Wall Street Is Preparing For An AI Catastrophe. Major Banks Discussing How to Deal With The Day After.

America's largest banks are preparing for the possibility of a major artificial intelligence-related cybersecurity incident, developing plans to keep financial services operating even if existing defenses fail.

The preparations include securing customer accounts, restoring access to banking services and managing communications during a serious disruption, according to an Axios report.

The report did not identify an imminent threat or evidence of a large-scale AI attack affecting customer funds. However, the contingency planning comes as increasingly capable AI models gain the ability to identify software vulnerabilities and carry out sophisticated cyber operations.

Banks are also examining the risks associated with AI agents accessing financial accounts through credentials voluntarily supplied by customers. Some automated tools have reportedly performed actions beyond their users' instructions, raising concerns about access controls and potential liability.

The two issues are distinct. Unauthorized activity by an AI assistant does not necessarily constitute a cyberattack, while a large-scale breach could disrupt multiple banking services regardless of whether customers use such agents.

Financial institutions already operate under regulatory expectations requiring them to maintain business continuity and disaster recovery procedures.

The Federal Financial Institutions Examination Council has established guidance covering how banks prepare for technology failures, cyberattacks and interruptions involving outside service providers.

Its Business Continuity Management framework addresses essential operations, system recovery, communication strategies and the testing of emergency procedures.

The AI-related scenarios described by Axios extend that established planning to emerging technological threats. Banks are considering how they would regain control of affected systems, maintain critical services and reassure customers during recovery.

JPMorgan has already restricted certain third-party AI agents from accessing customer accounts while exploring more secure ways to connect outside applications.

A bank spokesperson warned customers against sharing their passwords with such tools, saying secure financial data-sharing services can provide access without exposing login credentials.

Despite the concerns, banks have not reported evidence of a widespread AI-related breach affecting customer funds, Axios said. Major financial institutions are also participating in efforts to use powerful AI models to strengthen their defenses.

JPMorganChase joined Anthropic's Project Glasswing, launched in April to identify and address vulnerabilities in software supporting critical infrastructure. Other participants include Microsoft, Google, Amazon Web Services, Cisco, CrowdStrike and Palo Alto Networks.

The initiative provides selected organizations with access to Claude Mythos Preview, an advanced AI model capable of identifying and exploiting software weaknesses.

Anthropic initially committed up to $100 million in usage credits and $4 million in donations to open-source security organizations.

Cyberattacks are not the only potential disruption financial institutions are examining. In a September analysis, Apollo Global Management Chief Economist Torsten Slok raised the possibility that AI agents could accelerate withdrawals by automatically moving customer deposits into accounts offering higher interest rates.

Such software could allow users to compare returns and transfer funds more quickly than they would through traditional banking applications.

Slok's scenario was hypothetical and did not involve a confirmed bank run or malicious cyber activity. The issue has also drawn attention from former White House AI adviser David Sacks, who has argued that banks should support customer-authorized AI agents while allowing users to grant, restrict and revoke access.

Meanwhile, AI companies are preparing for potential political and regulatory responses to a serious incident. An earlier Axios investigation reported that major developers were considering how to respond to public backlash following a significant AI-related security failure.

The extent of coordination between financial institutions, AI developers and federal authorities on such contingency plans remains unclear.

Existing banking regulations already provide a foundation for emergency responses. The Office of the Comptroller of the Currency, Federal Reserve and Federal Deposit Insurance Corporation have outlined operational resilience practices covering critical services, information systems and third-party dependencies. The guidelines address severe operational disruptions broadly rather than establishing a separate framework for AI-related incidents.