MI5 Threat Update 2026: Sir Ken McCallum Warns of AI Bioweapon Risks, Russia And Iran
Delivering his annual security address at Thames House, MI5 Director General Sir Ken McCallum declared that the post-Cold War era of stability is over. State threats from Russia and Iran now match counter-terrorism in scale, with MI5 warning that artificial intelligence is supercharging cyber sabotage, drone tactics, and potential bioweapon threats.
Looking back on his thirty-year run in the Security Service, McCallum recalled joining back when Northern Ireland terrorism was the chief item on the desk, only to face the shock of 9/11 five years later.
That single morning forced a total rebuild of MI5.
"We're there again," McCallum noted, pointing to a generational shift that has pushed Britain’s security apparatus into another uncomfortable overhaul.
Equal Scale: State Threats and Counter-Terrorism
For the first time on record, state threats and counter-terrorism now swallow identical shares of MI5’s daily capacity.
That shift led to the formal launch of a third core operational pillar, dubbed "Protect."
While counter-espionage and counter-terrorism still do the heavy lifting in terms of active surveillance, the Protect mission deals with something much drier: sheer national resilience. It isn't about glamorised spycraft; it’s about making sure power plants, water boards, and logistics networks can take a hit without collapsing.
McCallum was dead set on breaking the illusion that national security is just some distant geopolitical game played by men in suits.
The targets chosen by foreign adversaries today hit ordinary people right where they live, work, and trade.
"Think also of the place where you live, where you work," McCallum said. "Think of a flicker in the power grid supplying your home. Think of your local synagogue or mosque having to install enhanced security. Think of a toxic or manipulative post on social media. Think, perhaps, of what online algorithms are feeding your teenagers in their bedrooms."
Russia and the Escalation of Hybrid Warfare
When it comes to state-sponsored subversion on European soil, Moscow takes top spot.
MI5 Chief skipped the usual diplomatic tap-dancing on this point: "Russia remains aggressor number one, as Putin’s Kremlin continues to lash out at the UK and its allies."
Russian military intelligence agencies aren't looking for a head-on military fight with Western armies. Instead, they hire local criminals, deploy cyber proxies, and set fire to warehouses across the continent.
The whole point is to cause maximum friction while avoiding an outright escalation.
Russian operators are escalating hybrid attacks while "being careful to stay below the NATO Article V threshold it’d be foolish for them to cross," McCallum observed.
Teheran is playing a similar game. Iranian operatives maintain an active footprint on British soil, systematically targeting political dissidents and diaspora activists. Authoritarian regimes are effectively using the open nature of Western legal systems to poke at domestic fault lines from the inside.
Defending Critical Infrastructure and Civil Resilience
Britain’s critical infrastructure—the power lines, clearing houses, ports, and water treatment works—was designed back when maximum economic efficiency was the only metric that mattered.
That lean setup makes it brittle.
McCallum ran through a troubling checklist of recent incidents: hackers probing American water and energy networks, mysterious fires targeting European defence manufacturers, and a destructive cyber attack directed at a UK power generator.
The logic behind these hybrid strikes is cold and simple: low risk for the attacker, high chaos for the victim. A breached banking app locks millions out of their money. A rogue drone loitering near an airport runway grounds an entire airline fleet. A ransomware strain inside a hospital network cancels surgeries for a week.
To patch these gaps, the National Protective Security Authority (NPSA)—a specialized branch inside MI5—works alongside GCHQ’s National Cyber Security Centre (NCSC). They advise utility providers and private firms on how to screen supply chains, spot hostile insiders, and lock down physical perimeter security.
Political Violence and Democratic Institutions
The friction isn't confined to digital pipes and power lines; it’s spilling directly into British politics. On October 12, Home Secretary Shabana Mahmood ordered an independent review of the UK’s protective security framework following a sharp rise in threats against public figures.
McCallum directly mentioned the July murder of former politician Ann Widdecombe, as well as recent terrorism charges filed against an individual accused of targeting the leadership of Reform UK.
Under the Security Service Act 1989, MI5’s primary statutory mandate is defending parliamentary democracy. When MPs and community figures need police escorts just to run constituency surgeries, that core democratic machinery starts to break down.
Artificial Intelligence and Technological Risks
On the tech front, generative AI is turning into a massive force multiplier for hostile actors.
McCallum pointed out that three decades in intelligence work tend to give a person high adrenaline thresholds, but he didn't mince words on the risks ahead: "Today AI is already supercharging the cybersecurity contest between attackers and defenders."
Hostile agencies and extremist groups are using automated models to write tailored radicalisation content, automate cyber reconnaissance, and refine drone attack methodologies.
The real nightmare scenario, however, involves chemical and biological threats. Looking at potential misuse cases down the road, McCallum singled out "AI's potential to change the stakes on existing or even new bioweapons" as the hazard carrying the heaviest weight.
To keep a handle on these capabilities, MI5, GCHQ, and MI6 are working directly with the UK AI Security Institute, alongside real-time intelligence sharing through the Five Eyes alliance.
Sir McCallum offered no illusions about the pace of this race, admitting that keeping ahead is far from a relaxing job, though British intelligence brings "plenty of racing experience" to the track.
Institutional Adaptability and Structural Frameworks
Thames House has a long history of shifting its internal plumbing when the threat environment turns sour. After 9/11, the government stood up the Joint Terrorism Analysis Centre (JTAC) to centralize threat intelligence. A decade ago, as state espionage resurfaced, officials created the Joint State Threats Assessment Team (JSTAT).
The formal elevation of the Protect mission in 2026 is just the latest iteration of that adaptive pattern.
With state threats and counter-terrorism now sharing equal operational scale, and with hybrid sabotage, AI proliferation, and political violence hitting civilian targets at once, the Security Service is shifting its baseline. National defence is no longer something that stops at military barracks; it now covers the entire civil framework of the country.