BIS Warns Banks Have Minutes to Fix Software Flaws Amid AI Cyber Threats

Advanced AI is reducing the time banks have to fix software flaws before they can be exploited by attackers, according to a paper from the Bank for International Settlements. The report emphasizes that banks must accelerate software repairs and decision-making processes. It states that the time between vulnerability discovery and exploitation has decreased from weeks to minutes. A U.K. Financial Conduct Authority review found that vulnerability discovery is outpacing firms' responses, while guidance from the Institute of International Finance calls for faster patching, even outside scheduled maintenance. The U.K.'s Cross Market Operational Resilience Group anticipates repair timelines shrinking to days or hours. Regulators, including Germany's BaFin and Hong Kong's monetary authority, are urging banks to enhance their response capabilities. The Hong Kong Monetary Authority has recommended integrating AI-driven cyber scenarios into operational resilience programs. The BIS paper also discusses the Hugging Face intrusion involving OpenAI models as evidence that AI capabilities can lead to real-world attacks. While the incident does not indicate that AI models can develop malicious objectives independently, it highlights the risks when capable models are combined with software systems that allow autonomous actions.