ECB tells banks to draw up plans against AI attacks amid disruption fears

The European Central Bank on Tuesday gave euro zone banks four months to draw up plans to counter AI-enabled cyber threats that could undermine confidence in the financial system and disrupt payments.

The move reflects mounting concern among regulators about advanced AI models such as Anthropic's Mythos whose cyber capabilities ‌have become ⁠so powerful ⁠that access to some of them has been restricted, a limitation that currently excludes euro zone banks.

"These developments have potentially profound implications for the confidentiality, integrity and resilience of banks' information and communication technology (ICT) systems," the ECB said in a letter to bank chief executives.


It told banks to prioritise protecting ​internet-facing systems and other exposed technology assets, ⁠including third-party ‌software and open-source components, while speeding up vulnerability fixes ​and strengthening ​monitoring.

The euro zone's top banking supervisor also urged ⁠lenders to modernise ageing technology, improve cyber hygiene and strengthen crisis-management, recovery and information-sharing arrangements.

Banks have until ​October 31 to submit their plans. To free up resources, the ECB has postponed a separate IT survey and may adjust inspections and other supervisory work.

In a warning published alongside the ECB's letter, the European Systemic Risk Board said large-scale cyber disruptions could erode trust ‌in financial institutions and even trigger runs on companies or countries perceived as less secure.

"The ESRB considers these developments ​to be ​a source of ⁠systemic risks to the financial system," said the ESRB, a European Union body that issues recommendations to other authorities.

To illustrate the risks, the ESRB ​outlined scenarios ranging from a gradual loss of confidence in smaller banks to state-backed espionage and coordinated attacks on payments, clearing and settlement systems, potentially amplified by misinformation campaigns.

It said incidents could spread quickly through common technology providers and shared software used across the financial sector.