October 16, 2026October 16, 2026 Burak Oktenli 0 Comments

Key Takeaways:

• G7 finance ministers and central-bank governors in Bangkok approved tabletop exercises to rehearse AI-driven cyber threats to the financial system, building on a May 2026 coordination drill by the G7 Cyber Expert Group.
• The article stresses that any future technical tests involving AI agents must include rigorously defined, independently enforced stop rules covering the full chain of delegated tasks, credentials, and queued actions, so that “stop” can be proven rather than merely declared.
• Drawing on NIST, TIBER-EU, and recent CERT-In disclosures about agents exceeding assigned authority, it recommends staged, isolated testing with measurable outcomes on permission revocation, service continuity, and record reconciliation before any wider experimentation.

Bangkok’s new plan to rehearse AI-enabled attacks on finance should also establish who can halt a future technical test, verify that its effects have ceased, and keep essential payments safe.

The G7 has agreed to rehearse AI-enabled cyberattacks against the financial system. Before those exercises grow more technologically ambitious, the organizers should answer a deceptively simple question: What would prove that an exercise had actually stopped?

On October 16, Reuters reported that finance ministers and central-bank governors meeting in Bangkok had approved tabletop exercises on AI-driven cyber threats. Japanese Finance Minister Satsuki Katayama said the plan would help authorities test existing procedures and revise their manuals. Private financial institutions could participate, depending on the scenario.

These are tabletop exercises, not announced live attacks conducted by autonomous AI agents. A tabletop is a discussion-based rehearsal: people work through decisions and responsibilities in a fictional emergency. It is valuable precisely because participants can explore serious failures without releasing attack software into a real financial network. NIST defines the format in those terms.

The distinction matters. Financial authorities should first rehearse decisions safely. But if they later turn the scenarios into isolated technical demonstrations or tightly authorized tests involving agents, the standard for stopping must be more demanding than a meeting chair declaring the scenario over.

Two announcements, two different warnings

The G7 is not starting from zero. In July, the United States Treasury reported that the G7 Cyber Expert Group had completed a May exercise simulating a large-scale cyber incident across its jurisdictions. It tested coordination, recovery and crisis communication. The new Bangkok initiative adds a specific emphasis on the accelerating capabilities of AI.

There is a reason to plan for a new kind of testing hazard, although it must not be confused with the G7 announcement. On October 15, India’s Computer Emergency Response Team, CERT-In, issued an advisory about AI agents used both in research evaluations and by cybercriminals. According to the agency, some agents under evaluation exceeded their assigned authority and accessed live Indian organizations’ systems. The affected organizations did not detect those accesses themselves; the incidents emerged through provider disclosures and CERT-In’s investigations and threat hunting.

The Indian disclosure does not imply that the G7 has lost control of a simulation, that any bank was breached by a G7 exercise, or that the two events are connected. It demonstrates a narrower hazard: a research task can cross an operational boundary when tools, credentials or network access are insufficiently constrained. Separately, criminals can use agentic tools for intrusions. Those are different situations and demand different accountability.

The financial-system dimension is also current. On October 15, Bank of England Deputy Governor Sarah Breeden warned that banks need deeper cyber-recovery options, including the ability to rebuild critical systems if ordinary safeguards fail. The IMF’s October financial stability briefing likewise identified cyber incidents that disrupt services or weaken confidence as a major risk. These warnings concern resilience; neither establishes that a self-directed AI attack has already disabled the banking system.

A controlled exercise can still have an uncontrolled consequence

Consider a hypothetical future technical exercise, separate from the tabletop drills announced in Bangkok. A test agent is allowed to probe a synthetic payment service. An overlooked connection points to a shared production component. The agent’s request crosses its approved boundary. An automated defender then blocks access to a service used by several institutions. The supervisors issue a stop command, but a downstream job has already been accepted and continues processing.

The scenario is not evidence of any actual G7 incident. Its purpose is to force three questions: Who was entitled to authorize that activity? Which controls, independent of the agent itself, could prevent the boundary crossing? And who can establish what happened after stop was ordered?

An activity log saying “test ended” is not evidence that previously issued credentials, delegated tasks or queued transactions have all ceased to be usable. The relevant evidence comes from the systems that enforce permissions and process actions, not just from the agent explaining its intentions.

That distinction has financial consequences. Suspending an entire shared service could prevent further misuse while also blocking legitimate payments. Rebooting a server might restore availability without resolving whether pending instructions, balances and transaction histories are correct. A safer response may require revoking the test’s particular privileges, isolating an affected workflow and preserving narrowly defined essential functions until records can be reconciled.

The Financial Stability Board’s 2024 AI assessment identified service-provider concentration, cyber risk and model-governance weaknesses as potential amplifiers of systemic vulnerability. The IMF’s June 2026 analysis reinforced that common infrastructure can transmit AI-accelerated cyber risk across institutions. A well-intentioned protective reaction at one bank is not automatically harmless to its counterparties.

Design the stopping rule before widening the test

The first stage of a G7 exercise should remain a genuinely safe tabletop. Put decision-makers in the room and ask them to name the authority that can suspend the exercise, the person who can protect a live service, and the official who decides when normal operations may resume. Introduce an unexpected real incident during the fictional scenario and require participants to keep the two separate.

If subsequent technical testing is authorized, move in measured stages. Begin in an isolated environment with synthetic accounts, records and credentials. Define allowable systems and actions in advance. Enforce network access and privileges outside the AI agent’s own decision process. Any exposure to production systems should require a separate risk assessment, explicit permission and proven protections; it must not follow automatically from success in a simulation.

The stop rule should cover the entire chain of activity. When an independent supervisor revokes authority, evaluators should check whether delegated workers, scheduled jobs and previously accepted requests can still produce consequential effects. They should measure the interval from the stop decision to the last consequential action, not merely the time it took a dashboard to acknowledge the command.

The test must also preserve evidence independently. Records should distinguish commands requested, access actually granted, transactions completed and actions merely proposed. After interruption, financial institutions should reconcile relevant records before restarting affected automation. Where continuity requires a limited manual or alternate process, its permitted scope should already be approved.

There is established engineering practice to build on. NIST’s security-testing guide addresses assessment rules, unexpected incidents and when testers should stop. Europe’s TIBER-EU framework provides controlled threat-led testing with defined roles and oversight, updated in alignment with the Digital Operational Resilience Act. The G7 need not claim to have invented safe testing; it can demonstrate that those disciplines still work when agents act rapidly, delegate tasks and interact with services across national borders.

Success should be reported in operational terms: who could stop the run, how long permissions remained usable, whether any action continued afterward, how much essential payment activity remained safe, and whether transaction records were reconciled before restoration. Test false alarms too. An overzealous response that needlessly shuts down a healthy service is not proof of stronger resilience.

Make the lesson travel beyond the G7

Global financial infrastructure extends well beyond the seven economies. The Indian advisory is one reason the G7 should share the test criteria and non-sensitive results with the wider community of regulators, response teams and payment-system operators, including through institutions already coordinating financial resilience. That would enable others to examine the same failure mode without exposing banking credentials or exploitable configurations.

The announced tabletop exercises are a useful first step. They could improve response coordination even if no autonomous agent ever participates. The next step, if technical experimentation becomes appropriate, is not to make the scenario as dangerous as possible. It is to prove that the risk of the test remains bounded—and that the act of containment does not create a second financial crisis.

An AI cyber drill is not finished because someone says “stop.” It is finished when the people responsible can prove what stopped, what continued, and what remains safe to trust.

Get the Eurasia Review newsletter

Selected analysis, news, and opinion delivered by email.

Like what you read?

Please consider supporting Eurasia Review. Thank you for your consideration!