MI5 launches an AI Threat Assessment Centre inside its new Protect mission

What did MI5 announce at Thames House on 13 October?

MI5 published the Director General’s annual threat update on 13 October 2026, with the full speech text on mi5.gov.uk. McCallum spoke at Thames House and framed 2026 as another “generational shift” comparable to the post-9/11 remaking of the Service: terrorism and state-threat missions are now “pretty much of equal scale,” and a third mission — Protect — has been elevated to front-rank status.

Inside the technological-resilience section he announced AITAC. The wording is careful: “in 2026 we’ve launched the AI Threat Assessment Centre, or AITAC. Housed in MI5 but drawing together expertise from a range of bodies including AISI, NCA and NCSC, this new team is producing all-source assessments which separate the bluster from the realities.”

A companion MI5 page on AITAC restates the launch, names AISI and NCSC among the contributing bodies, and says the centre will provide assessment for a range of government departments. That page is thin on staffing, budget and productisation — the speech is the primary narrative; the AITAC page is the organisational label.

What is the AI Threat Assessment Centre supposed to do?

AITAC’s described output is assessment, not enforcement. McCallum compared it to earlier fusion cells: the Joint Terrorism Analysis Centre after 9/11 and the Joint State Threats Assessment Team about a decade ago. Each, he said, broke new ground in analysing emerging dangers; AITAC is the AI-era equivalent for “all-source” work that government can use when it both wants to seize AI opportunities and manage misuse risks.

The MI5 AITAC page’s one operational sentence is that the centre “will provide assessment for a range of government departments.” It does not say AITAC will licence models, run evaluations for the public, or replace AISI’s technical programme. Readers should not confuse it with a standards body.

McCallum also placed “the alignment problem” — risks from AI systems that could out-think their operators — on MI5’s agenda as something “genuinely novel” that “deserves the serious attention it is getting, including in MI5.” That is a signal of attention, not a published MI5 alignment methodology.

How does AITAC sit beside AISI, NCSC and the Protect mission?

Protect is the organising frame. McCallum described three resilience strands: systemic (critical infrastructure and services), societal (cohesion, polarisation, violence against public figures and communities), and technological (especially AI). NPSA, which is part of MI5, works with NCSC on sabotage, hostile reconnaissance, insider risk, drones and cyber advice for operators.

AITAC sits on the technological strand and is explicitly multi-agency. That matters for readers following the UK AI Security Institute’s frontier best-practice priorities and the government’s frontier-AI cyber pilots and incident-reporting package: AISI remains the technical institute; AITAC is MI5’s assessment fuse box that can pull AISI, NCSC and NCA into a single national-security picture.

The speech also stressed Five Eyes technical collaboration and the need to keep a “capability edge” as adversaries adopt AI. Again, that is mission language rather than a disclosed programme list.

Which AI misuse cases did McCallum emphasise?

McCallum’s present-tense AI list is concrete: AI is “already supercharging the cybersecurity contest between attackers and defenders”; it can produce propaganda and radicalising material “tailored to the individual”; MI5 has “caught terrorists seeking to exploit AI to improve their reconnaissance and attack methodologies, with AI-enabled drones adding a new twist.”

The forward-looking priority is biological: “Not yet realised – but the misuse case to which I’d attach greatest weight – is AI’s potential to change the stakes on existing or even new bioweapons.” BBC and POLITICO coverage of the speech emphasised that bioweapons line; the primary attribution remains McCallum’s prepared text on the MI5 site.

He tied the intelligence community’s response to close work with AISI and to defending a capability edge as AI “increasingly accelerat[es] its own development.” Those sentences do not quantify budgets, headcount or evaluation suites.

How does this fit the UK’s wider frontier-AI security work?

The UK has been stacking AI-security institutions quickly: AISI’s technical guidance, DSIT risk packages, and parliamentary scrutiny that recently saw OpenAI and Anthropic discuss binding safety rules. AITAC adds an MI5-hosted assessment layer aimed at departments that need threat pictures, not model cards.

That division of labour is useful if it stays clear. If AITAC’s assessments stay classified and AISI’s public technical work continues, researchers and vendors will still look to AISI and NCSC for actionable guidance, while ministers get a fused national-security brief. If AITAC begins to issue public technical judgments without transparent methods, it will collide with AISI’s role — nothing in the speech resolves that boundary.

McCallum’s wider threat picture — state threats above Cold War resource levels, Russia as “aggressor number one,” Iranian proxy violence, China-linked espionage and academic-funding alerts, terrorism threat level back at SEVERE — is the context, not the AI product. AITAC is one structural answer inside that larger update.

What is still unknown after the speech?

Unresolved after the primary texts: AITAC’s size, leadership, published assessment products, whether any outputs will be unclassified, how tasking from departments works, and how its bio-risk work relates to existing UK biosecurity bodies.

Also unclear is the relationship between AITAC assessments and any future statutory AI incident reporting — the speech does not mention legislation. The AITAC web page currently mixes the launch blurb with an unrelated espionage-alert paragraph about CGTRI; treat the speech as the cleaner primary for the AI announcement.

Until MI5 or AISI publish a joint terms-of-reference, the accurate description is: MI5 has stood up an AI threat assessment centre with AISI/NCSC/NCA expertise in the mix, under an elevated Protect mission, and its Director General has publicly ranked AI-bio misuse as his highest-weight unrealised risk.

What should readers take from the Protect framing?

McCallum’s public advice at the end of the speech is operational rather than abstract: infrastructure and defence suppliers should follow NPSA and NCSC guidance on sabotage, hostile reconnaissance and drones; university researchers should use Trusted Research advice; tech startups should assume foreign intelligence interest and fix basic cybersecurity; parents worried about radicalisation paths should use teachers, clinicians or the police Act Early helpline.

Those lines matter for an AI story because they show where MI5 thinks resilience work lands — in operators and communities — while AITAC feeds the assessment layer that ministries use to prioritise. The announcement is therefore less a model-release event than a machinery-of-government event: a named centre, named partner bodies, and a ranked bio-risk concern inside a broader Protect doctrine.