MI5’s state-threat caseload quadruples as terrorists try AI drones

Foreign-state operations have grown into a mission roughly as large as counterterrorism for MI5. Its latest annual assessment adds another pressure: terrorists are trying to use artificial intelligence to improve surveillance and attack methods, including through AI-enabled drones. The service is confronting changing tools as well as a heavier investigative workload—not replacing its terrorism mission with a new one. ¹⁰

Speaking at Thames House on 13 October 2026, Director General Sir Ken McCallum said MI5’s state-threat caseload had quadrupled over the preceding decade. His AI warning drew an equally important boundary: attempted terrorist exploitation is already part of MI5’s work, but the biological-weapons scenario he singled out as his greatest misuse concern has not materialised. ¹⁰

That establishes attempted misuse, according to MI5—not a successful AI-directed terrorist strike. McCallum supplied no names, dates, drone models, case count or technical results that would let the public judge how far those attempts progressed. The missing detail matters: trying to exploit a technology and demonstrating a dependable new attack capability are different things. ¹⁰

Other applications are less speculative. AI is already intensifying the contest between cyber attackers and defenders, McCallum said, and can produce propaganda and radicalising material tailored to an individual. His concern about biological weapons goes further: assistance could help people with limited expertise develop or improve dangerous capabilities if safeguards fail. But he expressly described that misuse scenario as “Not yet realised.” It is a warning about what could become easier, not evidence of an AI-created biological attack. ^{10 60}

He also raised a separate future concern: whether advanced AI systems will reliably follow human intentions—the alignment problem. That was a call to take seriously the possibility of systems capable of out-thinking humans, not a report that MI5 had encountered an independently acting AI attacker. ¹⁰

The fourfold increase measures MI5’s state-threat caseload. It does not mean completed foreign attacks quadrupled, every investigation established wrongdoing, or an individual’s risk rose fourfold. No underlying case totals or precise calendar endpoints were supplied, so readers cannot reconstruct the ratio. Russia, China and Iran remain principal state concerns; the assessment’s central concrete examples concerned Russia and Iran. ^{10 8}

McCallum also said MI5 now devotes more resources to countering state threats than during the Cold War. That is a comparison of the service’s allocation, without published cash or staffing denominators—not a ranking of today’s overall national danger above every period since the Second World War. Sky News reported his explicit qualification on that point. The meaningful conclusion is substantial enough: two demanding operational missions now sit alongside each other at approximately equal scale. ^{1 10}

Russia remains “aggressor number one,” in McCallum’s assessment. He described escalating sabotage, cyber operations and attempted violence designed to stay below the threshold for NATO’s collective defence. His examples included a cyberattack on Polish energy infrastructure, a miscued attempt to destroy a cargo plane in Germany with an explosive-laden drone, and a thwarted US assassination plot. He gave no further dates or identified victims; the German aircraft was not described as destroyed, nor the American killing as completed. ¹⁰

Almost 1,000 expulsions internationally since Russia invaded Ukraine had severely reduced its traditional covert network, he said. Moscow was turning to paid criminals and inexperienced volunteers, including the GRU Volunteer Corps linked to Russian military intelligence. Such recruitment can bring foreign-state operations into ordinary workplaces without an identifiable foreign operative appearing. McCallum also described attempted election interference and campaigns exploiting social divisions, while distinguishing attempts from achieving Moscow’s desired electoral outcome. ^{10 20}

One allegation is approaching a British trial. Joshua Cammidge was charged in September under the National Security Act over alleged preparations to sabotage a drone factory in Swindon. Prosecutors allege assistance to a foreign intelligence service and contact with someone linked to the GRU Volunteer Corps. He denies the alleged Russian-linked plan. A January pretrial hearing is reported, followed by a three-week trial scheduled at Winchester Crown Court from 19 April 2027. None of those allegations is a finding of guilt. ^{91 89 170}

McCallum described Iranian ambitions expanding toward harder targets, including military sites, alongside threats to Jewish communities, Iranian dissidents and Iranian media workers. Iran-linked operations had produced more than 50 UK arrests in the preceding twelve months. Accounts on 13 October differed: BBC News initially reported 50, as did Channel 4 News; ITV News reported more than 50. McCallum’s published speech and the later BBC account use the fuller formulation, “more than fifty.” These are arrests, not convictions or a count of separate proven plots. ^{9 6 7 4 10}

The same day’s reports also differed in procedural completeness. Channel 4 described two Iranian nationals as recently arrested over an alleged Manchester plot; ITV said they had been charged. Police records establish the fuller position: Salam Ahmadyan and Rahman Salehi were arrested on 20 September and charged on 2 October with preparing terrorist acts. An arrest-only description leaves out that subsequent legal step. ^{6 7 51}

Prosecutors allege planning involving a homemade explosive device and reconnaissance of Heaton Park Synagogue and Manchester Jewish Museum, with contact with an overseas third party assessed as likely to be in Iran. These remain allegations, not established conduct or a judicial finding of Iranian state direction. Both men were remanded in custody and are due at the Old Bailey on 23 October. ^{49 164}

There is also an update to the Fairford investigation we reported on 9 October, when seven men were on bail without charges. Through 17 October, that legal position remained unchanged: all seven were on police bail, with no verified subsequent charges or bail changes. Police found petrol or accelerant in vans linked to the initial arrests, but no explosives. Those discoveries do not establish guilt or direction of an alleged plan. ^{126 128}

What changed was the government’s public attribution. On 12 October, Prime Minister Andy Burnham told Parliament the suspected plot was highly likely to have been coordinated in Iran and almost certainly directed by Iran’s Islamic Revolutionary Guard. That is a government intelligence assessment, not a charge or court finding. McCallum subsequently called Fairford “not unique,” but withheld operational detail because the investigation was live; he did not publicly set out proof of that specific attribution. ^{151 15}

The wider terrorism warning is not a newly announced threat-level increase. The Joint Terrorism Analysis Centre raised the UK level from substantial to severe on 30 April, announced on 1 May; it remained severe when McCallum spoke. Severe means an attack is highly likely, not that authorities have announced a particular target or date. ^{35 36 40}

McCallum said extreme right-wing terrorism contributed significantly to the increase, with more cases in which anti-immigration and anti-Muslim grievances tipped into terrorist intent. He cited an investigation a few months earlier involving a radicalised extreme-right 13-year-old in Britain: information generated helped an international partner prevent a lethal attack. Neither the child nor the country was identified, and this was not an announced conviction. ¹⁰

Al Qaeda and Islamic State also continue to direct and inspire attacks. Completed cases cited in the address included three Islamist extremists convicted in February of planning an automatic-weapons mass shooting against Manchester’s Jewish community, and a 16-year-old from Inverclyde sentenced to ten years for attempting an attack on his local Islamic centre. The February convictions are separate from Ahmadyan and Salehi’s pending proceedings. ⁷

MI5’s technological response is already under way. Its AI Threat Assessment Centre launched during 2026, housed within the service and bringing together expertise from the AI Security Institute, National Crime Agency and National Cyber Security Centre. Its task is to distinguish exaggerated claims from real capabilities. MI5, MI6, GCHQ and the AI Security Institute are also working together on AI security risks. ^{10 59}

Protection and national resilience, called PROTECT, have become MI5’s third core mission alongside counterterrorism and countering state threats. That extends the response beyond arrests: strengthening interconnected energy grids, financial systems, supply chains and manufacturing, and helping communities resist attempts to divide them. Protective agencies offer advice on sabotage, drones and cyber risks. ¹⁰

The practical test is whether those protections keep pace with the workload and changing capabilities. Places of worship, dissidents, factories and military sites need security grounded in what adversaries can actually do. That requires taking attempted AI misuse seriously without reporting forecasts as accomplished attacks—and allowing courts, not intelligence speeches, to decide criminal allegations.