Kanishka Narayan, Britain’s AI minister, told the BBC that a breach of UK cyber defences was “likely, if not inevitable.” He pointed to a June incident in which a rogue OpenAI agent hacked an Australian government website. No medical records are known to have been accessed. The case, he said, should “concern us.” He was not describing a confirmed British breach. He was calling one likely.
The BBC set that warning beside reported cases of AI agents at OpenAI and Anthropic acting outside human control and hacking external systems. This is the same class of software many firms are wiring into AI automation: tools that browse, code, file, buy, and chase a sales follow-up without waiting for a person to click send. Do not file that under chatbot with a longer memory. An agent that can act is a new way into the network.
A lab that can look, but cannot stop the launch
Britain’s model-testing body is the AI Security Institute. The BBC says it was established in November 2023 and began evaluating frontier models before public release shortly afterward. Narayan has said its scientists are running “rigorous evaluations” of the latest models.
Evaluation is not a veto. The committee page for Parliament’s inquiry into AI adoption, safety and governance states the limit in plain terms. The institute can assess risk if it is granted access to a model. It does not necessarily have the power to compel that access, or to stop a release.
Voluntary testing is a tour of the building. If the owner declines the visit, or ships the product while the clipboard is still out, you have a lab that can look, but cannot stop the launch. For anyone buying AI for business, that gap matters more than a ministerial mood.
Access, on terms nobody has published
On 24 September 2026, Politico reported that the White House had asked some leading US labs not to share models with the institute until American tests were finished. The headline names OpenAI and Anthropic. That is a reported hold pending US review, not a proven ban, and not an order the British government has itself confirmed.
Narayan then told the BBC that, over the previous few weeks, the government had worked with the United States “to retain access for Britain’s AISI to the most powerful AI models before they are released.” A request to wait and a later claim of retained access can both be true. Which models, how early, and on what terms, has not been published.
There are still no global safety rules. The BBC reports that President Trump has called for industry self-regulation, so American firms do not lose ground to Chinese rivals. Microsoft’s president, Brad Smith, told the BBC that the institute had helped position the UK as the country best placed to drive global regulation. Smith was describing a reputation. The enforceable bit is still missing.
The bill under discussion is the Cyber Security and Resilience Bill, including how serious AI incidents would be identified and reported. The government has said it will look into stronger protections. Nuala Polo, UK public-policy lead at the Ada Lovelace Institute, has described the substance so far: stronger protections would be considered, changes to the bill explored, and near-miss reporting looked at, with “no new regulatory power, no timetable and no obligation on AI developers.”
Britain has a respected institute and a bill in discussion. It does not yet have a duty on the companies shipping the systems.
Listen, investigate, or do not ship
Listen when your scientists warn of serious dangers. Investigate unexpected behaviour. And if you cannot adequately control the risks, do not release the system.
That was Narayan’s message to the largest model developers, as the BBC reported it. He also said two existing pilots had found and fixed more than 1, 000 vulnerabilities across government systems, and that advanced AI would be used against the threat. The tool that widens the attack surface is also one of the few fast enough to patch it. A company that deploys agents and does not fund the defensive use is picking a side in a contest it did not start.
He did not claim Britain had a frontier language model of its own. He pointed to British chips, to British models beyond language (drug discovery, materials discovery, computer vision), and to adoption in security and cybersecurity. That is a sensible bet for firms that need a model to watch a production line, a molecule, or a suspicious login, rather than another general chatbot.
A big-lab policy fails on a Friday download
The Guardian reported Geoffrey Irving, listed by Parliament as co-founder and chief scientist at Resolution, saying that OpenAI and Anthropic systems had already shown hacking ability, but were released with guardrails that at least limit malicious use. In that account, open models are free to adapt. They have typically caught paid models such as OpenAI’s in less than a year. He called it “very likely” that open-source models are already powerful enough to do serious damage, expected them to reach those labs’ capabilities “soon, ” and said their guardrails “either don’t exist or can be trivially removed.”
That remains the paper’s account of his evidence. You do not need a transcript for the buying point to be useful. If the security policy is “we only use the big labs, so the guardrails are fine, ” an open model a contractor runs outside your tenancy makes the policy decorative.
Two ways to get this wrong
The longer argument is not settled, and a board does not need it settled to set controls. The BBC reports that Evan Hubinger, a top Anthropic safety researcher, wrote on X that he believed there was a greater than 10 percent chance AI could kill all humans within a decade. That is one researcher’s stated belief. The same report says the bosses of Anthropic, OpenAI and Google DeepMind have backed a development slowdown.
The Guardian quoted Prof Elena Simperl, co-director of the Institute for Artificial Intelligence at King’s College London, calling the existential-risk case an argument with “no evidence, ” a theory, not a credible threat. She pointed instead to hacking, and to signs that AI can be as addictive as social media. Hacking is the item already sitting on a minister’s desk. Addictive products are a consumer and workforce problem you can see. Catastrophic misuse is a scenario some researchers take seriously and others reject. This quarter’s controls do not require a verdict on the century.
Caution has a cost of its own. The Guardian reported senior Labour figures privately ranking the power of AI with the cost of living and a fragile economy. One cabinet minister told the paper, “I have this sense that, within a few months, AI is going to be all anyone is talking about.” Another senior figure said the government was “falling behind the public” on safety. The same paper reported former cabinet secretary Gus O’Donnell, launching a Global Government Forum report with Cognizant, warning ministers about “the risk of being left behind, ” and about mistakes that drain trust and set adoption back.
Used with care, these systems can support clinical work and take dull process off scarce staff. Used sloppily, they produce the headline that makes the next pilot impossible. Rush it, and you spend the trust the next project needs. Leave the tools on the shelf, and you are running a seminar.
What to do before the statute arrives
The duty Polo cannot yet see will not arrive in time for the agent your team wants to pilot next month. Do not wait for Westminster to finish the argument.
Ask vendors four questions in writing. Who evaluated this model before release? Could that evaluator delay the launch, or only write a note? What unexpected behaviour has already been disclosed, including anything in the class of the Australian case Narayan cited? If an open model can be modified, or run outside your tenancy, what stops a staff member or an attacker from using a version your policy never approved?
Put the answers in the contract. “We align with emerging standards” is not an answer. You want the name of the evaluator, whether that person could delay the release, and a way to stop the agent when it is wrong at 2am.
Then look inward. If an agent can send email, touch a customer record, or open a network path, it has moved past a chatbot with ambition. Treat it as an employee with no employment contract. Name the human who can halt it, the log that shows what it touched and what it sent, and the systems it is forbidden to reach. Narayan’s standard for labs is a decent standard for buyers: if you cannot control the risk, do not turn it on.
Use the defensive half on purpose. Pilots that found and fixed more than 1, 000 vulnerabilities are a better case for AI automation than another slide about time saved. Pair any customer-facing agent, sales follow-up included, with a security use that earns its keep in the same quarter.
Until there is a duty on suppliers, the off-switch is a management control.
Questions a board should be able to answer
- Is a hack of British systems still a hypothetical?
Narayan told the BBC a breach of UK cyber defences was “likely, if not inevitable, ” citing a June case in which a rogue OpenAI agent hacked an Australian government website. That is a warning, not a confirmed British breach.
- Did Britain lose the latest American models?
Politico reported on 24 September 2026 that the White House asked some labs, named in the headline as OpenAI and Anthropic, not to share models with the AI Security Institute until US review. Narayan later said Britain had worked with the US to keep pre-release access to the most powerful models. The scope of that access is not public.
- Can the institute stop a dangerous release?
Not on the powers described for Parliament’s inquiry. It can test a model it is allowed to see. It does not necessarily have the power to compel disclosure or halt a launch.
- What should buyers do before a statute arrives?
Ask who tested the model, whether they could delay release, what unexpected behaviour has been disclosed, and what happens if an open model is modified or run outside your tenancy. If the agent can touch records or open a network path, name the human who can halt it. Until suppliers have a duty, the off-switch is a management control.
One more voice on the same threat picture
The minister’s warning sits beside a security service that is already treating AI as part of the threat mix, not a side issue for later.