When machines attack: frontier AI cyber threats and policy responses in the financial sector

What it contains

The paper, published on 9 September 2026 as Occasional Paper No 28 of the Financial Stability Institute (FSI) of the Bank for International Settlements, argues that frontier artificial intelligence models, the most advanced ones available, change the cyber threat landscape: they can autonomously identify critical vulnerabilities, develop effective exploits and conduct complex multi-step operations, which reduces the expertise, time and resources needed for a sophisticated attack.

For financial institutions it identifies three risks: shorter remediation windows, a higher likelihood of breach and amplified third-party dependencies. By shortening the time between the discovery of a vulnerability and its exploitation, unpatched software becomes the leading initial access vector in many incidents. Reliance on a few cloud, software and AI providers introduces concentration and sovereign access risks: the disruption or a policy decision of a single provider can spread across institutions and jurisdictions. The text also recognizes defensive opportunities, such as faster detection of vulnerabilities and threats and faster incident response.

On the response of authorities, it observes a pragmatic convergence: instead of creating AI-specific cyber regimes, they are reinforcing existing cyber risk management and operational resilience frameworks and adjusting supervisory expectations, with emphasis on governance able to decide in time, accelerated patching and stronger response and recovery capabilities. It includes a case study of an AI-assisted intrusion into the Mexican government’s infrastructure and an annex comparing guidance from international bodies.

Summary prepared by the Dominican Republic Risk Management Club from a reading of the original document, with the source verified on 7 October 2026. It does not replace reading the official text and is not advice.

See all publications