IMF Warns AI Eases Bank Hacking, Urges Action in 12 Months
IMF, Anthropic, and BIS experts warn that AI accelerates banking cyberattacks, uncovering massive software vulnerabilities and requiring urgent action within 12 months.
Stock photo for illustration only, not from the actual event
- AI enables a single individual to hack a bank in hours instead of months of team effort.
- Anthropic's Glasswing project scanned systems and found 130,000 vulnerabilities, including 30,000 critical ones.
- Financial institutions heavily rely on shared third-party IT vendors, creating systemic cascading risks.
- IMF and BIS experts warn the global financial system has just 12 months to fortify defenses.
During an IMF panel discussion on AI and cyber risks in the financial system, four distinguished speakers shared critical insights: Michael Sellitto, Head of APAC Policy at Anthropic; Marlene Amstad, Chair of Switzerland's financial market regulator FINMA; Paulo Picchetti, Deputy Governor of the Central Bank of Brazil; and Andrea Maechler, Deputy General Manager of the Bank for International Settlements (BIS). The panel explored how artificial intelligence is reshaping cyber threats and testing global financial preparedness.
Michael Sellitto noted that AI significantly lowers the complexity of system penetration. Tasks that once required elite teams of hackers can now be executed by a single person using accessible AI tools within hours, while security frameworks lag behind. Marlene Amstad added that bad actors do not even need advanced AI models; simple tools like voice cloning and deepfakes allow them to deceive victims quickly and at an unprecedented scale.
The rapid evolution of AI was likened to a pandemic, with Anthropic's Claude model expanding its coding responsibilities from near zero last year to over 50% currently, and potentially up to 90% by year-end. Recognizing its exceptional capability to identify computer vulnerabilities, Anthropic withheld a powerful new model from general release earlier this year. Instead, they launched the Glasswing project in April to let external experts patch security gaps before malicious actors could exploit them. The initiative uncovered approximately 130,000 vulnerabilities, with 30,000 deemed critical. Although AI accelerates vulnerability discovery, patching still requires human labor and time, leaving most flaws unaddressed.
Stock photo for illustration only, not from the actual event
Additional Context: Financial institutions' growing reliance on shared third-party software vendors creates a 'Single Point of Failure' phenomenon. If a major vendor is breached, the damage cascades instantly across multiple banks, as seen during the MOVEit file transfer incident, highlighting that modern cyber risks often stem outside the financial institution itself.
Marlene Amstad explained that a single breach can escalate into a financial crisis through three main pathways: core banking system failures paralyzing transactions, shared software vulnerabilities compromising multiple institutions simultaneously, and rumors triggering widespread bank runs. Paulo Picchetti shared Brazil's experience with the Pix instant payment system, where third-party fintech integration introduced weak security links exploited by cybercriminals. He noted that traditional armed bank robberies have been largely replaced by online theft due to lower risks of apprehension.
On the defense side, the Central Bank of Brazil utilizes statistical AI models to detect anomalies and alert commercial banks promptly. Meanwhile, Andrea Maechler from BIS acknowledged resource gaps between large and small central banks regarding expensive AI security tools, though she expects accessibility to improve over time.
"The global financial system must urgently address this within the next 12 months before hackers outpace security systems."
Global Financial Leaders and IMF Panelists
Ultimately, the panel agreed that financial institutions worldwide must reinforce their defenses within the coming year. Banks must map out their third-party dependencies, establish rapid network-wide alert systems, and abandon isolated defense strategies in favor of cross-industry collaboration.
Source: Techsauce
Found something wrong in this article? Report an issue with this article
Comments
Leave a Comment