The timing is pointed. The announcement follows the PHP2Shell scare, in which dozens of government websites were taken offline after critical flaws were found in the widely used PHP scripting language. The National Cyber Security Centre worked with OpenAI to coordinate disclosure and give vendors time to prepare fixes, after AI-assisted researchers uncovered the vulnerabilities. AI minister Kanishka Narayan said last week that the technology had already uncovered 500 previously unknown security flaws across significant parts of the public sector.

Beyond cyber defence, the Treasury is putting £120 million into the AI Security Institute, which tests advanced AI systems for dangerous capabilities, and £165 million into a National AI Biosecurity Initiative. That includes £100 million for what the government claims will be the world's first dedicated AI Biosecurity Lab, with OpenAI contributing £100 million in compute and model credits and Anthropic offering up to £100 million in model credits and support; Google DeepMind and Basecamp Research are also involved.

The rest of the package tilts at technological sovereignty: £60 million added to the Sovereign AI Fund for British firms, £60 million for AI research and development procurement, £18 million for an Advanced Chip Design Academy, and smaller sums for local AI partnerships, a healthcare-focused challenge prize and research into AI's impact on jobs. Manchester will also get an NCSC AI Cyber Security Centre of Excellence.

Open questions remain. It is not yet clear how much freedom the new autonomous AI defenders will have to act without human intervention, or when they will be deployed. Ciaran Martin, former head of the NCSC, welcomed the investment, saying: "We need to padlock our systems, and harness AI for defense."