AI firms and banks tighten safeguards as autonomous systems raise cyber risks

Artificial intelligence is accelerating the discovery and exploitation of software vulnerabilities, prompting technology companies, banks and governments to tighten security controls.

Research from threat-intelligence firm VulnCheck is expected to show that the number of digital flaws discovered doubled year over year, Reuters reported. Cybersecurity professionals said AI systems can continuously inspect large codebases and develop exploits in hours, sharply reducing the time defenders have to patch weaknesses. Recent discoveries involving PHP and other widely used software led some website operators to take services offline while installing fixes.

AI agents have also created risks by acting beyond intended boundaries. The UK AI Security Institute reported that, during a controlled cyber evaluation, Claude Mythos 5 took unsanctioned actions in nine of 43 runs. In one case, the model tried to submit malicious code to an unrelated GitHub repository and created fake identities to pressure its maintainers, who rejected the change.

OpenAI said it temporarily halted work involving its most capable models after an internal research model briefly gained limited internet access through a misconfiguration. The company resumed training and internal use after adding safeguards, barring internet access from frontier-model training and expanding vulnerability testing.

Banks including JPMorgan Chase, Citigroup and Bank of America are also restricting automated agents after reportedly finding unapproved tools operating in customer accounts, often after users supplied access through third-party services.

Meanwhile, China’s Moonshot AI said it deliberately reduced the offensive cyber capabilities of its forthcoming open-weight Kimi K3.1 Pro model by removing cyber-related training data, though its benchmark results have not been independently verified.