What happened
This BIS Bulletin (No. 129) by Aldasoro, Auer, Frost and Pérez-Cruz analyzes how frontier AI models are reshaping systemic cyber risk for the financial system. Its central finding: "Frontier artificial intelligence (AI) models increase the speed, scale and complexity of cyber attacks, and they also strengthen cyber defence. But the costs are asymmetric and may favour attackers." Drawing on UK AISI capture-the-flag evaluations, the authors report Anthropic's Mythos achieved a 68.6% pass rate on expert-level cyber tasks (the highest of any model at the time), before OpenAI's GPT-5.5 surpassed it at 71.4% just weeks later — and both models achieved full network takeovers in cyber-range simulations. The bulletin estimates a full autonomous attack chain consumes roughly 100 million tokens, meaning the economics of AI-enabled attacks are not prohibitive for well-resourced actors. The authors argue swift adoption of frontier AI for code review and vulnerability remediation is essential, and call for international coordination among financial authorities to address the asymmetric risk to financial market infrastructure.
Why it matters
This is a flagship central-bank institution (BIS) formally flagging that frontier AI has crossed a capability threshold ('a Mythos moment') with direct, quantified implications for financial-sector cyber resilience and systemic risk — CISOs and boards at banks and financial infrastructure providers should treat this as a signal to accelerate AI-assisted patching and defensive tooling given the stated attacker-favoring cost asymmetry.
Action needed
Brief the board and CISO on the attacker/defender cost asymmetry and benchmark internal patch/vulnerability-remediation cycle times against the AI-accelerated attack timelines described.