Hackers turned Claude, Grok and Gemini on 400 banks: AI's biggest near-term danger is automated fraud

The report says attackers used Claude (Anthropic), Grok (xAI) and Gemini (Google) to automate cyberattacks against 400 banks. That's the full extent of the source material. It doesn't say which banks were hit, whether any attack worked, what the losses were or who was behind it. We won't fill those gaps with speculation.

One detail still matters a lot: the number 400. A team of people working by hand would struggle to run a campaign against hundreds of financial institutions at once. What AI changes here is scale. It doesn't need to invent a new kind of attack. It just runs the familiar steps, like reconnaissance, adapting scripts and repeated attempts, much faster and more cheaply.

It also matters that three different providers' models are named. That points to a problem for the whole industry, not one company's failure. Models built to help programmers, analysts and support staff can be put to other uses. This is what dual use means: the same capability serves the defender and the attacker. The report doesn't suggest any of these companies helped the attackers, and nothing here should be read that way.

Our take: this fits a thesis we keep coming back to. AI's most concrete security risk is short-term and fairly mundane. It's the industrialization of fraud and intrusion, not a far-off superintelligence. That's why the right response isn't panic regulation. It's evidence-based governance: providers detecting and blocking abusive use, sharing information with the financial sector, and putting the same automation to work on defense. Banks have the money and the incentive to use AI to find and fix weak points faster than attackers can exploit them.

In the long run, we expect defense to win this race, as long as it's taken as seriously as offense. In the short run, we should be honest: the transition will be rough, and cases like this will keep coming.