The traditional tête-à-tête that defines financial crime is one of technology.
Fraudsters use technological innovations to probe the behavioral and digital defenses of institutions and organizations that deploy the same, or similar, technologies to fend off those same attacks while authorizing valid customer transactions and workflows.
Underneath all that digital innovation, however, lies a simpler foundation of cost and economics. Banking cybersecurity rests on the premise that breaking into the encrypted financial perimeter requires so much computation, expertise and sheer time that any existential attack by a fraudster on the financial system’s foundation is ultimately rendered economically irrational.
A report from Anthropic published Tuesday (July 28) casts that assumption into doubt. Frontier models developed by the AI provider under its line of Mythos AI systems were able to discover previously unknown weaknesses in multiple cryptographic algorithms previously thought resilient, including the HAWK post-quantum digital signature scheme and a reduced-round version of AES, the encryption standard that underpins much of today’s internet.
Computational limits have effectively served as an invisible layer of financial regulation, protecting everything from payment authorization and ATM withdrawals to cloud infrastructure and mobile banking. While Anthropic emphasized that neither discovery affects production banking systems today, nor does the work compromise full-strength AES, the research nonetheless demonstrates that frontier AI models are becoming capable of performing sophisticated cryptanalysis previously requiring years of specialized human research, potentially rebalancing the cost economics of a severe attack.
The most pressing question raised by Anthropic’s cryptographic research is not whether artificial intelligence can break the encryption protecting bank accounts today. It cannot. The harder question is what would happen if that answer changed faster than the financial system could respond.
See also: Quantum and AI Are Breaking Trust Everywhere at Once
The Challenge Is Replacing Encryption
Banks have traditionally treated cryptographic migration as a long-duration technology program. Encryption algorithms are embedded across payment terminals, mobile applications, APIs, databases, cloud infrastructure, authentication systems, card-processing platforms, ATMs, hardware security modules and decades-old core systems. Even when a replacement standard exists, identifying every dependency and moving the institution to a new one can take years.
The PYMNTS Intelligence report “Scale Amplification: How Revenue Amplifies Agent-Driven Identity,” showed that large enterprises, with their larger digital footprints, can be more susceptible to the AI-powered spoofing of identity documents due to the industrialization of deepfakes and automated data scraping capabilities by adversarial fraudsters.
The complexity of systemic scale across the financial sector also makes migration to a new encryption standard difficult. Replacing an encryption algorithm rarely resembles installing a software patch. It often requires inventorying thousands of applications, identifying hidden dependencies, validating interoperability across vendors, updating hardware, recertifying compliance controls and coordinating changes across payment networks, processors and technology partners.
The impact of frontier AI can cut both ways. Banks capable of using frontier models and inventorying cryptographic dependencies, deploying updated standards and coordinating migration across partners may respond more effectively as their own defensive and security research breakthroughs begin arriving at machine speed.
Institutions lacking that flexibility, however, could face growing technical debt.
“The time to start thinking about migrating to quantum-resistant methods of encryption is now,” Professor Scott Aaronson, scientific adviser at StarkWare, told PYMNTS in February.
Read also: Innovation Keeps Expanding Compliance for Mid-Market Firms
Tomorrow’s Security Standards Will Need to Assume Smarter Attackers
AES and related cryptographic systems protect data in transit and at rest across online banking, card payments, merchant platforms, cloud environments, token vaults, mobile wallets and enterprise treasury systems. Cryptography also supports authentication, transaction integrity, software signing and the protection of credentials moving among banks, processors, networks and FinTech providers.
The potential disruption from AI-led cryptanalysis means a bank that once expected warning before an algorithm became vulnerable may need to prepare for a world in which models can explore attack paths continuously, operate in parallel and turn incremental academic weaknesses into practical attacks faster than existing governance processes can respond.
See also: The 7 AI Terms Every CFO Needs to Understand
This compressed security clock may begin affecting capital allocation, vendor management, cyber-resilience exercises or post-quantum migration plans. The limiting factor in an emergency may not be the availability of a replacement algorithm but the institution’s ability to locate every place the old one remains embedded.
Institutions cannot predict which algorithm, library or implementation will weaken first. They can control whether they know where cryptography resides, whether they can replace it and whether their vendors are contractually required to move with them. As a result, the financial system’s next cryptographic challenge may not be choosing an unbreakable standard. It may be building infrastructure capable of changing standards before a theoretical weakness becomes a commercial attack.
For all PYMNTS AI coverage, subscribe to the daily AI Newsletter.
