For decades, financial regulators obsessed over the threats they could model: credit contagion, liquidity spirals, sovereign defaults. Now the Group of Seven's finance ministers have quietly admitted that the next crisis might not emerge from a balance sheet at all—it might be engineered by an adversary wielding generative AI.
The G7 has agreed to conduct coordinated tabletop exercises simulating AI-powered cyberattacks on banks, a first for the bloc and a signal that the intersection of artificial intelligence and financial stability has moved from academic concern to operational priority. The drills will test how major economies' banking systems respond when attackers use machine-learning tools to probe defenses, generate convincing phishing campaigns at scale, or automate the discovery of zero-day vulnerabilities.
Why AI changes the calculus
Cyberattacks on financial institutions are hardly new; JPMorgan disclosed a breach affecting tens of millions of accounts more than a decade ago, and central banks from Bangladesh to Ecuador have been targeted by sophisticated actors. What has changed is the force multiplier that AI provides. Large language models can craft social-engineering attacks indistinguishable from legitimate internal communications. Autonomous agents can scan codebases for exploits faster than any human red team. Deepfake audio has already been used to impersonate executives in wire-fraud schemes.
The concern among G7 officials is not merely that individual banks might suffer losses, but that a coordinated AI-assisted attack could trigger the kind of confidence collapse that central banks are ill-equipped to address. A liquidity crisis can be met with emergency lending facilities; a crisis of trust in the integrity of payment systems has no obvious monetary-policy remedy.
The limits of simulation
Tabletop exercises are useful but inherently constrained. They reveal coordination gaps—who calls whom, which minister has authority to shut down a payments network—but they cannot replicate the fog of a real attack, where attribution is uncertain and political pressures distort decision-making. The G7's drills will reportedly involve finance ministries, central banks, and private-sector participants, but the details of scenarios and success criteria remain undisclosed.
Critics will note that the G7 has a long history of communiqué-driven initiatives that fade once cameras leave the room. Whether these exercises translate into hardened infrastructure, better information-sharing protocols, or pre-authorized response authorities will depend on follow-through that is far less photogenic than the announcement itself.
Our take
The G7's decision to simulate AI cyberattacks is overdue recognition that financial stability now depends on cybersecurity in ways that legacy regulatory frameworks never anticipated. But simulations are not defenses. The real test is whether governments will fund the boring, unglamorous work of upgrading legacy banking IT, mandating stronger authentication, and building redundant payment rails. If these drills remain a diplomatic set piece rather than a catalyst for structural investment, the next AI-powered attack will find the system exactly as vulnerable as it is today.
