“AI could alter the speed, scale and economics of cyber risk.” That’s Andrew Bailey, governor of the Bank of England and chair of the Financial Stability Board, in a letter to the G20. Not a think piece. Not a vendor blog. A letter to finance ministers and central bank governors about what frontier AI models might do to the global financial system.
My first reaction was mild surprise, then something closer to recognition. I spend most of my week testing agent frameworks, orchestration layers, and whatever new wrapper promises to automate your back office. The failure modes I write about are usually small and embarrassing: an agent that loops forever, a tool call that silently drops half its arguments, a RAG pipeline that confidently cites a document that does not exist. Bailey is describing the same class of problem scaled up until it touches settlement systems.
Speed, scale, and economics is a precise phrase
Those three words are doing real work, and they map neatly onto what actually breaks in production.
Speed. The gap between “someone found a weakness” and “someone exploited it at volume” keeps shrinking. Anyone who has watched an agent chew through a task list knows how fast automated iteration moves compared to a human doing the same work by hand. That asymmetry cuts both ways, and defenders do not get exclusive access to it.
Scale. Most tools I review are built on a handful of the same foundation models. That is convenient for developers and unnerving for anyone thinking about correlated failure. When thousands of firms run similar reasoning behind similar guardrails, a shared flaw is not thousands of independent incidents. It’s one incident with thousands of addresses.
Economics. This is the part toolkit reviewers understand better than most. The cost of doing a competent-looking thing has collapsed. That’s why the space is flooded with products. It’s also why the cheap version of an attack is now viable at a volume that used to require a funded team.
What this changes about how I evaluate tools
Reporting on a warning is easy. Turning it into something useful for a buyer is harder. So here is where my scoring is shifting.
- Model concentration gets named, not buried. If a product is a thin layer over one provider, that belongs in the review, along with whether swapping providers is a config change or a rewrite.
- Auditability outranks demo polish. A tool that logs every tool call, prompt, and retry in a form a human can reconstruct beats a prettier tool that produces no trail. Central bankers care about this for regulatory reasons. You should care about it because it’s the only way to debug an agent that made a bad decision three hours ago.
- Failure behavior is a feature. What does the agent do when the API times out, the credential expires, or the retrieved document is garbage? Solid tools stop and escalate. Weak ones improvise.
- Permission scope is not an advanced topic. Plenty of agent frameworks still default to broad access because narrow access makes the quickstart harder. That’s a tradeoff being made on your behalf, without a conversation.
The part that should not get lost
A warning from a central bank governor tends to get read two ways, both wrong. One camp treats it as proof that AI is dangerous and progress should stop. The other treats it as regulatory noise from institutions that don’t build anything. Neither reading is useful if you’re the person choosing what goes into your stack next quarter.
The more honest reading is narrower. Bailey is pointing at systemic risk, meaning risk that emerges from how these systems interact rather than from any single tool being bad. That’s an unusual framing for this industry, which almost always evaluates products one at a time. My own reviews are guilty of it. I test a tool, I score it, I move on. What I rarely test is what happens when everyone runs the same tool.
I don’t have a clean answer to that, and I’m not going to pretend otherwise. What I can do is be more specific about dependencies, more skeptical of products that hide their plumbing, and more direct when a tool’s convenience comes from removing a safety step rather than solving a hard problem.
Where this leaves buyers
If you’re shipping AI into anything that touches money, the practical takeaway is unglamorous. Know which models you depend on. Know what your agents are permitted to do. Keep records you can actually read. Assume the cheap attack is now affordable.
None of that requires a G20 letter to justify. It’s the same advice I’d give about any tool that acts on your behalf. The letter just means the people who supervise banks have reached the same conclusion, which is either reassuring or unsettling depending on your mood.
đ Published: