AI Is Now the Threat Banks Must Plan Around

The world’s top intelligence agencies warned that artificial intelligence (AI) is making cyberattacks faster, cheaper and harder to stop—and banks are in the crosshairs. The financial sector isn’t waiting. It’s already fighting back with the same technology fueling the threat.

The Five Eyes intelligence alliance, which comprises the U.S., U.K., Canada, Australia and New Zealand, warned on Monday (June 22) that AI could rapidly expand what both attackers and defenders can do. The group urged organizations to patch software faster, reduce exposed systems and start using AI defensively before attackers use it first, Reuters reported.

AI can now scan software for weak spots, flag which ones are serious and suggest fixes. That helps defenders. It also helps attackers.

On Monday, AI startup OpenAI said it expanded its Daybreak cybersecurity program with new tools to help organizations find and fix vulnerabilities. Its most advanced cyber model is available only to verified defenders. Meanwhile, IBM announced a partnership with OpenAI on Monday to bring AI into enterprise security services, Reuters reported.

Banks Face Compounding Patch Risk Across Legacy and Cloud Systems

A large bank runs dozens of systems at once: cloud platforms, legacy core banking software, payment connections, vendor tools. AI can scan all of it quickly for weaknesses. The hard part is what comes next. Banks still have to confirm the problem, test a fix, avoid taking systems offline and show regulators the response was handled properly.

Japan’s banking industry is taking the threat seriously enough to consider preemptive service shutdowns.

“There ⁠are concerns about an increase in sophisticated cyberattacks ​that go beyond what has been anticipated,” said Masahiko Kato, chair of the Japan Bankers Association and president of Mizuho Bank, according to a Thursday (June 18) Reuters report.

“Certain services such as ATMs could be proactively ​suspended in order to protect customers’ assets,” he added.

Taking a service offline to stop an attack is safer than leaving it open, but both options carry reputational and operational costs.

FinTechs face a version of the same risk. Most run modern systems but rely on shared cloud infrastructure, open-source code and third-party application programming interfaces (APIs). A single flaw in any of these can affect many companies at once.

OpenAI’s Patch the Planet program, which it introduced Monday, is working with open-source maintainers to turn vulnerability findings into actual fixes, reflecting how much of financial infrastructure now runs on shared code.

Attackers Are Using AI to Make Fraud Look Legitimate

Google’s Threat Intelligence Group found in May that attackers are already using AI to find entry points and run broader operations. The concern is not that AI makes every attacker more sophisticated. It is that AI makes attacks cheaper and faster to run at scale. Bad spelling and odd formatting used to give fraud away. AI removes those tells. Defenses will need to rely more heavily on behavioral signals, device data and transaction context.

Regulators are responding in kind. The National Institute of Standards and Technology (NIST)’s Cyber AI Profile identifies three areas of focus: securing AI systems, using AI to defend and blocking AI-enabled attacks, according to their website.

Akamai and Zscaler Acquisitions Signal Where Protection Is Heading

Akamai agreed to acquire LayerX, which governs how employees use AI tools inside the browser. Zscaler announced plans to acquire Symmetry Systems to secure how AI agents communicate across a company’s systems. Both deals point to where the new security boundary is forming: not just the network edge, but the browser, the identity layer and the AI agent.

The Japan Bankers Association’s warning about preemptive shutdowns is the clearest signal yet that financial institutions are no longer treating AI-enabled attacks as a hypothetical threat. They are building response plans now.