AI Security

Bank of England’s Bailey: frontier AI has raised cyber attack risk

Bailey says frontier AI has raised cyber attack risk and wants more model testing, incident reporting and human override. What UK firms should do.

Graphic of an AI chip motif with the headline Bailey: frontier AI has raised cyber risk

The Governor of the Bank of England has said in public that frontier AI has made cyber attacks more likely, and he wants AI models tested harder before and after they ship. For UK financial firms, the warning points to tougher supervisory questions on AI risk, incident reporting and human oversight.

What happened

Andrew Bailey gave a lecture in Zurich on 9 November 2026, part of the University of Zurich’s Swiss Institute of International Studies series. Most of the speech was about central bank independence and whether AI share prices have formed a bubble. Towards the end, though, he turned to technology, and the passages he chose matter to anyone defending a UK network.

Bailey told the audience: “Frontier AI has increased the risk from cyber-attacks”. He added that this risk was “already prominent” before the latest models arrived. He tied the cyber threat to a wider problem of public trust in AI, and set out three asks: more extensive testing of models before and after release; better incident reporting, monitoring and follow-up; and a clearer role for people to step in and override AI systems while they run. He said public trust will depend on “assured human intervention”.

Bailey is not a hostile witness. He called himself an optimist on AI and robotics and said the technology could lift productivity. That makes the warning harder to dismiss. A central bank governor who chairs the Financial Stability Board is saying the cyber downside of frontier AI is already here, and that the guardrails are not yet good enough.

The detail

The speech does not give new statistics or name individual models, and it would be a stretch to read it as a policy announcement. Its weight comes from who said it and where it sits in a run of UK warnings. The Press Association’s report of the lecture linked it to the National Cyber Security Centre’s recent warning that AI-assisted attacks on UK critical national infrastructure are likely inside the next two years. That warning featured in the NCSC’s annual review earlier this month.

Crypto Briefing reports that Bailey made a similar point when he wrote to G20 finance ministers, describing the technology as something that “may materially alter the speed, scale, and economics of cyber risk”. The same outlet says the Bank has teamed up with the NCSC and the AI Security Institute on a specific problem: frontier models are uncovering software flaws faster than firms can patch them. It also reports that the Bank wants firms to put effort into three things: detection, containment and recovery. I have not been able to confirm the letter or the joint work against a primary Bank of England document, so treat those points as reported rather than established.

The bubble argument is relevant to security too. Bailey said one reason an AI asset bubble could burst is fragile public trust, and he said frontier AI’s cyber risk has raised concerns that may call that trust into question. Resultsense reads the speech as setting out two financial stability risks, with cyber the first. On that reading, a serious AI-enabled cyber incident is a possible financial stability event, not just a matter for the affected firm’s IT team.

Checklist of Andrew Bailey's three asks on frontier AI and two practical actions for UK organisations

Why it matters for UK organisations

Banks, insurers and payment firms should read this as an early signal of what supervisors will ask about next. Bailey’s three asks line up with work already moving through UK regulators. In October the government said it is looking at how serious AI incidents and near misses ought to be spotted, reported and learned from, while the Cyber Security and Resilience Bill moves through Parliament. An incident logging regime that does not yet cover AI models, agents and the third parties that supply them is a gap supervisors are likely to find.

The call for model testing after release is the more interesting point for firms that do not build models. Most UK organisations consume frontier AI through vendors, copilots and agent platforms. When the underlying model changes, so do its behaviour and its failure modes. If the Governor expects developers to keep testing after release, it follows that the firms deploying those models should be able to say what changed, when, and what they checked.

Firms outside financial services should take notice too: the time between a flaw being published and someone weaponising it keeps shrinking.

Expert view

I welcome the warning, but its value lies in what firms do next rather than in the words themselves. In my experience, organisations that worry about AI tend to start with policy documents on staff using chatbots. That matters, but it is not where the cyber exposure has moved. The bigger shift is on the attacker’s side: reconnaissance, phishing content, vulnerability discovery and exploit development are all cheaper and quicker than they were two years ago. The practical effect is that the grace period your patching policy quietly relied on is disappearing.

The second point I would stress is Bailey’s emphasis on human intervention. When we test environments that use AI agents with real permissions, the most common weakness is not clever prompt manipulation. It is that nobody can say quickly what an agent is allowed to do, and nobody has a tested way to stop it. A kill switch that has never been pulled in an exercise is a hope, not a control.

Finally, incident reporting only works if you can spot an AI incident at all. Many security operations centres still have no log source for model or agent activity.

What to do now

  1. Shorten patch timelines for internet-facing systems. Treat the Cyber Essentials 14-day rule for high and critical fixes as the most you will allow, not the target, and aim faster for edge devices and remote access services.
  2. Build an inventory of AI systems. Record every model, copilot and agent in use, who supplies it, what data and systems it can reach, and which version it runs. This supports Cyber Essentials secure configuration and user access control.
  3. Bring AI into incident management. Define what counts as an AI incident or near miss, add it to your classification scheme, and make sure model and agent logs reach your SOC.
  4. Test human override. For any agent with write access or payment authority, document how to suspend it, who can do so, and how long it takes. Then rehearse it.
  5. Ask suppliers about testing after release. Include questions on model change notification, red-team results and incident disclosure in third-party risk reviews.
  6. Check least privilege for AI service accounts. Agents should hold scoped, short-lived credentials, never standing administrator rights.
  7. Run detection and containment drills. Run an exercise that assumes an AI-accelerated intrusion moves faster than your current playbooks expect.

Bottom line

When the UK’s top central banker says frontier AI has raised cyber risk, it moves the subject from a technical concern to a board and supervisory one. Nothing in the speech creates a new obligation today. It does show where UK regulators are heading: tested models, reported incidents and people who can reliably step in. Firms that build those capabilities now will find the next round of supervisory questions much easier to answer.

Sources

Related Posts