Britain's National Cyber Security Centre said on Tuesday that the country's critical infrastructure should brace for a ransomware attack using AI-powered malware by 2028. Its annual review, The State of the Cyber Nation, says hostile actors are "highly likely" to use AI over the next two years to scale up ransomware, social engineering and the search for weak spots.

Chief executive Richard Horne said AI is not inventing new attacks. It finds weaknesses that were tolerated for too long, at a scale that was once unimaginable. "For decades, we have collectively got away with doing tech on the cheap," he said. He asked leaders to invest now, disconnect systems that do not need to be online, and treat the government's Cyber Essentials scheme as a floor. Those who do not, he warned, will have to explain to investors and customers why food is not on shelves and the lights are off. (NCSC; Annual Review 2026)

A day earlier, Europe saw what an old weakness can do. Overnight into Monday, refrigeration systems at supermarkets in at least nine European countries were switched into defrost mode, and some freezers in Sweden were set to 50 degrees Celsius. About 40 Delhaize stores in Belgium and Luxembourg were hit, along with 13 SuperValu stores in Ireland, seven Coop stores in Sweden and about 15 Carrefour stores in Belgium.

Belgian federal prosecutors have opened an investigation, and EU agriculture commissioner Christophe Hansen called it a deliberate attempt to disrupt the food supply chain. Swedish grocer ICA said its affected stores used an outside refrigeration control system from Danfoss, the supplier hit in last month's attack on French stores. Ask who patches the building systems in your sites, and whether they need to be on the internet at all. (Euronews; BleepingComputer)

Your staff's AI-written text is now marked. This week Anthropic extended its invisible text watermark to four older Claude models, including Opus 4.7 and Sonnet 4.6. The mark sits in the choice of words, adds no characters or cost, and applies worldwide. There is no opt-out, though on two of the older models changing sampling settings through the API removes it.

Anthropic says it is meeting the EU AI Act's rule that AI-generated content be marked so machines can detect it. Detection is limited for now to regulators, researchers, the media and companies the act obliges to check. A detected mark means Claude touched the text, not that it wrote it. If your teams draft reports or client documents with Claude, set a disclosure policy before someone else runs the check. (Claude Help Center; The Independent)

A follow-up to The Levy. On October 30, France's National Assembly adopted a budget amendment that would charge content senders 0.055 euros for every gigabyte delivered to French internet subscribers. Streaming, social media and cloud services would all pay, with the bill capped at 15 percent of French revenue or 2 percent of global revenue.

It passed 11 to 10, with 14 abstentions, among only 35 deputies voting. It is not law yet. The 2027 budget still has to clear the Senate. If your products send heavy data to French users, put a number on the exposure now. (Assemblée nationale amendment; vote record)

Already filed, if you want the run-up: The Rulebook (Abu Dhabi rewriting its rules so AI can check permits), The Levy (Germany debating a tax on AI revenue) and The Disclosure (the SEC examining what AI companies tell investors).

Also on the shelf: The Shareholder (Canada taking a stake in an AI company, with conditions), The Spare (India's markets regulator weighing its own AI model) and The Model Card (US health regulators dropping required AI model cards). Read today beside The Rulebook. Abu Dhabi is handing AI the rules to check. London warns that attackers will use AI to find the rules we skipped.

Cheap choices come back with a bill. Many early programs stored years as two digits because memory was expensive, from about 10 dollars to more than 100 dollars per kilobyte in 1975. As 2000 approached, every system that would read 00 as 1900 had to be found and fixed.

Worldwide spending on Y2K remediation was estimated at about 308 billion dollars, including roughly 134 billion in the United States. The saving was made in the 1970s. The cost arrived decades later, with a deadline that could not move. (Year 2000 problem)

Put these to management. Which of our systems, including building, refrigeration and plant controls, are online without a reason, and who patches them?

Then the shortcuts. Where have we saved money on security that AI-driven attackers could now find in hours? Do we know which of our documents carry an AI watermark, and do we say so?

The Move

Britain's cyber agency says AI will find the weaknesses we have tolerated, and the freezer attacks show how far an old weakness can reach.

Ask the chief information security officer for a list of every internet-connected operational system we own, with an owner and a patch date for each, and bring it to the next audit committee.

Pay down the discount before someone else collects it.

Seven bullets. One move.