While frontier artificial intelligence models strengthen both cyberattacks and cyber defense, the financial costs for both are “asymmetric” and may favor attackers, according to a new bulletin published by the Bank for International Settlements.
Frontier AI models, such as Anthropic’s Mythos, can identify weaknesses in software and hardware systems and develop exploits to exploit them. Depending on the model used, the cost of launching an attack ranges from $10,000 to as little as $50, according to BIS. Still, attackers only need to find a single entry point into a system, whereas defenders must protect all their systems.
“Tools that cut the cost to find and exploit that route can therefore shift the balance towards offence even when both sides adopt frontier AI models at the same pace,” BIS said. “Market intelligence also suggests that cyber defence strategies may increasingly imply larger costs for compute, given the need to detect and respond to (cheaper and more frequent) attacks.”
One possible solution is for the financial industry, central banks and financial supervisors to collaborate with national security agencies and other stakeholders to accelerate vulnerability remediation, strengthen core cyber hygiene practices, and address exposures from in-house software dependencies, legacy systems, open-source code, third parties and internet-facing assets, according to the bulletin.
“The same tools that lower costs for attackers can be used defensively, to find and fix flaws in firms’ own systems before others do,” BIS said. “Engaging critical suppliers, including cloud providers, and updating exercises to simulate third-party software compromises and compressed attacker timelines are also important.”
