The Government has reported that 32 government services had been taken offline and a further four were partially unavailable, after AI discovered a major cyber security vulnerability.
The vulnerability has caused widespread disruption across the public sector, with the BBC reporting that seven of Scotland’s 32 councils and six of its 14 health boards tad taken their websites down.
The disruption follows the publication of a security update on Wednesday (21 October), warning that the vulnerability could allow attackers to execute commands on web servers running PHP.
The National Cyber Security Centre (NCSC) subsequently urged UK organisations to take immediate action by updating to the latest version of PHP.
It also recommended taking affected systems offline where organisations were unable to implement the necessary fixes immediately.
Speaking in Parliament, Baroness Lloyd of Effra said the disruption was largely the result of precautionary measures taken to protect systems while security updates were applied.
She said: "We are working very carefully with departments to restore the services safely and securely following that remediation activity. The advice of the NCSC is to mitigate and then restore the services. We are working to restore the services safely and as quickly as possible."
The minister added that the Government was not aware of any confirmed compromise of central government systems resulting from the vulnerabilities.
She also revealed that the NCSC had been briefed on the PHP vulnerability by OpenAI, the company behind ChatGPT, the previous week.
The centre had subsequently worked to ensure the vulnerability was disclosed in a coordinated manner with vendors, allowing sufficient time for organisations to prepare protective measures, she said.
Baroness Lloyd of Effra also encouraged organisations to sign up to the NCSC's early warning scheme, revealing that the centre had issued 50,000 proactive notifications to businesses and other organisations advising them on the action they should take.
The security scare comes amid growing concerns about the speed at which artificial intelligence is uncovering previously unidentified security vulnerabilities.
The Government's AI Minister, Kanishka Narayan, said that an earlier AI-assisted examination of government systems had uncovered 500 cyber security vulnerabilities.
"These are novel vulnerabilities that we discovered in significant areas of the public sector," he said.
Narayan argued that the Government should proactively use AI to identify and address security risks.
Meanwhile, Jason Clinton, deputy chief information security officer at AI company Anthropic, warned that the cyber security challenges posed by the technology were likely to intensify.
In a social media post, he said: "As bad as things have gotten in the past 4 days, they are going to get a lot worse before they get better. Security leaders, never let a crisis go to waste: please go to your boards and ask for help right now."
His recent comments follow a warning he made in August of a potential "vulnerability tsunami", in which AI systems uncover critical security flaws faster than organisations can patch them.
