AI found 500 new vulnerabilities in government, UK minister says
The UK has used artificial intelligence to uncover hundreds of weaknesses in government systems, AI minister Kanishka Narayan told the BBC, highlighting the technology’s growing role in cybersecurity.
Artificial intelligence has identified 500 new vulnerabilities in UK government systems, AI minister Kanishka Narayan told the BBC. The disclosure highlights how AI is being used to uncover security weaknesses, alongside growing concern about its ability to help attackers find exploitable flaws. BBC report
The BBC’s accompanying synopsis says Narayan spoke before a separate critical cybersecurity flaw became public, prompting organisations worldwide to assess their exposure. His remarks concerned earlier government use of AI, rather than a finding that all 500 weaknesses were connected to that latest alert.
The available synopsis does not identify the affected departments, the tools used or the severity of the government vulnerabilities. It also does not establish whether all the findings have been repaired, limiting what can be concluded about the remaining risk to public systems.
The distinction between finding a weakness and resolving it is central to official guidance on AI-assisted security. Discoveries must be assessed and prioritised before fixes are implemented; a larger number of findings does not, by itself, demonstrate that systems have become safer. New Zealand National Cyber Security Centre guidance
UK guidance published by the Government Digital Service and Department for Science, Innovation and Technology says AI-assisted software analysis is improving quickly. It warns that faster analysis can shorten the interval between a weakness being discovered and exploited, making departments’ ability to respond increasingly important. UK government guidance
That guidance identifies existing weaknesses, insecure implementation and configuration, and slow remediation as key drivers of exploitation risk. Its recommendations include clear responsibility for systems, automated vulnerability management and arrangements that allow teams to respond quickly when security reports arrive.
The government guidance also rejects a blanket retreat from publishing source code openly. It says openness should remain the default, with narrow, reviewable exceptions, while emphasising that keeping code private is not a substitute for maintaining secure systems and fixing their weaknesses.
Separately, New Zealand’s National Cyber Security Centre advises organisations using AI for vulnerability discovery to control what those tools can access. Its recommendations include using restricted permissions and testing environments, and considering whether external AI services could expose sensitive information to a vendor.
The centre also stresses the importance of experienced staff who can guide investigations and validate findings. Its guidance calls for processes that filter false positives, prioritise genuine problems and address underlying causes, rather than treating every automated finding as equally urgent or reliable.
For the government findings described by Narayan, the unanswered questions concern their seriousness and remediation status. The official guidance points to the practical next step: turning discoveries into verified repairs, while maintaining the people, processes and controls needed to handle further findings.
Sources
Primary source: BBC Technology. Newzly rewrites and structures source reporting for clarity; verify critical details at the original.