The Bank for International Settlements (BIS) has warned that artificial intelligence is now capable of weaponizing software vulnerabilities into active exploits within minutes. A process that once took weeks has shrunk drastically, according to a Financial Stability Institute BIS paper dated September 9, 2026.
The ability of language models to dismantle systems was demonstrated in the ExploitGym benchmark. Out of 898 tested cases, the Claude Mythos Preview model generated active exploits for 157 cases, accounting for 17% of the total test suite. Competing model GPT-5.5 followed with findings in 120 cases, or roughly 13%. The paper’s authors cautioned that success in a test environment does not automatically mean AI can breach heavily protected banks.
In real-world environments, an Anthropic report underscored the scale of the threat. Claude Mythos Preview identified more than 10,000 serious vulnerabilities across operational systems. Given that more than 99% of the flaws remain unpatched by developers, Anthropic limited the details disclosed to the public. Since April 2026, several leaders of financial institutions and government agencies have begun testing the model to trace system weaknesses before its broader release.
Regulators Respond to Third-Party Risks
The primary challenge for banking currently lies in response times. The UK Financial Conduct Authority noted that financial firms struggle to move as fast as the pace of newly discovered vulnerabilities. The 2026 Verizon Business Data Breach Investigations Report confirmed this defensive lag: software vulnerability exploitation accounted for 31% of initial access pathways in cyber incidents, surpassing the 13% share from credential theft. Of all organizations evaluated, only 26% resolved their vulnerabilities completely.
A wave of security vulnerabilities has prompted state authorities to update the rules of the game. Four US federal regulators proposed new supervisory guidance on September 11, 2026, targeting third-party technology service providers. Months earlier in May 2026, the New York Department of Financial Services released a circular emphasizing AI advancements as a game-changer for financial institutions’ cyber risk landscape.
A Boardroom Issue, Not Just for Technical Teams
The BIS paper emphasized that responding to cyber threats is no longer viable if left purely to technical teams. Senior management is now required to help steer security responses directly from the top. Boards of directors require threat intelligence feeds and decision-making channels that trigger remediation execution without being hindered by monthly routine review schedules.
📌 Baca JugaJendela Tambal Celah Bank Susut Jadi Hitungan Menit - AI Temukan 10.000 Titik Lemah
The speed at which AI discovers cracking points forces bank executives to rethink their institutions’ defensive architecture. If boards of directors still rely on quarterly meetings to approve system patching, hackers may have already emptied the vaults before the meeting agenda is even distributed.
Reported by crypto.news.
Read also: US Seizes $52 Million in Crypto from Xinbi - $24 Billion Scam Money Processing Network
Disclaimer: This article is for informational and educational purposes only, not financial advice. Cryptocurrency assets are highly volatile and carry significant risk. Always do your own research (DYOR) and never invest more than you can afford to lose.
