When AI Leaves the Lab: Testing Frontier Models in Government Cyber Defence
When AI Leaves the Lab: Testing Frontier Models in Government Cyber Defence
In a month of UK government hackathons, teams scanned public code using frontier models alongside conventional security tools. One approach made agents challenge and verify each other’s findings; another fed scanner results into models that traced flaws across services. Human specialists checked escalated findings, ruled out false alarms and passed viable issues into existing patch workflows. The government reported 407 findings across nine organizations, including some already known or otherwise mitigated, and said every critical weakness was remediated. It spent £13,000 on model tokens, not on the entire exercise.
A 12 October ministerial statement said two pilots together found and addressed 1,352 vulnerabilities across 548 repositories in 18 departments. That broader claim is not an independently audited count of deployed fixes or intrusions prevented. There is no matched scanner-and-human-only control, reviewer-hours total or patch-latency measure. A parliamentary question tabled on 14 October asks what both pilots cost and how many issues were actually remediated; an answer is due by 19 October. The takeaway is that defenders can put AI discoveries into a real fix pipeline when they own that pipeline; whether they outpace adaptive attackers remains unmeasured.