The G7’s finance authorities are preparing to put artificial intelligence into a crisis exercise. Finance ministers and central bank governors have approved tabletop simulations of AI-enabled cyberattacks, with possible participation by private financial institutions. The reported aim is to test existing response procedures and revise manuals—not to predict one exact attack technique.[1]
This is a continuation rather than a first rehearsal. In May, the G7 Cyber Expert Group ran a large cross-border exercise involving finance ministries, central banks, bank supervisors and market authorities across all seven jurisdictions. That exercise focused on coordination, recovery and crisis communication after a major cyber incident. The new decision asks what changes when attackers, defenders or the affected systems themselves use more autonomous AI.[2][1]
What an AI-focused tabletop should force participants to decide
| Scenario pressure | Decision the exercise should test | Why AI changes the timing |
|---|---|---|
| A model finds and exploits the same flaw across several banks | Who declares a systemic incident and coordinates containment across borders? | Machine-speed discovery can compress separate local failures into one shared eventSource 3Source 4 |
| A deepfake executive authorises a transfer or public statement | Which channel establishes identity and who can halt a high-value action? | Synthetic media can arrive during the confusion of a real outageSource 3 |
| A common AI or cloud provider fails | Which services are critical, substitutable and safe to reconnect? | Concentration can spread one provider failure across many institutionsSource 3Source 4 |
| Defensive AI recommends blocking legitimate traffic | Who can override the model and preserve essential payments? | Fast automated defence can create its own operational disruptionSource 3Source 4 |
| Conflicting public accounts circulate | Which authority communicates what is known, unknown and changing? | Generated content can flood the information environment before facts are stableSource 2Source 3 |
The hard test is authority under uncertainty
A tabletop exercise does not prove that firewalls work or that a bank can restore a database. It places decision-makers around a simulated timeline and asks who has the authority to act when information is incomplete. Can one supervisor tell a bank to disconnect a shared service? Who warns another country without exposing sensitive details? When does a central bank decide that an operational incident threatens liquidity or confidence?
AI makes those governance questions sharper because it increases scale and speed. The IMF argues that the main financial-stability concern is often not a wholly new species of attack, but the ability to discover vulnerabilities, generate lures and repeat actions across common infrastructure faster than human teams can respond. The same technology can improve anomaly detection and triage, so the exercise also needs to test how authorities trust defensive AI without delegating judgment to it.[4][3]
A useful exercise ends with changed procedures
- Record the decisions that were delayed because no agency clearly owned them.
- Identify data that could not be shared quickly across borders or with private firms.
- Test a reconnection sequence rather than ending when the attacker is contained.
- Separate failures of technology from failures of communication, authority and staffing.
- Repeat the scenario after changing one assumption—such as the identity of the compromised provider—to see whether the plan is robust.
Sources & further reading
- G7 to launch exercises to guard against AI cyber attacks Reuters · 16 Oct 2026 · Accessed 16 Oct 2026
- G7 Cyber Expert Group 2026 Cross Border Coordination Exercise HM Treasury · 31 Jul 2026 · Accessed 16 Oct 2026
- G7 cyber expert group statement on Artificial Intelligence and Cybersecurity HM Treasury · 6 Oct 2025 · Accessed 16 Oct 2026
- Artificial Intelligence and Cybersecurity in the Financial Sector International Monetary Fund · 30 Jun 2026 · Accessed 16 Oct 2026