Key Takeaways
- The UK Government Cyber Coordination Centre (GC3), alongside the NCSC and the AI Security Institute, ran a pilot that used frontier AI models to scan public government code for security weaknesses.
- The effort formed part of the UK Government Cyber Action Plan, aiming to boost public‑sector cyber resilience through emerging technologies.
- Hackathon‑style exercises tested multi‑agent workflows, AI‑assisted vulnerability investigation, and specialised AI skills to automate parts of the security auditing process.
- The pilot uncovered 407 findings, including authentication‑bypass, data‑exposure, and remote‑code‑execution vulnerabilities, and revealed attack paths that conventional scanners often miss.
- Government departments validated the results through existing security processes and remediated all critical vulnerabilities, with human experts retaining final responsibility for validation, prioritisation, and remediation.
- Officials concluded that successful AI deployment hinges more on how the technology is integrated into structured security workflows than on the choice of a particular AI model.
- A second phase is planned, involving additional departments, more AI systems, and assessments of closed‑source environments to further refine the approach.
- The initiative demonstrates a practical, operational use of frontier AI in cybersecurity, reinforcing the trend of combining AI capabilities with human expertise to improve resilience across critical public‑sector infrastructure.
Background and Objectives
The UK Government Cyber Coordination Centre (GC3) launched a pilot programme in partnership with the National Cyber Security Centre (NCSC) and the AI Security Institute to evaluate how frontier artificial intelligence could strengthen cyber defence across government systems. This initiative sits within the broader Government Cyber Action Plan, which seeks to uplift public‑sector cyber resilience by adopting emerging technologies. By directing AI toward the systematic analysis of publicly available government code repositories, the pilot aimed to determine whether advanced models could uncover security weaknesses more efficiently than traditional automated scanners while maintaining rigorous human oversight.
Hackathon Format and Participating Teams
To explore AI‑driven vulnerability discovery, the pilot organised a series of hackathon‑style events where multidisciplinary teams—including security analysts, developers, and AI researchers—worked with state‑of‑the‑art AI models. Participants were tasked with applying these models to real‑world code bases belonging to various government departments. The hackathon setting encouraged rapid experimentation, enabling teams to test different AI architectures and workflows in a controlled yet realistic environment, thereby generating actionable insights about the practical utility of AI in security auditing.
Approaches Tested: Multi‑Agent Workflows and Specialised AI Skills
Rather than adhering to a single methodology, the pilot deliberately examined multiple AI‑enhanced strategies. Teams experimented with multi‑agent workflows, in which distinct AI agents collaborated to perform tasks such as code parsing, vulnerability scoring, and attack‑path mapping. They also employed AI‑assisted vulnerability investigation, where models highlighted potential issues for human analysts to investigate further. Additionally, specialised AI skills were developed to automate repetitive elements of the auditing process, such as generating reproducible proof‑of‑concept exploits or prioritising findings based on severity scores. This comparative approach allowed the pilot to identify which combinations yielded the most effective and actionable results.
Results: Volume and Nature of Findings
The combined efforts of the participants produced 407 distinct security findings. Among these were vulnerabilities that could enable authentication bypass, unintended data exposure, and remote code execution—flaws that, if exploited, could compromise the integrity and confidentiality of government services. Notably, the AI models demonstrated an aptitude for spotting subtle relationships between technical weaknesses across disparate services, thereby revealing multi‑step attack paths that conventional vulnerability scanners often overlook. This capability to contextualise isolated issues within a broader attack surface proved to be a significant advantage of the AI‑augmented approach.
Validation, Remediation, and Human Oversight
All identified findings were subjected to the government’s established security validation processes. Departmental security teams reviewed the AI‑generated alerts, confirmed legitimate vulnerabilities, and prioritised them according to risk assessments. Following validation, remediation actions were applied to address every critical vulnerability uncovered during the pilot. Throughout this cycle, human experts retained ultimate responsibility for validating AI outputs, interpreting contextual risk, and deciding on remediation measures, ensuring that automation complemented rather than supplanted professional judgement.
Lessons Learned: Integration Over Model Choice
UK officials highlighted that the success of AI deployment in cyber defence depended less on selecting a particular frontier model and more on how the technology was woven into structured security workflows. Effective integration involved clear hand‑offs between AI components and human analysts, well‑defined criteria for alert validation, and feedback loops that allowed teams to refine AI behaviour based on operational experience. The pilot underscored that while AI can vastly increase the scale and speed of vulnerability discovery, the strategic decisions surrounding risk prioritisation and resource allocation remain firmly within the domain of skilled security professionals.
Future Plans: Expanding Scope and Closed‑Source Assessment
Building on the pilot’s outcomes, GC3 intends to launch a second phase that will broaden participation to additional government departments, incorporate a wider variety of AI systems, and extend assessments to closed‑source environments where code is not publicly available. This expansion aims to test the robustness of AI‑driven auditing techniques across disparate software ecosystems and to develop best practices for handling proprietary or sensitive code bases. By iterating on the lessons learned, the UK government hopes to establish a repeatable framework for ongoing AI‑enhanced security monitoring.
Significance for Operational Cybersecurity
The pilot provides a concrete example of how frontier AI can be moved from experimental research into operational cybersecurity practice. As cyber threats grow in complexity and volume, AI tools offer the potential to accelerate vulnerability detection, uncover hidden attack chains, and alleviate some of the manual burden on security teams. Crucially, the initiative reinforces the prevailing view that AI should augment—rather than replace—human expertise. Effective cyber defence will continue to rely on the synergy between machine‑scale analysis and human contextual judgement, a balance that the UK pilot demonstrates is both achievable and essential for safeguarding critical public‑sector infrastructure.