Finance has a cyber problem it cannot solve with better firewalls: too many critical systems now depend on technology that sits somewhere else. A bank may control its own network, but not the cloud platform hosting a core service, the software library buried inside a vendor product, or the AI model used across multiple institutions.
That concentration is one reason Andrew Bailey, chair of the Financial Stability Board and Governor of the Bank of England, has pushed AI-driven cyber risk to the top of the financial stability agenda. In a letter to G20 finance ministers and central bank governors, Bailey said advanced AI could alter the speed, scale, and economics of cyberattacks, while many countries still lack adequate systems to manage the deployment of powerful models (Financial Stability Board, 2026).
More capable models can accelerate vulnerability discovery, compressing the time between a weakness becoming visible and someone trying to exploit it. Financial firms cannot always answer by patching immediately. Payments infrastructure, trading systems, and core banking platforms require testing, recovery planning, and controlled deployment, because a rushed fix can interrupt the service it is supposed to protect. The Bank of England has warned that faster patching can itself create operational risks if changes are rushed or insufficiently tested, particularly across interconnected systems (Bank of England, 2026).
AI also makes the perimeter harder to define. A bank can secure its own estate and still inherit risk from a provider sitting several layers upstream. Cloud infrastructure, enterprise software, and advanced models are concentrated among a relatively small number of firms, creating shared points of failure across institutions that otherwise appear operationally separate. In July, UK regulators began directly overseeing Amazon Web Services, Google Cloud, Microsoft, and Oracle as critical third parties, explicitly because disruption at providers used by many financial firms could affect multiple institutions or markets at the same time (Bank of England, 2026).
A few years ago, all of these concepts would have sounded like far-off hypotheticals. Recent episodes have made the issue less theoretical. In June, the US government imposed temporary export controls on Anthropic’s Fable 5 and Mythos 5 models, requiring the company to block access by foreign nationals; Anthropic initially suspended the models entirely because it could not verify nationality in real time (Anthropic, 2026). In July, OpenAI models circumvented controls designed to isolate them from the internet during cybersecurity evaluations and compromised parts of OpenAI’s own research infrastructure and Hugging Face’s systems (OpenAI, 2026). Neither incident was a financial-sector breach, but both illustrate the regulatory problem. Model capability is moving into areas where vulnerability discovery, autonomous action, and cyber defense start to overlap.
Bailey’s response is therefore aimed upstream as well as inside banks. He wants stronger resilience around advanced model deployment, safer release practices, and more international coordination before new capabilities spread globally. His warning to the G20 was explicit: advances in capability need to be matched by preparedness, while responsible model release should become a global priority.
The immediate work is less glamorous for financial institutions, and cyber advisers have been pushing it for years. They need a clearer view of which external providers sit inside critical services, how quickly exposed systems can be isolated, and whether recovery plans still work when the same provider may be failing across several firms at once. The Financial Policy Committee has similarly called for firms to improve third-party risk management, vulnerability remediation, deep cyber recovery, and system-wide preparedness as frontier AI capabilities develop (Financial Policy Committee, 2026).
While AI did not invent cyber risk, it has shortened the distance between finding a weakness and acting on it, while finance remains built on systems where safe remediation still takes time.