulnerabilities in legacy critical infrastructure technology.
The adoption of AI within critical infrastructure will create additional attack surfaces that adversaries may attempt to exploit.

These judgements use formal intelligence probability language, they should not be interpreted as guarantees. The report also presents baseline, pessimistic and optimistic scenarios as plausible trajectories, rather than predictions of what will definitely occur. The distinction matters. The NCSC is not forecasting a specific attack, target, or technical breakthrough. It is warning that AI will increase the speed, scale, and efficiency of offensive activity while many critical systems continue to carry unresolved vulnerabilities and technical debt. The agency’s message is therefore as much about the condition of the technology estate as it is about advances in attacker capability. AI did not create unsupported operating systems, weak identity controls, exposed management interfaces, incomplete asset inventories, or slow patching processes. It makes those weaknesses easier to find and exploit repeatedly.

NCSC Annual Review 2026

What Has Already Changed

AI-Assisted Attacks

This is the most established category. Attackers use general-purpose AI systems to research technologies, translate and refine phishing messages, troubleshoot code, analyze stolen information, create scripts, and support malware development. Human operators still select targets, make strategic decisions, and control the operation. Google Threat Intelligence Group reported in February 2026 that government-backed actors associated with China, Iran, North Korea, and Russia were using LLMs for technical research, targeting, and the rapid production of more nuanced phishing material. Google said it had not observed these actors achieving breakthrough capabilities that fundamentally changed the threat landscape. This is consistent with the practical reality facing most organizations today. AI is primarily a productivity multiplier for attackers.

GTIG AI Threat Tracker: Distillation, Experimentation, and (Continued) Integration of AI for Adversarial Use

AI-Enabled Malware in Active Operations

The evidence has also moved beyond simple content generation. In a November 2025 threat assessment, Google identified malware families that called large language models during execution. Examples included tools that generated scripts, changed their code, or created malicious functions dynamically rather than relying entirely on instructions written in advance. This activity was described as nascent, but it represents an important development. Malware that can adapt selected behaviors during execution may be harder to detect using controls designed around static code, known indicators, and predictable execution patterns.

It does not mean malware has become independently intelligent. The models still operate within boundaries established by their developers and operators, and access to external models can introduce latency, availability, and detection risks. Nevertheless, the use of AI at runtime is a demonstrated operational capability rather than a laboratory concept.

GTIG AI Threat Tracker

AI-Orchestrated Intrusion Activity

The strongest public evidence for semi-autonomous offensive AI came from Anthropic’s investigation of a cyber espionage campaign detected in September 2025. Anthropic attributed the operation with high confidence to a Chinese state sponsored group. According to its investigation, the attackers manipulated Claude Code into supporting reconnaissance, vulnerability discovery, exploitation, lateral movement, credential harvesting, data analysis, and exfiltration across roughly 30 targets. A small number of intrusions were reportedly successful. Anthropic estimated that AI performed between 80% – 90% of tactical activity, while human operators retained responsibility for campaign selection, authorization, and strategic decisions.

This was not a fully autonomous cyberattack. It was a human directed operation in which AI agents carried out much of the repetitive technical work. That still represents a material change, it shows that a capable operator can use agents to run tasks in parallel, maintain operational tempo, and investigate multiple targets at a rate that would be difficult for a human team to sustain.

Full report: Disrupting the first reported AI-orchestrated cyber espionage campaign

AI Enabled Fraud and Impersonation

AI-generated audio, video, and synthetic identities are also being used in active criminal campaigns. In May 2025, the FBI warned that malicious actors were using AI-generated voice messages to impersonate senior US officials. The messages were used to establish trust, move conversations to other platforms, and attempt to acquire account access or sensitive information. The FBI’s 2025 Internet Crime Report subsequently recorded 22,364 complaints categorized as AI-related, involving reported losses of nearly $893 million. This figure measures complaints submitted to the FBI’s Internet Crime Complaint Center. It does not represent every AI-enabled fraud incident, and it should not be treated as a complete measure of worldwide losses. These cases matter because they show how AI can attack identity and trust without exploiting a software vulnerability. A convincing voice message, synthetic video, or personalized conversation can be used to influence help desks, executives, suppliers, finance teams and employees with privileged access.

Cryptocurrency and AI Scams Bilk Americans of Billions

AI is Changing the Economics of Cybercrime

The most immediate impact of generative and agentic AI is economic. Cybercrime has long depended on division of labor. Initial-access brokers obtain credentials; malware developers build tools, affiliates conduct intrusions. Other specialists launder funds or negotiate extortion payments. AI can reduce the time and expertise required at several points in this chain.

Digital target touch point illustrating how attackers identify and analyze potential organizations during cyber reconnaissance.

Reconnaissance and Target Selection

Attackers can use AI to collect and summarize information from company websites, job descriptions, technical documentation, code repositories, professional profiles, procurement notices, and previous breaches. The value is that AI can connect separate pieces of information into a working target profile. A job advertisement might identify a cloud platform. A support document might reveal a remote-access product. A public code sample might expose naming conventions or credentials. At scale, attackers can use this information to prioritize organizations with particular technologies, exposed systems, or valuable relationships.

Unlocked digital padlock representing a cybersecurity vulnerability that attackers could identify and exploit.

Vulnerability Discovery and Exploitation

AI systems are becoming more capable of reviewing source code, analyzing software behavior, and developing proof-of-concept exploits. This does not mean any attacker can ask a chatbot to compromise an organization. Exploit development still requires environmental knowledge, testing, and the ability to handle unexpected conditions. The more immediate risk concerns known vulnerabilities. Once a vulnerability is publicly disclosed, AI can help attackers understand the affected component, adapt existing exploit code, and scan for exposed systems. This can shorten the time between disclosure and widespread exploitation.

Digital globe surrounded by blue network connections representing automated vulnerability scanning across interconnected systems.

Verizon’s 2026 Data Breach Investigations Report analyzed more than 31,000 security incidents, including more than 22,000 confirmed breaches in 145 countries. It found that vulnerability exploitation accounted for 31% of breaches, overtaking stolen credentials as the leading initial entry point in its dataset. AI was not necessarily responsible for every one of those breaches. The finding demonstrates why faster attacker analysis matters. Organizations already struggle to patch known weaknesses before criminals exploit them. AI increases the pressure on that existing weakness.

Verizon 2026 Data Breach Investigations Report

Phishing and Social Engineering

Traditional mass phishing is constrained by poor language, generic content, and limited knowledge of the intended victim. Generative AI reduces all three constraints. An attacker can create messages in multiple languages, adjust tone for different roles, and incorporate information about a target’s organization, colleagues, projects or suppliers. The same workflow can generate thousands of individually tailored messages rather than one generic template. The result is the possibility of personalized phishing at mass-mailing scale.

AI can also maintain conversations. Instead of relying on a single email, an automated system can respond to questions, adjust its story, and move victims towards credential theft, payments, or malware installation. This will make traditional awareness advice less reliable. Grammar, spelling, and awkward phrasing are no longer dependable indicators of fraud.

Rows of email icons with one highlighted in red, representing a compromised account used in a business email compromise attack.

Business Email Compromise and Impersonation

Business email compromise depends on context and authority. Attackers impersonate executives, employees, suppliers, or professional advisers to redirect payments or obtain sensitive information. AI can improve these schemes by analyzing previous correspondence, reproducing writing styles, generating plausible replies, and combining email with synthetic voice or video. An attacker who compromises one mailbox can use AI to identify payment discussions, understand organizational relationships, and produce messages consistent with the existing conversation. A realistic voice, familiar writing style, or apparently accurate knowledge of an internal project should no longer be treated as sufficient proof of identity.

Malware alert displayed on a computer screen, representing the detection of malicious software or ransomware activity.

Malware and Ransomware

AI can assist criminals with code generation, debugging, obfuscation, and the modification of existing malware. It can also help operators analyze a victim environment after gaining access. This will benefit less experienced criminals, but it will not eliminate the need for operational knowledge. Deploying ransomware across a complex network requires credentials, privilege escalation, lateral movement, evasion, data collection, and an understanding of which systems can create maximum leverage.

More capable groups are likely to use AI to accelerate these tasks. Less capable groups may use it to improve individual components while still relying on established criminal services. The likely outcome is that the minimum viable capability for conducting harmful attacks increases.

How Close Are Fully Autonomous Cyberattacks

A fully autonomous offensive system would have to perform a long sequence of tasks reliably:

Select an appropriate target.
Map its internet-facing infrastructure.
identify technologies and vulnerabilities.
Choose or generate an exploit.
Establish and maintain access.
Acquire credentials and privileges.
Navigate an unfamiliar internal environment.
Avoid detection.
Identify valuable information or operational systems.
Exfiltrate data or deploy a disruptive payload.
Recover when assumptions prove incorrect.

AI agents can already perform parts of this sequence under controlled conditions. Public reporting also shows agents supporting connected sections of real intrusion activity. The limiting factor is reliability.

Enterprise environments contain incomplete documentation, unusual configurations, defensive controls, deceptive signals, and operational dependencies. A mistake that is harmless in a coding benchmark can expose an intrusion, damage the target prematurely, or lock the attacker out. Agents also struggle with long-running tasks, ambiguous objectives, and error recovery. They may misinterpret tool output, invent facts, repeat unsuccessful actions, or choose an approach that appears reasonable but does not work in the target environment. Human attackers are better at judging when to pause, change tactics, or abandon an operation. They also understand political, financial, and operational consequences that cannot be captured reliably in a technical objective. For these reasons, fully autonomous end-to-end attacks without meaningful human supervision remain difficult. Semi-autonomous attacks are much more realistic. Human operators can set the objective, approve consequential actions, and let agents perform reconnaissance, analysis, scanning, and selected exploitation tasks.

The practical progression is therefore:

Human-led attack: People perform and coordinate most tasks.

AI-assisted attack: AI supports research, content creation, coding and analysis.

AI-orchestrated attack: Human operators define objectives while agents execute substantial parts of the workflow.

Autonomous attack: AI selects targets and conducts the complete operation with little or no human oversight.

The first three stages are already visible in public evidence. The fourth remains a future capability rather than a dependable operational model.

NIST: Strengthening AI Agent Hijacking Evaluations

What Changes Between Now and 2028

The evidence supports several developments with different levels of confidence.

Highly credible near-term developments

AI will continue to increase the speed and volume of phishing, impersonation, vulnerability analysis and malware development. Attackers will use AI across more of the intrusion lifecycle rather than as a standalone writing or coding tool. Semi-autonomous agents will allow capable groups to investigate more targets simultaneously. Known vulnerabilities, exposed services, weak credentials, and legacy systems will become easier to identify and exploit at scale. Synthetic voice, video, and identity material will become a routine component of fraud and social-engineering operations.

Plausible developments by 2028

Adaptive malware may use external or locally deployed models to alter scripts, commands, or obfuscation during execution. Criminal service providers may offer agent-based reconnaissance, vulnerability analysis, and victim-profiling capabilities to customers with limited technical expertise. Attackers may automate the creation of highly personalized, multilingual campaigns against large populations. State-linked groups may use coordinated groups of agents for intelligence gathering and intrusion support. AI systems may reduce the time between disclosure of a vulnerability and practical exploitation, increasing the importance of exposure-based patching and compensating controls.

Less certain developments

The evidence does not justify assuming that reliable, fully autonomous end-to-end attacks will become commonplace by 2028. It is also uncertain whether AI will consistently discover and exploit previously unknown vulnerabilities faster than defenders. Offensive and defensive capability will advance together. AI is already helping security teams analyze malicious code, investigate alerts, identify vulnerabilities, and automate response. The outcome will depend less on whether attackers possess AI and more on whether organizations can deploy defensive improvements faster than adversaries can exploit their weaknesses.

Known Exploited Vulnerabilities Catalog

The Early 2030s: Capability May Matter Less Than Access

Looking into the early 2030s involves greater uncertainty. Model capability will improve, but capability alone will not determine the threat. Three other factors will be critical.

First, agents will gain access to more tools. An AI model that only produces text presents a different risk from an agent connected to a browser, terminal, cloud environment, identity platform, and software-development pipeline.

Second, agents will become more persistent. Systems capable of maintaining state, coordinating subtasks, and operating for extended periods will be better suited to lengthy intrusion workflows.

Third, offensive capability may become increasingly commoditized. If sophisticated reconnaissance and exploitation workflows are packaged into accessible criminal services, the number of actors able to conduct credible attacks may rise even if the underlying techniques remain familiar.

The long-term risk is therefore not only that AI becomes more intelligent. Capable models becoming connected to tools, data, and infrastructure that allows them to act repeatedly and at scale is where the true risk lies.

What Organizations Should Do Now

1. Know What Is Exposed

Maintain an accurate inventory of internet-facing assets, cloud services, domains, remote-access systems, APIs, and operational technology gateways. Compare internal inventories with external attack-surface monitoring. Unknown assets and forgotten services are particularly attractive to automated reconnaissance.

2. Prioritize Exploitable Vulnerabilities

A vulnerability score alone is not enough. Prioritization should consider whether the asset is exposed, whether exploitation has been observed, what privileges an attacker could gain, whether the system supports an essential service, and what compensating controls exist. The CISA Known Exploited Vulnerabilities Catalogue should be incorporated into vulnerability-management decisions. For critical systems that cannot be patched quickly, organizations should document isolation, monitoring, access restrictions, and recovery measures.

3. Modernize Identity Security

Deploy phishing-resistant authentication for administrators, remote access, and high-risk business functions. Passkeys and hardware-backed FIDO2 authentication provide stronger protection than passwords or one-time codes that can be captured through phishing. Restrict standing administrative privileges. Monitor the creation of new accounts, unusual token use, suspicious consent grants, and changes to authentication methods. Help-desk verification procedures must also account for synthetic voice and convincing personal information. A familiar voice should not override an established identity-verification process.

4. Introduce Independent Verification for Sensitive Actions

Financial transfers, changes to supplier details, credential resets, and disclosure of sensitive information should require verification through a separate approved channel. The process should apply even when a request appears to come from a senior executive. Authority and urgency are precisely what impersonation attacks exploit.

5. Reduce Technical Debt

Legacy platforms, unsupported software, and fragmented security architectures create the conditions AI-enabled attackers can exploit. Critical and important infrastructure operators should identify systems that cannot be patched, replaced, or isolated within acceptable timeframes. These risks should be visible to executive leadership, with named owners and funded remediation plans. Technical debt is not only an IT maintenance issue. It determines how quickly an organization can respond when attackers compress the time available for defense.

6. Prepare for Faster Incidents

Incident-response plans should assume attackers can conduct reconnaissance, credential analysis, and lateral-movement activity more quickly. Test detection and containment for identity compromise, cloud-token theft, supplier impersonation, ransomware, and the loss of remote-access infrastructure. Exercises should include operational decision makers, legal teams, communications staff, and business-service owners, not only security personnel.

7. Monitor AI Use Inside the Organization

Organizations must understand which AI applications and agents can access corporate data, execute code, call APIs, or take actions in business systems. Record each agent’s owner, purpose, permissions, data access, integrations and escalation path. Apply least privilege and maintain logs detailed enough to reconstruct what the agent did and why. NIST has highlighted agent hijacking as a material security risk. An agent may process a malicious instruction hidden in an email, document or website and take an unintended action. Treating external content as untrusted input is therefore as important for AI agents as it is for conventional applications.

8. Use AI Defensively but Retain Accountable Oversight

AI can help security teams summarize alerts, correlate evidence, analyze malicious code, and accelerate investigation. This is valuable when the volume of security data exceeds the capacity of human analysts. However, high-impact response actions should remain governed by clear policies. Automated containment can reduce attacker dwell time, but unreliable automation can also interrupt essential services. The goal should be controlled acceleration, not automation without accountability.

The Outlook

Artificial intelligence will not replace the fundamentals of cyber defense. It will expose where those fundamentals are missing.

Between now and 2028, organizations should expect attackers to use AI to find weaknesses faster, personalize deception, adapt malicious code, and coordinate more of the intrusion process. Semi-autonomous operations will become more credible. Fully autonomous end-to-end attacks may emerge in limited settings, but the public evidence does not support treating them as the dominant near-term threat. The more immediate issue is that AI changes the economics and tempo of existing attacks. It allows capable groups to operate at greater scale and gives less capable actors access to better research, code, and deception. For organizations responsible for critical services, the response should not be panic or speculative investment. It should be a disciplined program focused on exposure, identity, vulnerability management, technical debt, operational resilience, and the secure governance of AI agents.

The organizations best prepared for AI-enabled attacks will not necessarily be those with the most AI security products. They will be those that can see their environment clearly, make risk decisions quickly, apply controls consistently, and continue operating when preventive measures fail.