UK Commits £130 Million to AI Cyber Defenders as AI-Found Flaws Hit Government Sites

The UK government is putting £130 million into AI-powered cyber defence. The funding is part of a wider £600 million-plus AI package announced by the Treasury ahead of this week's Budget. Of the cyber money, £60 million will go to a new National Cyber Shield that uses agentic AI, including a £25 million challenge fund for UK security firms and a regulatory sandbox to test autonomous security tools. A further £70 million will set up the National Exposure and Real-Time Vulnerability (NERV) Centre, which will use AI to look for weaknesses across Britain's infrastructure and wider economy.

The announcement follows the PHP2Shell security scare, in which dozens of government websites were taken offline after critical flaws were found in the widely used PHP scripting language. AI-assisted researchers uncovered the vulnerabilities. The UK's National Cyber Security Centre worked with OpenAI to coordinate disclosure and give affected vendors time to prepare fixes. AI minister Kanishka Narayan said last week that AI had already found 500 previously unknown flaws across significant parts of the public sector.

It remains unclear how much freedom the new AI defenders will have to act without human intervention, or when they will be deployed. Former NCSC head Ciaran Martin welcomed the investment, saying: "We need to padlock our systems, and harness AI for defense." The Treasury is also giving £120 million to the AI Security Institute, which tests advanced AI systems for dangerous capabilities.