A new paper from the Bank for International Settlements’ Financial Stability Institute warns that frontier AI is compressing the time banks have to patch software vulnerabilities from weeks to minutes. The authors highlight autonomous vulnerability discovery and exploitation as the most significant change driven by advanced AI models.
Routine security assessments and scheduled patching cycles are becoming inadequate as attackers can identify and weaponize flaws far more quickly than before. Supervisors are pushing financial institutions to accelerate both technical repairs and the internal decisions needed to authorize them.
The Drivers of This Warning
Frontier AI systems can independently find critical software weaknesses, develop working exploits, and chain multi-step operations, sharply reducing the expertise, time, and resources previously required for sophisticated attacks. This collapses traditional defensive buffers, making unpatched software a higher-risk initial access vector. For perspective, the paper notes that the window between vulnerability discovery and exploitation has narrowed from weeks to minutes, with supporting observations from a UK Financial Conduct Authority review and Institute of International Finance guidance calling for faster patching outside normal maintenance windows.
It is important to note the fundamental difference between earlier generations of AI tools that mainly assisted human operators and current frontier models capable of autonomous discovery and exploitation at machine speed.
Impact and Broader Context
Banks face higher breach likelihood, greater pressure on operational resilience, and the need to accept planned downtime for urgent fixes while strengthening response and recovery capabilities. This development sparks important discussions about how financial institutions and supervisors should adapt existing cyber-risk frameworks rather than create entirely new AI-specific rules. Supporters of the BIS assessment emphasize the urgency of faster governance and decision-making processes to keep pace with the threat. Critics or more measured voices may note that AI also offers defensive benefits, such as accelerated vulnerability scanning and detection, and stress the risks of rushed patches causing operational disruptions. Analysts observe that authorities in multiple jurisdictions are already reinforcing expectations around timely patching, recovery readiness, and resilience testing in response to the accelerated threat landscape.
Financial firms will need to invest in both technology and rapid decision-making structures as AI capabilities continue to advance. This analysis is based on the BIS Financial Stability Institute paper and related reporting from Decrypt and crypto.news for accuracy and reliability. Specific regulatory expectations and threat timelines remain subject to ongoing developments.