Summary
- MI5 announced the AI Threat Assessment Centre in its annual threat update.
- The centre draws expertise from AISI, NCA and NCSC.
- Its assessments cover potential misuse of AI and wider questions about advanced systems.
MI5 has established a new AI Threat Assessment Centre to evaluate the national security risks associated with advanced artificial intelligence. Director General Sir Ken McCallum announced the centre in his annual threat update on 13 October, saying it had been launched during 2026 and was bringing together expertise from the AI Security Institute, National Crime Agency and National Cyber Security Centre.
The centre, known as AITAC, is housed within MI5 and produces assessments drawing on multiple sources of intelligence and technical knowledge. McCallum positioned it as a response to the difficulty of separating credible emerging capabilities from exaggerated claims. It follows the creation of earlier cross-agency structures for analysing terrorism and state threats, although the new body’s remit concerns AI-related risks rather than replacing those existing teams.
McCallum said AI is already changing the contest between cyber attackers and defenders. Systems that can assist with software analysis, information gathering or content generation can be useful to legitimate investigators and malicious actors alike. Those capabilities do not establish that every anticipated threat has become technically feasible, but they create a need for assessments that can be updated as models and tools change.
His speech also described potential uses of AI in propaganda, hostile-state activity and biological threats. Cybersecurity is therefore one element of a broader assessment programme. Reports about AI-enabled terrorism, autonomous attacks or advanced model behaviour should not be conflated: each involves different technical capabilities, likelihoods, safeguards and possible consequences.
The centre brings together organisations with distinct functions. The AI Security Institute tests model capabilities and risks; the NCSC provides the government’s technical cybersecurity expertise; the NCA investigates serious organised crime; and MI5 leads domestic intelligence work on national security threats. Coordinating those perspectives may help distinguish a model’s performance in a controlled evaluation from its practical usefulness to a malicious operator facing real-world constraints.
McCallum also reported that MI5’s state threat caseload had quadrupled over the past decade. He discussed Russian and Iranian activity and threats to British interests, reinforcing that AI assessment is developing within a wider intelligence landscape. The new institution does not indicate that the agency has attributed a particular recent attack to autonomous AI or identified a new AI-specific threat actor.
AI threat assessment may need to distinguish a model’s stated capability from the results it achieves with tools, access and human assistance. A system that can suggest a technique in a test does not necessarily have the credentials, network reach or reliability needed to carry it out. Conversely, combining modest model capabilities with existing criminal infrastructure may create practical risks before a fully autonomous agent exists. Those distinctions affect whether a government response is best directed towards developers, service providers, affected industries or law-enforcement investigations.
The new centre’s cross-agency membership could help bring together technical test results and operational intelligence that would otherwise be interpreted in isolation. MI5’s announcement does not specify that AITAC will regulate products, certify models or publish individual vulnerability notices; those responsibilities belong to other organisations or regulatory frameworks. The speech also distinguishes malicious use by people from the longer-term question of whether AI systems themselves may behave in unexpected ways. Neither theme establishes a present-day autonomous attack against British infrastructure. The centre has been described as producing assessments for decision-makers, and its effectiveness will be difficult for the public to measure until more is disclosed about its findings and government use.
Establishing AITAC is a concrete organisational change, but its initial public description does not provide a budget, staffing figure, case list or binding powers. Its outputs will inform government decisions and threat understanding; whether specific technical findings become public will depend on disclosure decisions by participating agencies. McCallum’s announcement places the centre within the intelligence community’s approach to assessing technology before certainty about its future capabilities is possible.
