The world's richest economies are about to do something usually left to airline pilots and generals: rehearse a disaster before it happens.
G7 finance ministers and central bank governors, meeting in Bangkok on the sidelines of the IMF's annual meetings, have agreed to run tabletop exercises simulating AI-driven cyberattacks on the financial system. Japan's finance minister, Satsuki Katayama, told reporters on Thursday that the plan, worked up by G7 finance deputies, had been signed off at ministerial level.
Each G7 financial authority will design its own simulations, and commercial banks could take part depending on the scenario, a Japanese finance ministry official told Reuters. According to the Financial Times, the drills are meant to stress-test governments' emergency playbooks for a major cyber event. Scenarios could include AI-boosted intrusions and attacks on AI infrastructure itself.
The G7 is already in heavy Cyber preparation mode - its Cyber Expert Group ran a cross-border cyber crisis exercise in May involving finance ministries, central banks and market regulators from all seven countries. That same month, Katayama said ministers had agreed to step up monitoring of cyber risk and develop concrete measures on frontier models, naming Anthropic's Mythos. What's new is the explicit focus on AI as the attacker's weapon.
The IMF ‘s October 2026 Global Financial Stability Report has ranked a major cyberattack alongside an AI-driven market correction and rising government borrowing costs as three risks that could abruptly tighten financial conditions worldwide.
The speed problem is rising too. In more than 70% of reported cases so far this year, software providers had almost no time to patch a vulnerability before attackers exploited it, the IMF said. That is up 20 percentage points from 2025 and more than double the share in 2021.
Caio Ferreira, deputy chief of the IMF's global markets analysis division, told the FT that heavy reliance on third-party technology providers creates chokepoints where one disruption could ripple through the system. Even without big financial losses, he warned, "the loss of confidence could be a systemic event in itself."
"We are all staring at the same black box," Dutch finance minister Eelco Heinen told the FT. His point: a handful of countries control the technology, but every economy is exposed to it.
South Korea offered a live example on Oct. 6, when President Lee Jae Myung said signs had emerged that AI was used in recent hacks on commercial banks. The breaches exposed customers' personal information and triggered a full police investigation, though officials have not named the AI tools involved.
In the UK, the Financial Conduct Authority's Sept. 2 review of frontier AI and cyber resilience found that the models are surfacing flaws faster than many firms can validate and fix them, and can chain low-rated weaknesses into new routes of attack. On Thursday, the Bank of England's deputy governor said banks can no longer assume their defenses are immune to AI-enabled attacks, Reuters reported.
Read next: The Fed just doubled its AI risk warning. Here's what it means for US cyber insurers
Andrew Bailey, Bank of England governor and chair of the Financial Stability Board, has already told G20 finance ministers that frontier AI's impact on cyber risk is the most immediate threat to global financial stability. In Bangkok he called for more rigorous model testing and higher safety standards, the FT reported.
US banks have been on alert since spring. Days after Anthropic announced Mythos Preview on April 7, Treasury Secretary Scott Bessent and Fed Chair Jerome Powell met with major bank CEOs to discuss the model's cyber risks.
The cleanup is costly. Bank of America has put 1,000 contractors and 3,000 employees to work fixing software flaws found by Mythos and other frontier models, CEO Brian Moynihan told CNBC. JPMorgan Chase CEO Jamie Dimon has said cyber risk rose tenfold when Mythos was released.
Market sentiment has shifted with it. In the Fed's May Financial Stability Report, half of the roughly 20 market contacts surveyed named AI as a salient risk to the financial system, up from 30% six months earlier.
For insurers, the G7's scenarios read like a cyber catastrophe model come to life. One compromised vendor or widely used software component knocking out thousands of policyholders at once is the aggregation event underwriters fear most. It is also the worry that has put Anthropic's Mythos at the center of cyber risk aggregation fears since April.
Modelers are adjusting. Cyber analytics firm CyberCube warned in April that AI concentrated across cloud platforms and model providers could raise portfolio aggregation risk, and urged catastrophe modelers to build AI dynamics into their work. Its threat intelligence director, William Altman, said AI is "compressing the cyberattack lifecycle." In September the firm added six AI event families to help carriers assess where AI-driven losses could land.
Swiss Re takes a more measured view. Fabian Willi, its head of cyber key accounts, has said AI is amplifying familiar cyber risks rather than creating new ones, and that AI-related claims remain limited for now. But the reinsurer's latest cyber market report questions whether large US companies, which buy average limits of about $120 million, are buying enough. Some may need to double them, it said.
Read next: Can cyber insurance survive the Mythos shock?
Trevor Jones, a partner in West Monroe's insurance practice, has warned that AI is shrinking the gap between a vulnerability's discovery and a financial loss, which "creates pressure on cyber models that were built for a slower-moving threat landscape." Westfield Specialty's Jeff Kulikowski has countered that carriers have spent years modeling systemic events and are now recalibrating those models for AI, while conceding that the market hasn't seen anything yet.
Pricing, however, has not followed the headlines. US cyber rates fell 2% in the second quarter, according to Marsh's Global Insurance Market Index, and have been falling since mid-2023. Globally, cyber rates have now declined for 12 straight quarters.
Policy wording is the other pressure point. Law firm DAC Beachcroft has noted that most cyber policies don't mention AI at all, leaving open the question of whether AI-enabled losses are silently covered.
Read next: Dimon says AI cyber risk is up tenfold. Cyber insurance prices are still falling
The G7 drills will test governments' playbooks, but brokers can test their clients' programs now:
Officials have not said when the G7 drills will run or which financial institutions will take part. But the weaknesses they expose are likely to shape what supervisors demand of financial institutions, and by extension what underwriters ask at renewal. For carriers still cutting cyber rates, that could be the moment the market's pricing and its threat picture finally meet.
