UK government’s AI-assisted cyber defence: real patches but no AI-only denominator

Government Cyber Coordination Centre (GC3), “When AI Leaves the Lab,” 12 June 2026; ministerial statement, 12 October 2026; cyber attack–repair question.

The NCSC/AISI-backed June pilot scanned public UK government repositories at weekly hackathons. One team arranged six agentic challenge/validation stages; another ran traditional scanners (Gitleaks, Trivy, Semgrep and Hadolint) first and then let AI investigate chains across services; another built reusable specialized audit skills. Human experts verified every escalated finding and handled false positives; existing teams had to patch. GC3 reports 407 findings across nine organizations, some already known or protected by compensating controls; all critical weaknesses were said to be remediated, with no exploitation observed. It describes a GitHub Actions trigger that could have executed untrusted comment-supplied material and exposed tokens. £13,000 was model-token spend for the month, not total program, analyst or patching cost. GC3 argues structure and scoping mattered more than model choice and that finding is not fixing.

A 12 October ministerial statement says two pilots found and addressed 1,352 vulnerabilities across 548 repositories in 18 departments. That aggregate cannot be treated as 1,352 independently verified exploited flaws, patched production builds or a count of attacks prevented. Nor can the second pilot’s effectiveness be derived by subtracting the original 407 without matching scope and terms. A written parliamentary question tabled 14 October, due for answer by 19 October, explicitly asks total two-pilot cost and how many were actually remediated—a concrete near-term check, not an answer yet. No matched human/scanner-only control, manual review time, actual deployment lags or independent subsequent-exploit checks are reported. Heldt et al.’s paired study gives reasons to test patch robustness; it does not audit the government pilot. The positive observation is material: defenders with source and patch authority can send model findings through a real repair workflow, but net advantage over attackers remains unmeasured.