Frontier AI is speeding up cyberattacks on Canadian banks, federal regulator warns
Canada’s federal banking regulator says the newest artificial intelligence systems are making cyberattacks on financial institutions faster, cheaper and more sophisticated, and that banks and insurers have less time than ever to respond.
The Office of the Superintendent of Financial Institutions (OSFI), which oversees federally regulated banks, insurers and pension plans, devoted its mid-year risk update, published Oct. 8, almost entirely to “frontier AI”: the most advanced and capable AI models available. The update says the pace of AI development “has accelerated materially” since OSFI’s annual risk outlook in April.
“The rate of change in capabilities created by frontier AI is unprecedented,” the regulator writes.
Attacks that chain small weaknesses together
OSFI’s main concern is cyber risk. It says AI models, including those that can act autonomously, put attack techniques that once required serious technical expertise within reach of far more people.
The most advanced models can find and exploit more security holes, and can “rapidly and autonomously chain together multiple vulnerabilities across interconnected systems.” In other words, a string of minor weaknesses in different systems or suppliers can be combined into a high-impact attack. The time between a vulnerability being discovered and being exploited has shrunk, OSFI says, leaving institutions less time to understand new capabilities and put defences in place.
The same technology can also help defenders find and patch holes before attackers do. OSFI says keeping pace on cybersecurity and finding vulnerabilities is the area of innovation it now considers most important.
Reliance on a few foreign tech giants
The regulator also flags a concentration problem. A small number of companies dominate both the development of frontier AI models and the cloud infrastructure they run on. If one of them suffers an outage, a cyberattack or another failure, many institutions could be hit at once.
OSFI raises “technology sovereignty” too. Many of these services are based outside Canada, and banks’ cross-border dependence is likely to grow as they adopt more AI. Geopolitical tensions, including foreign technology restrictions and policy decisions, could affect Canadian institutions’ access to critical services, OSFI warns.
It adds that as AI evolves, institutions may struggle to keep track of how their key suppliers are using AI and what vulnerabilities that creates.
Risk in falling behind
The update also argues there is a reputational risk in moving too slowly. Institutions and their suppliers need to “remain at the forefront of technological advancement” to avoid the risks of delayed adoption, OSFI says. Where they do use frontier AI, governance, controls and testing need to keep up. Boards and senior management remain accountable for managing the risks.
“In an era of advancing AI capabilities, resilience is a competitive advantage,” Superintendent Peter Routledge said in a statement.
A tougher backdrop
The AI warnings come on top of the four main risks in OSFI’s April outlook, which it says remain relevant: real estate secured lending and mortgages, risks from non-bank financial institutions, funding and liquidity, and “other risks.” The update notes that domestic economic conditions have softened. It also says the trade war with the United States is discouraging business investment and adding to market volatility, and that conflict between the U.S. and Iran has raised concerns about energy supply disruptions. Earlier this year, OSFI lowered the Domestic Stability Buffer, a capital cushion big banks must hold, to support continued lending.
Even so, OSFI says Canada’s financial system “remains resilient,” with strong capital and liquidity.
What OSFI is doing
This year, OSFI has issued two technology risk bulletins, one on generative and agentic AI and one on frontier AI. It has held sessions on AI-enabled cyber threats with the Canadian Centre for Cyber Security. It also co-hosted a national security threat forum for financial institutions with CSIS and the Communications Security Establishment. With the Financial Stability Board, it co-authored draft international guidance on responsible AI adoption, released for consultation in June.
The regulator says it will continue to assess the system-wide risks of financial institutions depending on the same few technology providers, and is working to build its own capacity to supervise how banks deploy frontier AI.
Source: Office of the Superintendent of Financial Institutions, “Annual Risk Outlook – Semi-annual update – Fiscal Year 2026-2027,” Oct. 8, 2026, and accompanying news release.
