G7 to Run Drills Against AI Cyberattacks as Banks Brace for a New Threat

Japanese Finance Minister Satsuki Katayama announced the plan on Thursday, October 15, after a meeting of G7 finance ministers and central bank governors in Bangkok, held alongside the International Monetary Fund's annual meetings.

Katayama told reporters, Reuters reported.

The G7 finance deputies had been discussing the idea of doing tabletop exercises on frontier AI, which was signed off at the ministerial level.

The move comes in the same week that the IMF and the Bank of England both warned that AI is making cyberattacks on banks and markets more dangerous.

What the G7 Agreed To

The exercises will use simulations designed by G7 finance authorities to test how they would respond to AI-driven cyberattacks, a Japanese finance ministry official who attended the meeting told reporters.

The results will show how well current protocols work and will be used to revise manuals for handling such incidents, the official said. Depending on the scenario, private financial institutions could also take part.

What is a tabletop exercise?

Despite some headlines about "fake attacks on banks," a tabletop exercise doesn't involve hacking anything. It's a structured crisis rehearsal: officials sit together, walk through a realistic scenario step by step, such as an AI-powered attack that knocks out a major payment system, and decide how they would respond.

The aim is to find weak spots before a real crisis: who needs to talk to whom, which decisions slow things down, and what gaps exist between countries.

Why Regulators Are Worried About AI Cyberattacks

The IMF's warning

On October 13, the IMF's latest Global Financial Stability Report flagged cyber risk as a growing threat.

IMF officials Athanasios Vamvakidis and Jason Wu wrote in a blog post on the report.

As finance becomes more digital and interconnected, cyber disruptions have emerged as a growing source of systemic risk.

They warned that a major incident at a big bank, payment system, cloud provider or software platform could spread through the whole financial system.

One number shows how fast the threat is moving. In more than 70% of reported cases this year, software providers had almost no time to fix a security flaw before attackers used it, the IMF said. That share is more than double the level in 2021, when companies typically had close to 300 days.

The IMF wrote.

Frontier AI models could accelerate both attacks and defenses.

The Bank of England: assume attackers will get in

On the same day as the G7 meeting, Bank of England Deputy Governor Sarah Breeden gave a blunt message at the Institute of International Finance's annual meeting in Bangkok.

"It's not enough now to assume that the cyber attackers won't get through," she said, according to Reuters. She described AI as a "systemic risk" to the global financial system.

Breeden said the Bank of England is working with banks on deep recovery plans. "We need to be thinking about what are the bare metal recovery options ... that we need for the core services," she said.

"Bare metal" recovery means being able to rebuild a bank's most important systems from scratch on clean hardware, if attackers have corrupted everything else.

Why AI Changes the Threat

AI can help attackers in several ways:

• Finding weaknesses faster, by scanning software for flaws at machine speed.

• Writing convincing scams, such as personalized phishing emails or fake voice messages.

• Acting on its own, as autonomous AI agents can carry out many steps of an attack with little human help.

How the US, UK, and EU Already Test Banks

The G7 drills will add to testing programs that already exist:

What It Means for Bank Customers

For everyday customers in the US, UK and Europe, nothing changes today. The exercises are about making sure that if a major AI-powered attack ever hits, authorities can keep payments flowing, protect deposits and restore services quickly.

The bigger signal is that regulators no longer treat AI cyber risk as a distant problem. As Breeden put it, the planning now starts from the assumption that attackers will eventually get in.

The Bottom Line

The G7's plan is a sign that the world's largest economies see AI-powered cyberattacks as a real threat to financial stability, not just a technology problem. The exercises won't stop an attack on their own. But by rehearsing a crisis before it happens, finance ministries and central banks hope to find the gaps in their defenses and their teamwork while there's still time to fix them.