IMF Panel Warns AI Is Compressing Cyber Attacks From Days to Minutes

IMF Panel Warns AI Is Compressing Cyber Attacks From Days to Minutes

At  the 2026 IMF-World Bank Annual Meetings in Bangkok on 16 October 2026, a panel on "Artificial Intelligence and Escalating Cyber Risks" delivered a message that was both sobering and oddly reassuring: AI hasn't invented new ways to attack the financial system. It has made the old ones faster, cheaper, and available to almost anyone.

Michael Sellitto of Anthropic set the tone with a number. During Project Glasswing, the effort that gave defenders early access to the company's Mythos model, about 130,000 software vulnerabilities were found, roughly 30,000 of them critical or severe. Months later, most are likely still unpatched. "Finding vulnerabilities is easy," he said. "Fixing them is hard." Breaches that once took a team weeks, he added, can now be run by a single person with AI agents working in parallel.

For regulators, the nightmare isn't only a system going down. Marlene Amstad, chair of Switzerland's FINMA, described a subtler threat: a loss of confidence. Banks can prove they hold enough capital and liquidity, she noted, but it is far harder to prove you haven't been hacked. And with attacks moving from days to minutes, she warned, supervisors may no longer have the luxury of a "resolution weekend."

Brazil offered a real-world case study. Paulo Picchetti, the central bank's deputy governor, recounted how criminals targeted the service providers connected to its Pix instant payment system, exploiting outdated networks, and sometimes bribed insiders. His wry observation: bank robberies in Brazil have nearly vanished, because cyber theft is cheaper and safer than a gun.

Andréa Maechler of the Bank for International Settlements argued that the biggest weakness may not be technology at all, but decision-making. In a crisis, she said, the bottleneck is often who decides what, and how fast, which is why the BIS runs crisis simulations on a "digital twin" of central banking.

The closing advice was refreshingly practical: go beyond prevention to containment and restoration, nail the cyber basics, shorten patch cycles, and bring more transparency to supply chains. Above all, use the next 12 months, while defenders still have an edge, to close as many holes as possible. As Picchetti put it in the final seconds: "Cooperation, cooperation, cooperation."

Source: PR Thai Government