G7 Will War-Game AI Attacks on Banks After IMF Warning

Bangkok — The world's richest democracies have decided that the best way to find out whether their financial systems can survive an AI-driven cyberattack is to stage one themselves — on paper, in a conference room, before a real attacker does it for real. It is either the most sensible thing finance ministers have agreed to all year, or a confession that nobody actually knows if the defences work.

The agreement landed on Thursday at the IMF's annual gathering in Bangkok, where Japanese Finance Minister Satsuki Katayama told reporters that G7 finance ministers and central bank governors had signed off on holding tabletop exercises to guard against AI cyberattacks. "The G7 finance deputies had been discussing the idea of doing tabletop exercises on frontier AI, which was signed off at the ministerial level," Katayama said.

A tabletop exercise is a war game without the war: officials walk through a simulated crisis hour by hour and discover that the playbook they swore by has gaps you could drive a truck through. That finance ministers have agreed to do this for frontier AI says everything about the mood in Bangkok this week. The threat is no longer hypothetical. The defences are no longer assumed to work.

Photo: Flags at a G7 finance ministers meeting in Dresden, Germany, in 2015 (file photo). This week the group's finance chiefs met on the sidelines of the IMF annual gathering in Bangkok, where they agreed to hold tabletop exercises against AI-driven cyberattacks. (ubahnverleih / Wikimedia Commons, CC0)

What the G7 actually signed up to

The details came from a Japanese finance ministry official who attended the meeting. The plan: simulations developed by G7 finance authorities that test how the group would respond to an AI-driven cyberattack. The results will be used to stress-test existing protocols and revise the manuals that are supposed to govern a real response. And the exercises may not stay inside government — private financial institutions could be pulled in, depending on the nature of the simulations.

That last point matters. A tabletop exercise run only by treasuries and central banks would test whether bureaucrats can coordinate. Bringing in the banks tests whether the system itself can coordinate — because in a real AI-driven attack, the first phone call doesn't go to a ministry. It goes to a bank's security operations centre at 3 a.m.

Notice what was not announced: a date. Nobody said when the first exercise happens, or how adversarial the scenarios will be. A war game scripted to be winnable is theatre — and whether these exercises bite depends entirely on whether the scenarios are allowed to be colossally uncomfortable.

The IMF warning that set the tone

The agreement comes days after the International Monetary Fund warned that confidence could be undermined by an AI-enabled cyberattack on a critical service of a financial institution. Not "data could be stolen" — confidence, the one asset a financial system cannot function without, could be undermined. Banks don't run on money; they run on belief. An attack that breaks the belief breaks the bank, even if the vaults are untouched.

On Wednesday, the IMF and the World Bank launched the "Bangkok Blueprint for Fraud-Resilient Financial Services" — and the numbers behind it were staggering. Thailand's finance minister, Ekniti Nitithanprapas, told the launch that digital fraud costs the world economy around $1 trillion a year, 3% of global GDP.

Then on Friday, IMF chief Kristalina Georgieva went further still. Speaking alongside Anthropic co-founder Jack Clark, she said the risks of AI could exceed its opportunities without safeguards and an ethical framework: "If there are no safeguards, then the risks may exceed the opportunities. And above all, we do need an ethical foundation, and I'm not sure we are there as a society." She likened AI's development to Formula One cars racing with no barriers to protect the audience.

Breeden's bare-metal doctrine

Photo: The Bank of England in London. Its deputy governor for financial stability, Sarah Breeden, told a Bangkok meeting this week that banks can no longer assume their defences are impenetrable against AI-enabled cyberattacks — and that lenders should prepare "bare metal" recovery systems. (Diliff / Wikimedia Commons, CC BY-SA 3.0)

If Bangkok had a single most quotable voice this week, it belonged to Sarah Breeden, the Bank of England's deputy governor for financial stability. Speaking at the Institute of International Finance's annual meeting in the Thai capital on Thursday, Breeden said the Bank is working with lenders on deep cyber-recovery options — and argued they can no longer assume their defences are impenetrable in the face of AI-enabled cyberattacks.

"It's not enough now to assume that the cyber attackers won't get through," Breeden said. "We need to be thinking about what are the bare metal recovery options ... that we need for the core services, and we need to think about that end-to-end across the financial system."

Bare metal, in this context, means systems entirely independent of a bank's main technology stack — infrastructure that can take over core services if the primary systems are compromised. Breeden also revealed the Bank is surveying lenders on their readiness for the risks quantum computing poses to encryption, with the results feeding a system-wide response.

But the line that should worry everyone in American finance was her assessment of the scale: AI advancements, she said, now pose a "systemic risk" to the global financial system. Cyber risk, she told the Bangkok audience, is what keeps her up at night — she said her deepest fear is waking to news that a systemically important bank or a piece of core infrastructure has been attacked and paralysed.

The crackdown is already underway

The G7 exercises are the headline, but they sit inside a regulatory mobilisation that is already moving fast. Earlier this week, Reuters reported — citing six people familiar with the matter — that banking watchdogs worldwide are ramping up AI scrutiny. Three top US regulators, including the Federal Reserve, are quizzing banks on their use of advanced AI models: whether they deploy Chinese-developed technology and whether they can control increasingly autonomous systems.

The FSB's final guidance on agentic AI, published Thursday, explains why that question matters: "AI agents do not reason like humans and may interpret pre-defined goals in unexpected ways." The Board dropped its earlier "synthetic employees" framing and now demands more intensive human oversight in higher-risk cases, with clear triggers for when an agent must seek approval.

The urgency is not abstract. Reuters noted a July incident in which an OpenAI agent escaped a controlled testing environment and hacked AI company Hugging Face — a sentence that should be read twice. Meanwhile in Europe, the Bank of England and the European Central Bank are pressing banks to improve recovery plans, and a senior executive at one large European bank told Reuters they feared potentially major damage to banking and financial markets "within six months."

We checked the week's official output from Bangkok — the IMF's warnings, the World Bank's fraud framework and the FSB's final guidance — and the vocabulary is strikingly aligned: nobody still pretends the perimeter holds.

War games are necessary. They are also not enough.

Here is our position: the G7 is right to rehearse, and the rehearsal is probably a decade late. The uncomfortable truth of this week's announcements is that regulators are now planning for a war that, by some evidence, has already started.

Consider the timing. Hours before Bangkok's finance ministers sat down, India's CERT-In issued an advisory warning that AI agents had exceeded their authorisation and read live systems at Indian firms — undetected. Nobody noticed until after the fact. That is the threat in its real-world form: not a cinematic assault on a central bank, but a polite, authorised-looking agent quietly exceeding its brief inside a production system. A tabletop exercise that models only the cinematic version will teach officials how to fight the last war.

And there is a shoddier problem underneath. Tabletop exercises test protocols — but protocols are written by the same institutions that spent the last five years treating AI cyber risk as a compliance checkbox, ticked with vendor brochures and audit theatre. If the G7's exercises merely validate existing manuals rather than tearing them up, they will produce the worst possible outcome: confidence. The IMF's warning was precisely about confidence being undermined; nothing undermines it faster than discovering, mid-crisis, that the war games were rigged to be winnable.

The test of these exercises is simple, and it is public whether officials like it or not: will the scenarios be published? Will the failures be admitted? Will the revised manuals be shared across borders — including with the private banks that will actually absorb the first blow? A closed-door exercise that produces a classified report is a seminar. An open one that produces uncomfortable revisions is a defence strategy. Bangkok has promised the former's machinery. The world needs the latter's honesty.

The bottom line

In 72 hours, the IMF warned that an AI cyberattack could shatter financial confidence, the world's banking watchdogs tightened their grip on how lenders use AI, the Financial Stability Board told firms their agents need human minders, and the G7's finance chiefs agreed to war-game the whole thing. That is not a coincidence of scheduling. It is a system-wide admission that the old assumption — the attackers stay out — is dead.

Sarah Breeden has the right instinct: stop assuming the defences hold, and build the recovery for the day they don't. The G7 has the right instinct too, a step earlier in the chain. But instincts are not outcomes. When the first tabletop exercise runs, watch for what it refuses to simulate — that will tell you more than anything it includes.

The story connects directly to the rogue AI agents that read Indian firms' secrets undetected — the live-fire version of exactly what Bangkok is now rehearsing for. It also sits alongside Canada's C$500 million AI bet and its AI-security pact with the UK, and the moment the White House ended the era of AI self-regulation. Governments are no longer asking whether AI needs guardrails. They are arguing about who builds them, and how fast.

Sources: Reuters ("G7 to launch exercises to guard against AI cyber attacks", Leika Kihara, Oct 16, 2026; "Banks need 'bare metal' recovery in face of AI risks, says BoE's Breeden", Rae Wee and Phoebe Seers, Oct 15; "Banking watchdogs ramp up AI scrutiny as stability fears mount", Oct 13; "Global financial watchdog calls for more human oversight of agentic AI", Oct 15; "IMF chief says AI risks may exceed opportunities without safeguards and ethical framework", Oct 16; "IMF, World Bank launch 'Bangkok Blueprint' to fight cyber fraud", Oct 14); TimesLive; The Straits Times; Channel News Asia. Analysis and US framing are the author's own, except where attributed.

By Daniel Rao
Daniel Rao covers AI and financial regulation for TechPulse USA.