Commercial AI models reportedly used to automate attacks on 400 banks: fraud at scale is the risk that has already arrived

Hackers used the AI models Claude (Anthropic), Grok (xAI) and Gemini (Google) to automate cyberattacks against 400 banks, according to the brief note we have. The note does not explain how the attacks worked, whether any succeeded or what damage they caused, so we won't speculate.

The number of targets is the telling part. Attacking 400 institutions points to scale rather than sophistication. AI's main contribution here is probably letting a small group run a campaign that used to need a large team. It also matters that three competing companies' models are named. The problem is not one provider's failure. It is a structural gap in all general-purpose models that can act as agents, meaning they carry out multi-step tasks on their own.

Our reading: this fits a thesis we have already laid out. Agentic AI industrializes fraud and espionage, and that is a short-term risk to govern now, not science fiction. In practice, labs need better abuse detection and banks need to adopt AI for defense at the same speed. In the long run the same capability strengthens defense: models that find vulnerabilities can also fix them. Which side wins depends on how fast defenders move.