G20 finance ministers are being urged to prepare for “more severe scenarios involving simultaneous disruption across multiple firms or shared technology dependencies”.
As we have been warning for several years now, our growing dependence on digital payments systems has created serious operational risks and vulnerabilities in the financial system. Digital payment networks depend on power grids, telecoms infrastructure, cloud servers, and complex software, and are inherently vulnerable to cyberattacks, software glitches and rolling blackouts.
Readers may recall the stark warning issued in March last year by Riksbank, the central bank of Sweden, one of the world’s most cashless economies. In its 2025 Payments Report, the central bank warned that the rampant digitalisation of payments over the past two decades, which it itself had spearheaded, had increased the vulnerability of Sweden’s financial system:
In 2024, the payments system has experienced few disruptions, but individual agents have been subject to attacks and have experienced disruptions. This is also confirmed by Finance Sweden, which states that recent cyber attacks have increased in strength and scope. The risk of new cyber attacks is significant, and is amplified by the heightened geopolitical risks.
The central bank even cautioned of the need to bolster Sweden’s cash infrastructure after years of neglect: “Measures need to be taken to strengthen preparedness and reduce exclusion so that everyone can pay, even in the event of crisis or war.” For years, it said, efficiency had been the priority for payments, but now safety and accessibility “are at least as important”.
Within weeks of the report’s publication, Spain suffered a massive energy outage that brought down electricity across nearly the entire Iberian Peninsula for hours on end — in some places for almost an entire day. As the system came back online and attention turned to the possible causes of one of Western Europe’s largest peacetime blackouts, one thing was clear: without cash, the resulting chaos would have been far worse.
Roughly half a year later, in November 2025, the Internet infrastructure provider Cloudflare suffered an outage that brought down roughly 20% of the Internet’s websites, including social media networks and online banking platforms, for over three hours. Weeks later, a similar glitch at the same company triggered a fresh wave of chaos.
Fast forward to today, we may have something potentially even more serious to worry about: AI cyber attacks, which now (apparently) pose an imminent threat to the global financial system — just three years after AI went mainstream. That’s according to Andrew Bailey, the governor of the Bank of England and current chair of the Financial Stability Board (FSB), an international body that monitors and makes recommendations about the global financial system.
It was in the latter role that Bailey wrote a letter this past weekend to G20 finance ministers and central bank governors warning of the need to prepare for “more severe scenarios involving simultaneous disruption across multiple firms or shared technology dependencies”.
From the Financial Times:
The letter from the Bank of England governor, who also chairs the Financial Stability Board, underlines how the guardians of the world’s financial system are becoming increasingly alarmed about the dangers of AI-enabled cyber attacks.
These fears intensified following a series of recent incidents in which the flagship models being tested by Anthropic and OpenAI went rogue, hacking into external organisations and creating fake identities to deceive people who were running the tests.
Bailey said in his letter, published on Monday, that AI cyber risks were adding to existing vulnerabilities in the financial system, including energy-driven inflationary pressures, rising interest rates, increased investor leverage and stretched equity valuations.
Urging more countries to take “appropriate steps” to control the release of new frontier AI models, Bailey appeared to be trying to convince the US to reconsider its hands-off approach to regulating the new technology.
“Recent developments have also highlighted to me that many jurisdictions do not have the protocols in place to manage the development, release and deployment of advanced frontier AI models, heightening risks for the financial sector and beyond,” he wrote.
Those “recent developments” include OpenAI’s recent decision to pause some of its model training after its models allegedly independently gained access to the internet during testing and hacked into the systems of tech company Hugging Face. Anthropic also reported cases in which Claude agents targeted real-world systems that were not included in the experiments.
The Financial Stability Board is not alone in warning of the risks posed by AI cyber attacks. In fact, there has been a cacophony of warnings in recent weeks. Just last week, more than 100 tech-related firms — including Google, IBM, Microsoft, OpenAI, Anthropic, Accenture and Cloudflare — co-signed a letter calling for “collective action” against “AI-enabled cyber attacks”.
The letter urges all organisations to make cyber defence an “immediate leadership priority” as more capable AI models make attacks easier to automate. It also calls on governments to give hospitals, water utilities, and local governments access to capable defensive AI, as well as to “impose costs” on attackers. As WIRED magazine notes, good luck with that.
It’s also noteworthy that the main solution being offered for all the security risks posed by AI involves granting organisations more access to “defensive” AI. So, whatever happens, more AI, which means more bank for the tech giants.
Interestingly, Israel, one of the world’s leaders in cyber security, is also “racing to harden critical infrastructure as AI cyber threats accelerate”, according to Ynet News:
The prolonged war and surge in cyberattacks against Israel have forced some of the country’s most sensitive organizations to reassess their computing infrastructure. Institutions that once viewed cloud computing with caution, and sometimes outright suspicion, are now facing a different question: not only how to protect data, but how to keep operating when the systems themselves become targets.
This is no longer theoretical.
Alongside ransomware, data theft and espionage attempts, Israeli organizations have in recent years faced operations linked to state actors and other well-resourced groups. AI could now allow attackers to work faster, at lower cost and at far greater scale.
AI has changed the equation
The warning follows a series of incidents that have shown how quickly the boundary between AI as an assistant and AI as a system capable of independently carrying out parts of an attack is beginning to blur.
One of the first people to raise the alarm was Bill Gates, which should in itself set off its own set of alarms…
Click here to continue reading on Naked Capitalism
Nick Corbishley 