On 30 September 2026, MI5 issued a rare public alert to UK universities. It warned that more than 100 UK-linked academics had contributed to projects funded through a front organisation working on behalf of a foreign intelligence service. Many of them had no idea.
The funded work covered artificial intelligence, cyber security, covert communications and steganography (hiding data inside ordinary-looking files). According to MI5, the organisation’s real purpose was to improve that intelligence service’s own espionage capability. The link back to the state had been deliberately obscured, so many institutions engaged in good faith.
This is not about one country
It would be easy to read this as a story about a single state. It isn’t. MI5’s annual threat updates have repeatedly named several hostile states active against the UK, and official guidance from the NCSC, NPSA and UKRI deliberately speaks of “hostile actors” and “foreign powers” in general terms. State actors, commercial competitors and criminals all have reasons to want what UK researchers produce.
The common thread is method, not nationality. Valuable research is acquired by funding it, collaborating on it, recruiting the people behind it, or simply asking for it in a way that looks routine.
Why this matters now: the law has changed
The National Security Act 2023 created an offence of assisting a foreign intelligence service, which can apply where a person ought reasonably to have known what their actions supported. Following the alert, the Security Minister wrote to every university vice-chancellor. “We didn’t know” is becoming a harder position to hold once a warning is public.
That puts the focus on awareness. Researchers, research office teams and technical staff need to recognise when something doesn’t feel right, and know who to tell.
Tell-tale signs your research may be a target
- Opaque funders – Money arriving through intermediaries, or an organisation whose ownership and ultimate backers are hard to verify.
- Unusual interest in sensitive or dual-use topics – AI, cyber, communications, quantum, semiconductors and advanced materials attract particular attention.
- Requests beyond scope – Asking for raw data, source code, methods or unpublished results that the agreed project doesn’t need.
- Pressure for speed or discretion – Urgency to sign, reluctance to involve the research office, or a preference for informal channels and personal email.
- Generous, unsolicited offers – Paid trips, honorary posts, consultancy or “talent” roles that arrive out of the blue, often via professional networking sites.
- Approaches to individuals, not institutions – Contact aimed at a PhD student or early-career researcher rather than through formal channels.
- Shifting stories – Partner details, project aims or end users that change once work is under way.
As with a lot of things in security and intelligence world no one thing above means that what is going on is malicious. But by combining these signals together they can indicate the need to stop and check.
What institutions can do
- Review current partnerships against the latest government alerts and NPSA Trusted Research guidance.
- Make due diligence routine, not a box-ticking exercise reserved for large contracts.
- Train the people most likely to be approached, including academics, postgraduates, research office and IT staff, with realistic, discipline-specific scenarios.
- Make reporting easy and blame-free, so concerns surface early.
International collaboration remains essential to world-class research. The aim is not to close doors, but to make sure everyone knows who is on the other side of them. If this is something you have been affected by or are worried about, please reach out. We can help you review the risks, put the right checks in place and train your staff to recognise the warning signs before research is compromised. Get in touch with our team.
Morgan Cyber Solutions helps education and research organisations build security awareness that fits how their people work.
