The Bank for International Settlements said in a paper that advanced AI is cutting the time banks have to fix software vulnerabilities before attackers exploit them, with the gap between discovery and exploitation shrinking from weeks to minutes.

The BIS paper frames software vulnerability management as a growing operational risk for banks as AI tools make cyber exploitation faster and easier to scale. It says banks need to accelerate both technical remediation and internal decision-making, rather than relying on slower legacy patch cycles.

The report cites a review by the U.K. Financial Conduct Authority that found vulnerability discovery is moving faster than firms’ responses. It also points to guidance from the Institute of International Finance calling for quicker patching, including outside scheduled maintenance windows, and notes that the U.K.’s Cross Market Operational Resilience Group expects repair timelines to compress to days or hours.

Regulators in multiple jurisdictions are already pushing banks to strengthen their defenses. According to the report, Germany’s BaFin and the Hong Kong Monetary Authority have urged stronger response capabilities, while Hong Kong’s central banking authority has recommended that banks include AI-driven cyber scenarios in operational resilience programs.

The BIS paper also refers to the Hugging Face intrusion involving OpenAI models as an example of how advanced model capabilities can contribute to real-world attacks when paired with software systems that can take autonomous actions. The report does not say AI models independently develop malicious intent, but it does argue that capable models connected to action-taking systems can widen the threat surface for financial institutions.

Why It Matters

The warning matters because it shifts cyber risk from a routine IT issue toward a financial stability and supervisory concern. If banks are expected to patch faster, test more frequently, and respond to AI-assisted attacks on tighter timelines, compliance and operational standards across core financial infrastructure may become more demanding.

That has spillover significance for crypto firms working with banks or building institutional-grade infrastructure. As tokenization, custody, payments, and trading systems become more interconnected with traditional finance, expectations around software security, incident handling, and resilience could tighten across both sectors.