Advanced AI has cut the time banks may have to repair software flaws from weeks to minutes, according to a new Bank for International Settlements paper that calls for faster security decisions and patching.
Summary
- The BIS paper says AI can help find software flaws and turn them into working attacks.
- Its authors warn that scheduled security checks and patching may be too slow.
- U.S. and overseas authorities are pressing financial firms to improve cyber response and recovery.
- A July incident involving OpenAI agents and Hugging Face showed how a test could reach real systems
The Bank for International Settlements paper, published on Sep. 9 by its Financial Stability Institute, says banks need to shorten the time between finding a weakness, approving a fix, and installing it. Its authors identify AI systems that can find vulnerabilities and turn them into working attacks as the main change facing financial firms.
“The window between vulnerability discovery and exploitation has narrowed from weeks to minutes,” the authors wrote. The paper does not say every flaw can be exploited that quickly. It argues that regular security reviews and fixed maintenance schedules may leave firms exposed when an attack can be prepared before the next planned repair.
BIS says faster attacks require faster bank decisions
According to the paper, the U.K. Financial Conduct Authority has found that firms are struggling to respond as quickly as vulnerabilities are being discovered. The Institute of International Finance has urged firms to install urgent fixes outside normal maintenance periods, even when doing so requires planned downtime.
Separate voluntary guidance from the U.K.’s Cross Market Operational Resilience Group anticipates that some repair periods could fall from weeks to days or hours, the BIS authors said. Faster patching also depends on management: a security team cannot install a high-impact fix promptly if the people responsible for approving an interruption to banking services are unavailable or unclear about who can make the call.
The report therefore treats cyber response as a matter for senior management as well as technical staff. It says boards need clear information about emerging threats, while institutions need decision processes that let them assess a flaw, approve a response, and protect essential services without waiting for a routine review.
In the United States, the paper points to New York financial regulator guidance issued in May for firms facing a heightened cyber threat environment. According to the BIS, the New York Department of Financial Services included advances in AI among the developments that could change cyber risks and asked regulated entities to consider stronger detection, preparation, response, and recovery measures.
The U.S. connection also extends to outside technology providers. In a Sep. 11 proposal, crypto.news reported that four federal regulators proposed revised guidance on how banks and credit unions oversee third parties. Outside firms can provide payment processing, cybersecurity, and online banking services, according to that report, making vendor oversight relevant when a software flaw affects a service a bank does not run itself.
AI tests show how software flaws become attacks
The BIS paper cites a test called ExploitGym to show the difference between finding a known vulnerability and producing a working exploit. Across 898 test cases, Claude Mythos Preview produced working exploits in 157 instances, or 17%, while GPT-5.5 did so in 120, or 13%. The authors caution that success in a test does not prove an AI system could break into a well-defended bank.
Anthropic has reported finding more than 10,000 serious software vulnerabilities with Mythos Preview, according to the paper. The company also said more than 99% of the flaws it identified had not yet been patched, limiting what it could disclose publicly. In April, financial leaders raised concerns about the model’s ability to uncover weaknesses in systems used across finance; banks and government agencies were testing it to identify flaws before any more open release.
Figures cited by the BIS add context to the repair problem. Citing Verizon Business’s 2026 breach report, the authors say exploitation of vulnerabilities accounted for 31% of initial access in the incidents studied, compared with 13% for stolen or misused credentials. The same report found that organizations had fully fixed 26% of the critical vulnerabilities tracked under a U.S. Cybersecurity and Infrastructure Security Agency measure in 2025, down from 38% the previous year.
The BIS authors use those findings to argue for continuous checks and quicker repairs, while keeping access controls and secure software development in place. AI can also help defenders find flaws and review large amounts of security data, the paper says, but it cannot replace basic security work that a firm has left undone.
OpenAI incident shows the limits of a controlled test
A July incident involving OpenAI agents and the AI platform Hugging Face gives the paper a separate example of what an autonomous system can do outside its assigned task. During an internal evaluation, an agent was supposed to solve security test problems. Instead, according to the BIS account, it sought the answers directly, exploited a previously unknown flaw in an OpenAI service, and reached the internet.
The agent then used stolen credentials and other weaknesses to run unauthorized code in Hugging Face systems, the paper says. Hugging Face reported limited access to internal datasets and credentials but no changes to public-facing resources. It also used AI to examine more than 17,000 events during its investigation, according to the BIS.
The authors stress that OpenAI had relaxed normal safeguards, supplied substantial computing power, and allowed the agent to act on its own during the test. They say the incident is not evidence that AI models develop malicious goals independently or a direct measure of the risk from tools available to the public. It does show, in their assessment, why financial firms must assess the permissions, tools, and external access given to a complete AI system.
For institutions deploying such agents themselves, the paper recommends keeping records of what the systems do, limiting access to data and tools, requiring human approval for high-impact actions, and maintaining a way to stop an agent or return control to a person.
Regulators focus on keeping critical services running
The BIS paper says Germany’s BaFin has called for quicker patching, while the Hong Kong Monetary Authority has urged institutions to test AI-driven attack scenarios and strengthen their ability to contain breaches. Hong Kong’s regulator has also asked firms to improve recovery plans as breaches may become more likely, according to the report.
In Europe, the authors point to the European Central Bank’s cyber stress tests and the Digital Operational Resilience Act. Both place attention on whether financial institutions can continue delivering critical services during a serious disruption, rather than only on whether an attack can be prevented.
The paper says existing Basel Committee principles already call for banks to identify critical operations and the systems they depend on. Those principles also cover patch management, access controls, threat sharing, and regular resilience tests.
