The Financial Stability Board warns that advanced AI models now represents an immediate cybersecurity concern for the global financial system. The FSB is particularly focused on faster attacks, concentrated technology dependencies and the possibility of simultaneous disruption across multiple institutions. The scenario is serious enough that the FSB is calling for recovery plans capable of rebuilding critical systems after a major breach.
Artificial intelligence is changing cybersecurity quickly enough to become a direct financial-stability concern. In a letter to G20 finance ministers and central bank governors, Financial Stability Board chair Andrew Bailey (who also governs the Bank of England) calls the potential impact of frontier AI on cyber risk the financial system’s “most immediate concern.”
The warning is not simply about AI writing malicious code. The FSB argues that advanced models could simultaneously increase the speed at which vulnerabilities are discovered, the scale at which attackers can exploit them and the economics of launching attacks. Financial institutions could face more vulnerabilities and much faster patching cycles, creating a secondary risk if testing, deployment and recovery processes cannot safely keep pace.
Systemic risk begins when everyone depends on the same providers
For the FSB, the problem extends beyond the cybersecurity of an individual bank. Banks, exchanges, payment systems and insurers increasingly rely on a relatively concentrated group of cloud, software, AI model and infrastructure suppliers. If a shared provider fails or is compromised, disruption can spread across multiple institutions and jurisdictions at once.
That concentration was already identified in the FSB’s 2024 AI report, alongside cyber risk, correlated market behaviour and model-governance problems. What has changed is the urgency. Recent advances in model autonomy, problem-solving and threat capabilities have prompted Bailey to tell financial institutions to prepare for more severe scenarios involving simultaneous disruption across multiple firms or shared technology dependencies.
The FSB goes as far as calling for the ability to restore critical systems and data from “bare metal” after a major incident — effectively rebuilding from clean infrastructure rather than assuming compromised systems can simply be restarted.
Regulators are turning their attention upstream
Bailey also argues that many jurisdictions still lack adequate protocols and laws for managing the development, release and deployment of advanced frontier models. He is calling for a globally coordinated approach to safe and responsible model deployment rather than a patchwork of national responses to a technology operating across borders.
The FSB is not a supranational regulator and its decisions do not themselves create binding law. Its importance comes from coordinating national financial authorities and international standard-setting bodies, with its recommendations feeding into G20 and domestic regulatory policy.
The shift in the G20 message is nevertheless significant. Frontier-AI cyber risk is no longer merely an emerging vulnerability to monitor. It is becoming a failure scenario that banks, market infrastructure and technology providers are expected to be able to survive.