The BIS warns banks that AI is rapidly reducing the time available to address software vulnerabilities, urging faster response measures.
Summary
- The Bank for International Settlements warns that AI is shortening the response time for banks to fix software vulnerabilities.
- Current patching practices are deemed insufficient in the face of rapid cyber threats.
- Regulators are pushing for faster remediation and enhanced operational readiness.
The Bank for International Settlements (BIS) has raised alarms about the impact of advanced artificial intelligence on the banking sector, noting that the technology is significantly reducing the time available for banks to address software vulnerabilities before they can be exploited by cybercriminals.
A recent report from the Financial Stability Institute emphasizes the need for banks to accelerate their software updates and streamline decision-making processes regarding these repairs. This warning aligns with prior concerns voiced by AI developers and financial regulators about the increasing velocity of cyberattacks driven by sophisticated AI models.
The report highlights that "the most significant development brought about by frontier AI is autonomous vulnerability discovery and exploitation." The authors note that traditional security measures and routine patching are becoming inadequate, with the window for identifying vulnerabilities shrinking from weeks to mere minutes.
Findings from a review by the U.K. Financial Conduct Authority support this urgency, indicating that the speed at which vulnerabilities are discovered is outpacing the response capabilities of financial institutions. The Institute of International Finance has also advised that banks should expedite patching efforts, even outside of regular maintenance windows, and be more open to scheduled downtimes.
Additional guidance from the U.K.'s Cross Market Operational Resilience Group suggests that the time required for repairs could drop from weeks to just days or hours. While these timelines are advisory, regulators are increasingly pressuring banks for swifter action. For instance, Germany's BaFin has called for faster patching protocols, while the Hong Kong Monetary Authority has stressed the need for enhanced breach responses and recovery processes.
Specifically, the Hong Kong Monetary Authority recommends that financial institutions integrate AI-driven cybersecurity scenarios into their operational resilience strategies, improving their incident response and recovery capabilities amid a landscape of evolving cyber threats. The report also points to the European Central Bank's emphasis on cyber resilience and the Digital Operational Resilience Act, which underline the necessity for institutions to maintain critical services during severe operational disruptions.
This BIS report follows a call from OpenAI, Anthropic, and over 100 other organizations in August for bolstered cyber defenses, advocating for stricter access controls, enhanced threat sharing, and increased oversight of AI systems.
The report references the Hugging Face breach involving OpenAI models as a case study, illustrating how capabilities demonstrated in tests can lead to real attacks. OpenAI later explained how its agents collaborated during this incident, highlighting that while typical safeguards were circumvented and significant computational resources were used, the event does not necessarily reflect the risks tied to publicly accessible AI tools. The authors clarify, "The OpenAI incident is not an indication that frontier AI models can develop malicious objectives on their own; however, they may pursue narrowly defined tasks with unintended and harmful consequences." They stress that effective cyber resilience hinges on a powerful model combined with a software system that enables it to plan, utilize tools, and operate autonomously.
